Mailing-List: contact repository-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: repository@apache.org
Received-SPF: pass (nike.apache.org: domain of wsmoak@gmail.com designates
 209.85.132.241 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=yBwKi6YcwHHVuEJH+HaAE6Miu6Y5q18doHFZ8FZ17pnRJmKdWpj9/CI4t3gST5X5R+Uaq8a/+lLnXFbh9b6oSQfdqUkvXUngTjXwSpDXTMu09cd4qJscx9w/02l4qA6tCOBJZb1Izsd7j19nKfX11hPrmr24cYpQNWQ01bMT7DM=
Message-ID: <adba96190805241247o79b29e60y26b5c54f6e38aa2c@mail.gmail.com>
Date: Sat, 24 May 2008 12:47:11 -0700
From: "Wendy Smoak" <wsmoak@gmail.com>
To: "Jochen Wiedmann" <jochen.wiedmann@gmail.com>
Subject: Re: [repo] /www/people.apache.org/repo/m2-ibiblio-rsync-repository/
Cc: repository@apache.org
In-Reply-To: <e75283b10805241214p63b78cd8yfc979dca99e64010@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20080512011952.50048.qmail@minotaur.apache.org>
	 <adba96190805241143m7c8a0ddcgace4e518b0bda984@mail.gmail.com>
	 <e75283b10805241214p63b78cd8yfc979dca99e64010@mail.gmail.com>

On Sat, May 24, 2008 at 12:14 PM, Jochen Wiedmann
<jochen.wiedmann@gmail.com> wrote:

> Wendy, you are right. I have indeed simply uploaded these jar files
> rather than building them. Which is why I also didn't create a
> signature for them. I did so, because Carlos requested in the past
> that ASF jar files should be uploaded via the M2 rsync repository
> rather than uploading them via the standard Maven process.
>
> If that's not what I ought to have done, sorry. Please let me know how
> to proceed. I am happy to either add my own signature, to remove these
> files and submit them via the standard Maven upload process or do
> whatever you suggest.

I think it's fine... there's really no way to get a good signature on
the individual artifacts so long after they were built.  It's not a
good idea to sign something you didn't build, or that has been out of
your control.  The only thing I'd suggest is to ping the Ant PMC, if
you haven't already, so they're aware of this and can review the
artifacts.

Thanks for the quick response!

-- 
Wendy