Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of chirino@gmail.com designates
 209.85.134.187 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:sender:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references:x-google-sender-auth;
        b=ENim8l8cJhigOUK58e/xZHoCS+W6IkTplShkUT9C1BnEQ/ewwIpzDIUQ4R/Xfc4KC4
         eUlneQzVHidTKg5aHaM2ec8hicKppMsjOOY6fEQjuW1446r9MkKb3Kgvd/Fzsff0COAU
         YmJgz0yQnAgtiCLnO1mCiT5RlWoGz53vpq/1Y=
Message-ID: <af2843cd0809240644u49ad6c8cyd4eb0edffee9cef5@mail.gmail.com>
Date: Wed, 24 Sep 2008 09:44:36 -0400
From: "Hiram Chirino" <hiram@hiramchirino.com>
Sender: chirino@gmail.com
To: general@incubator.apache.org, henning@apache.org
Subject: Re: status of PGP support in Maven
In-Reply-To: <1222234030.24030.106.camel@forge.local>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <9e3862d80809150702y7492812coa2f8f0f1deb42970@mail.gmail.com>
	 <14976D4F-CEEB-41D7-B1AE-1A703E14462B@SUN.com>
	 <af2843cd0809190612l26a03571iad65544edd954372@mail.gmail.com>
	 <5c902b9e0809191011u72e8b83arfd6e49c5fc202214@mail.gmail.com>
	 <f470f68e0809200208r75cc59bdw74c6edf09d54f28c@mail.gmail.com>
	 <1221930522.25066.161.camel@forge.local>
	 <af2843cd0809220634w21f510e0le873d83985a473db@mail.gmail.com>
	 <25aac9fc0809220712o45d61244i20b54c80347041ab@mail.gmail.com>
	 <af2843cd0809221042gd4616e9t1db67daec28288d9@mail.gmail.com>
	 <1222234030.24030.106.camel@forge.local>

On Wed, Sep 24, 2008 at 1:27 AM, Henning Schmiedehausen
<henning@apache.org> wrote:
> On Mon, 2008-09-22 at 13:42 -0400, Hiram Chirino wrote:
>> On Mon, Sep 22, 2008 at 10:12 AM, sebb <sebbaz@gmail.com> wrote:
>> > On 22/09/2008, Hiram Chirino <hiram@hiramchirino.com> wrote:
>> >> The only reason I suggested including the sigs in the source distro is
>> >>  because a source build like Apache ServiceMix depends on hundreds of
>> >>  third party dependencies.. so an end user would need to end up
>> >>  trusting LOTs different signatures to get ServiceMix to build.
>> >>
>> >>  It would be easier if the end user could just trust the Apache source
>> >>  distro and also transitively trust the signatures that we trust for
>> >>  our dependencies.
>> >>
>> >
>>
>> I actually meant to say include the pub key for the dependency in the
>> source distro.
>
> How do you validate that the pub key presented to you is genuine? What
> you currently proposing is
>
> src-artifact <- signed with A's privkey, validated with A's pubkey
>
> A's pubkey is inside src-artifact.

NO I'm not.  I'm saying that A artifact has 100 dependencies by say 30
different signers.. we include
those 30 pub keys in the src-artifact.  NOT the A key!

You have to validate the A source distro the same way you would
validate an ANT based build source distro today.


-- 
Regards,
Hiram

Blog: http://hiramchirino.com

Open Source SOA
http://open.iona.com

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org