Mailing-List: contact dev-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Developers List" <dev@struts.apache.org>
Received-SPF: pass (nike.apache.org: local policy)
Message-ID: <47FC34E0.1040402@blueskyminds.com.au>
Date: Wed, 09 Apr 2008 13:15:44 +1000
From: Jeromy Evans <jeromy.evans@blueskyminds.com.au>
Organization: Blue Sky Minds Pty Ltd
User-Agent: Thunderbird 2.0.0.12 (Windows/20080213)
MIME-Version: 1.0
To: Struts Developers List <dev@struts.apache.org>
Subject: Re: 2.1 build
References: <d8bdeb6f0803261148x763a1d7bw81deb943d7a638a3@mail.gmail.com>
	 <8b3ce3790804040359m1bd0f924v9f6b40dd3ae83b3f@mail.gmail.com>
	 <1c661f2f0804060528l123567a9lde23ac2cd6585dd@mail.gmail.com>
	 <47FB169E.10400@blueskyminds.com.au>
	 <adba96190804081222x5c2adee3o527f03eea1a13d5b@mail.gmail.com>
	 <47FC0E43.7060602@blueskyminds.com.au>
	 <436d9a250804081822v1ff4eee6m867a5a6bd63a6060@mail.gmail.com>
	 <16d6c6200804081830p2def732et6bf99ae1f90b31f1@mail.gmail.com>
	 <16d6c6200804081834xaae07ccy3bc0aead0f433471@mail.gmail.com>
	 <47FC2279.5080700@blueskyminds.com.au>
 <16d6c6200804081940w682e90fevb7acb820d6444e8d@mail.gmail.com>
In-Reply-To: <16d6c6200804081940w682e90fevb7acb820d6444e8d@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Martin Cooper wrote:
> On Tue, Apr 8, 2008 at 6:57 PM, Jeromy Evans <
> jeromy.evans@blueskyminds.com.au> wrote:
>
>   
>>
>> Understood.  Can I sign and distribute Don's binaries[1] or *must* they be
>> signed by the person that built them?
>>     
>
>
> I've lost track of why Don can't sign them himself, but I would consider it
> OK for you to do that if you use the following process:
>
> 1) Have Don e-mail you the binaries or otherwise get them to you in a way
> that they could not be intercepted. (I don't consider you picking them up
> from the URL below to be acceptable because there is a chance, however slim,
> that those binaries could have been compromised. And yes, I realise that
> e-mail can in fact be intercepted as well, but if you guys coordinate
> time-wise, I think that is an acceptable risk.)
>
> 2) You sign them, and mail the .asc files back to Don.
>
> 3) Don verifies that the .asc files you sent him validate successfully
> against the binaries that he has.
>
> At this point, you (Jeromy) have the appropriate signatures for what Don
> originally built, as well as the binaries, and can take it from there.
>   

Thanks Martin,  That doesn't take Don out of the loop so it won't 
alleviate the issue that he's been too busy to sign and distribute the 
binaries.
If he's able to validate the .asc against the original binaries he's 
able to generate them.  It's less effort and risk to wait until Don has 
time to complete the task.


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org