Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of gscokart@gmail.com designates
 209.85.200.169 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references;
        b=EVxmvvV6fJmSF9pf+g7kdAWb6g095pLyB/K1C39D+uLUxMPk2Z4SvB2QX7HYBfciWv
         TmadVp57ofG9q4RnewYcQ1PQWfGjQAGCQvww1BK6o/E5Ud0KIbMm+lhW90Ce7wiv5k+a
         UySFgKv+75Cbw5xoTxEb2FR4zIGZAfPefv5t0=
Message-ID: <e9d8a2610809172349s1c6020a8q35cf52342ed9f796@mail.gmail.com>
Date: Thu, 18 Sep 2008 08:49:59 +0200
From: "Gilles Scokart" <gscokart@gmail.com>
To: general@incubator.apache.org
Subject: Re: status of PGP support in Maven
In-Reply-To: <48CE73F5.5070502@rowe-clan.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <9e3862d80809150702y7492812coa2f8f0f1deb42970@mail.gmail.com>
	 <48CE73F5.5070502@rowe-clan.net>

2008/9/15 William A. Rowe, Jr. <wrowe@rowe-clan.net>:
> Brett Porter wrote:
>>
>> For the releases to be identified as from the incubator, they'll need to
>> be
>> signed solely by "the incubator". Did you want to elaborate on how you
>> anticipated that set up working?
>
> With PGP it's a web of trust.  Any ASF-role key would never be used to sign
> any artifact.  Ideally, ASF-key would sign incubator key, incubator key
> would sign Jane's key, Jane would RM and sign with her own key, and the web
> of trust satisfies the trust requirement.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>

That would requires a complete isolated web of trust for the incubator
release.  If the incubating web of trust is trusted by someone that I
trust, then I would trust the incubating artefact without realising
that this artefact comes from the incubator.
I thought the objectif was to force the user to agree that he
understandd he is using an incubating artefact.

I have the impression that I missunderstand something here.  But what?

-- 
Gilles Scokart

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org