incubator-ooo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Rob Weir <robw...@apache.org>
Subject Re: [RELEASE]: download page on the AOO project webpage
Date Fri, 04 May 2012 16:40:36 GMT
On Fri, May 4, 2012 at 12:16 PM, Fernando Cassia <fcassia@gmail.com> wrote:
> On Fri, May 4, 2012 at 12:46 PM, Dave Fisher <dave2wave@comcast.net> wrote:
>
>> I think we should offer mappings and have this page definitely download
>> via the Apache mirrors. I know what to do to make this work with the Apache
>> mirror cgi.
>
>
> I think I had read somewhere about Apache choosing to use SourceForge's
> network of mirrors around the world for distribution?
>

A distribution consists of several pieces:

1) The binaries, i.e., the install images.  These are served up via SourceForge

2) The source tarballs -- These could go out via Apache mirror network
if we want.  Or SourceForge.  Is will be very low volume in either
case.

3) The detached signatures and hashes,  For these we must link our
page to the Apache copies on /dist.  This is an essential part of the
verification model.  This is how the user is protected against a rogue
mirror operator or a "man-in-the-middle" attack,  They can always
verify their download against the authoritative hashes and signature
on the Apache server.

-Rob

> FC
> --
> During times of Universal Deceit, telling the truth becomes a revolutionary
> act
> Durante épocas de Engaño Universal, decir la verdad se convierte en un Acto
> Revolucionario
> - George Orwell

Mime
View raw message