Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Date: Tue, 28 Jun 2011 13:22:49 +0300
From: Daniel Shahaf <d.s@daniel.shahaf.name>
To: Christian Grobmeier <grobmeier@gmail.com>
Cc: general@incubator.apache.org
Subject: Re: KEYS and releases
Message-ID: <20110628102249.GA5242@daniel3.local>
References: <3BB424E5-0060-4AA1-91C4-CF6F93423708@jpl.nasa.gov>
 <CMECLHIGIKFCOPHDFPNOMEFKMAAB.noel@devtech.com>
 <CAPFNckh81A4QvkFVA8Msn789_Y5MFOv761e3vXerW-syY-mK2A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: 
 <CAPFNckh81A4QvkFVA8Msn789_Y5MFOv761e3vXerW-syY-mK2A@mail.gmail.com>
User-Agent: Mutt/1.5.20 (2009-06-14)

Christian Grobmeier wrote on Tue, Jun 28, 2011 at 11:20:13 +0200:
> >> we copy a KEYS file into that directory upon succesful VOTE of the release
> >> artifacts (which also include the KEYS file).
> >
> > Perhaps, but the point we're getting at was explicitly stated by Benson,
> > "The goal here is to allow and encourage consumers to independently verify
> > signatures. �That calls for KEYS somewhere else than inside the package."
> 
> I am sorry to ask it again, but why can't the incubator have a policy
> to make people use:
> https://id.apache.org/
> to store their signing key.
> 

You mean "To store the fingerprint of their public key."

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org