Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of hedhman@gmail.com designates
 64.233.170.188 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:sender:to:subject:in-reply-to:mime-version
         :content-type:references:x-google-sender-auth;
        b=OEGN7qH+If+qQSEN8C6ft84kKyzCaFTfegC7rm0luyRKWFOyjj8PIolFzR1ucJt+Wr
         uZKBPFKiBKPeeuXaivnhx/GB0ozGbpA2HQmspav+JMJP4DUIGgAo3JANs9S6F90zbl9h
         qw30Xs+Noel1ypbN3HvuHeAkepbToWgwEevWY=
Message-ID: <caf30e2a0809240100l7f523117oc349dd82141c884d@mail.gmail.com>
Date: Wed, 24 Sep 2008 16:00:30 +0800
From: "Niclas Hedhman" <niclas@hedhman.org>
Sender: hedhman@gmail.com
To: general@incubator.apache.org
Subject: Re: Key signing practicalities Was: status of PGP support in Maven
In-Reply-To: <AAC3D14E-0B6C-4C5C-B219-72F96D056062@ecyrd.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_87153_31669231.1222243230860"
References: <9e3862d80809150702y7492812coa2f8f0f1deb42970@mail.gmail.com>
	 <f470f68e0809200208r75cc59bdw74c6edf09d54f28c@mail.gmail.com>
	 <1221930522.25066.161.camel@forge.local>
	 <af2843cd0809220634w21f510e0le873d83985a473db@mail.gmail.com>
	 <25aac9fc0809220712o45d61244i20b54c80347041ab@mail.gmail.com>
	 <af2843cd0809221042gd4616e9t1db67daec28288d9@mail.gmail.com>
	 <1222234030.24030.106.camel@forge.local>
	 <48D9D1EC.5020406@rowe-clan.net>
	 <1222235656.24030.115.camel@forge.local>
	 <AAC3D14E-0B6C-4C5C-B219-72F96D056062@ecyrd.com>

------=_Part_87153_31669231.1222243230860
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

On Wed, Sep 24, 2008 at 2:36 PM, Janne Jalkanen <Janne.Jalkanen@ecyrd.com>wrote:

> So you assume that that www.apache.org can not be hacked? What if a
>> signing key *IS* in KEYS but not signed by anyone (because the developer
>> has never attended an Apache key signing event)?
>>
>
> Which reminds me - if one does not attend an Apache key signing event
> (which tend to be in faraway countries, traveling to which usually means
> parting with lots of cash), how *does* one get the key signed?  Is there a
> regional list somewhere?
>
> Any people near Helsinki, Finland who are willing to have a coffee and sign
> my key? ;-)


Yes, asking for people on community@ in your "not faraway country" is one
way to do it. Another is that I am sure you travel once in a while, and
before going there, you can ask if someone is up for a coffee and
keysigning.


Cheers
Niclas

------=_Part_87153_31669231.1222243230860--