www-repository mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Wendy Smoak" <wsm...@gmail.com>
Subject Re: [repo] /www/people.apache.org/repo/m2-ibiblio-rsync-repository/
Date Sat, 24 May 2008 19:47:11 GMT
On Sat, May 24, 2008 at 12:14 PM, Jochen Wiedmann
<jochen.wiedmann@gmail.com> wrote:

> Wendy, you are right. I have indeed simply uploaded these jar files
> rather than building them. Which is why I also didn't create a
> signature for them. I did so, because Carlos requested in the past
> that ASF jar files should be uploaded via the M2 rsync repository
> rather than uploading them via the standard Maven process.
> If that's not what I ought to have done, sorry. Please let me know how
> to proceed. I am happy to either add my own signature, to remove these
> files and submit them via the standard Maven upload process or do
> whatever you suggest.

I think it's fine... there's really no way to get a good signature on
the individual artifacts so long after they were built.  It's not a
good idea to sign something you didn't build, or that has been out of
your control.  The only thing I'd suggest is to ping the Ant PMC, if
you haven't already, so they're aware of this and can review the

Thanks for the quick response!


View raw message