Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Subject: Re: status of PGP support in Maven
From: Henning Schmiedehausen <henning@apache.org>
Reply-To: henning@apache.org
To: general@incubator.apache.org
In-Reply-To: <caf30e2a0809232236q5d108603k3a605c3f2c7ab3b9@mail.gmail.com>
References: <9e3862d80809150702y7492812coa2f8f0f1deb42970@mail.gmail.com>
	 <1221697970.25066.26.camel@forge.local>
	 <14976D4F-CEEB-41D7-B1AE-1A703E14462B@SUN.com>
	 <af2843cd0809190612l26a03571iad65544edd954372@mail.gmail.com>
	 <5c902b9e0809191011u72e8b83arfd6e49c5fc202214@mail.gmail.com>
	 <f470f68e0809200208r75cc59bdw74c6edf09d54f28c@mail.gmail.com>
	 <1221930522.25066.161.camel@forge.local>
	 <af2843cd0809220634w21f510e0le873d83985a473db@mail.gmail.com>
	 <1222233612.24030.99.camel@forge.local>
	 <caf30e2a0809232236q5d108603k3a605c3f2c7ab3b9@mail.gmail.com>
Content-Type: text/plain
Date: Tue, 23 Sep 2008 23:02:32 -0700
Message-Id: <1222236152.24030.125.camel@forge.local>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit

There is a pretty nice proposal on
http://people.apache.org/~henkp/trust/, however this will again take a
piece of "freedom of doing software at Apache" away and introduce some
administrative overhead that all projects must implement and manage.

Formalizing the signing of our releases would be a huge step towards a
reliable validation for the Apache software releases. It still does not
help you with third-party releases, though.

I don't know how many artifacts are on repo. I'd guess hundreds,
probably thousands. They have all been uploaded automatically or
semi-automatically. Because validating them by hand from the bazillion
of different sources is very difficult.

I spot a startup chance here for a company offering a trusted, validated
repository where all uploaded artifacts have been verified by the
uploaders. Any VCs around? I am bored and have time to write a business
plan ;-) 

IMHO: Anyone who is using maven for commercial software development and
does not run a controlled, in-house repository that is actively managed
and maintained is IMHO in for big, ugly surprises in the long run.

	Ciao
		Henning


On Wed, 2008-09-24 at 13:36 +0800, Niclas Hedhman wrote:
> On Wed, Sep 24, 2008 at 1:20 PM, Henning Schmiedehausen
> <henning@apache.org>wrote:
> I enjoy your scenarios...
> 
> 
> > And again, there is no "high nineties" security. Your solution is either
> > secure or it is not.
> 
> 
> For accuracy; This is not true either. AFAIK, no security solution is
> totally secure. You will be left with a number game.
> 
> 
> But I agree that this is a complex and non-trivial problem. Right now, we
> just say; "No Security, check manually." and to users who don't (like
> myself) we just ask them to blame themselves for being sloppy. Fair Enough.
> BUT, somehow I feel that a bit of "help" could be in order, and I think that
> if it is not portrayed as a "secure" and that the manual check should still
> be done by the security conscious, then why not try to provide that? How can
> a step in the right direction be bad?
> 
> 
> Cheers
> Niclas


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org