Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of chirino@gmail.com designates
 72.14.220.154 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:sender:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references:x-google-sender-auth;
        b=R1qfG0yAN3OopsXOdmjug4ghoUQx1q0eEjV78AB4yg3Wev2yL7GYqDdW/Mxu45DoqB
         2xjLDOpSUJHio/mwqPLHK0hH4WSOccCt4UOEi9sbBKxu0fRbYdBlbDWpST2jlO2dVntj
         8Jzv05RUc6kb7wJAzIjRe97tKaR4uc3PgXA+Y=
Message-ID: <af2843cd0809190612l26a03571iad65544edd954372@mail.gmail.com>
Date: Fri, 19 Sep 2008 09:12:30 -0400
From: "Hiram Chirino" <hiram@hiramchirino.com>
Sender: chirino@gmail.com
To: general@incubator.apache.org
Subject: Re: status of PGP support in Maven
In-Reply-To: <14976D4F-CEEB-41D7-B1AE-1A703E14462B@SUN.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <9e3862d80809150702y7492812coa2f8f0f1deb42970@mail.gmail.com>
	 <1221697970.25066.26.camel@forge.local>
	 <14976D4F-CEEB-41D7-B1AE-1A703E14462B@SUN.com>

How about we include the signatures in the source distros?  That way
if you trust your source, then you can trust the dependencies it
downloads.

On Thu, Sep 18, 2008 at 12:22 PM, Craig L Russell <Craig.Russell@sun.com> wrote:
>
> On Sep 17, 2008, at 5:32 PM, Henning Schmiedehausen wrote:
>
>> The only way around that I can see right away in a heavily mirrored
>> system, is to pull the signatures (and probably even the checksums) from
>> central all the time. Which represents a single point of failure and a
>> non-scaling element.
>>
> I do understand the single point of failure, which means that if Apache
> central happens to be down, users cannot get to the signatures.
>
> But I don't see the scaling problem. I understand that to download an
> artifact that's more than 200 bytes, you really need mirrors to relieve the
> burden on Apache central. But I'd guess that our central server could handle
> a few hundred (thousand?) xxx.asc file downloads per minute, far in excess
> of the load.
>
> To me, the only place to store .asc files for all artifacts is in central.
> Not maven central, and not mirrors.
>
> Craig
>
> Craig L Russell
> Architect, Sun Java Enterprise System http://db.apache.org/jdo
> 408 276-5638 mailto:Craig.Russell@sun.com
> P.S. A good JDO? O, Gasp!
>
>


-- 
Regards,
Hiram

Blog: http://hiramchirino.com

Open Source SOA
http://open.iona.com

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org