Mailing-List: contact repository-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: repository@apache.org
Received-SPF: pass (athena.apache.org: domain of carlossg@gmail.com designates
 209.85.222.188 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:date
         :x-google-sender-auth:message-id:subject:from:to:content-type
         :content-transfer-encoding;
        b=WUUYh4DstXp0Y+gdoyHiW+SxUNmItIjF2buFYgokTkIc1fWcFRoQ/ACtA/7FofblvP
         g2D972NeQjThPe9HGjZjgcgx9i4P30VJB4MguFnw+8e+wFZmokI7eWldQF6Cg3nAhPCI
         m0+2Iuo2rBYZ6eTAktFBaXyb5Mdy5+2YobMng=
MIME-Version: 1.0
Sender: carlossg@gmail.com
In-Reply-To: <4A3AD4B3.8030606@steitz.com>
References: <4A3ACE28.7070600@steitz.com>
	 <1a5b6c410906181647x33f66c71i213b0f412d6325a6@mail.gmail.com>
	 <4A3AD4B3.8030606@steitz.com>
Date: Thu, 18 Jun 2009 17:06:29 -0700
Message-ID: <1a5b6c410906181706yf319becs40c67d77b34e3c91@mail.gmail.com>
Subject: Re: How to get rid of bad sig that has been replicated
From: Carlos Sanchez <carlos@apache.org>
To: repository@apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

the source has propagated to the users already. The signature is not
downloaded by maven so it's better to change the later.

Maybe you can compare the contents of the old jar and confidently sign it?


On Thu, Jun 18, 2009 at 4:58 PM, Phil Steitz<phil@steitz.com> wrote:
> Carlos Sanchez wrote:
>>
>> what's the sig file that needs to be deleted?
>> delete it from people.apache and then I'll do the same from central
>>
>
> Could we possibly nuke the "old" source jar instead? =A0That way we end u=
p
> with a signed jar on central. =A0The jar in question is
> commons-pool-1.2-sources.jar and we would have to delete the .md5 and .sh=
a1
> in central too if we go this route..
>
> If you don't like that idea, I will delete from people.
>
> Thanks, Carlos, and sorry for the screw-up.
>
> Phil
>>
>> On Thu, Jun 18, 2009 at 4:30 PM, Phil Steitz<phil@steitz.com> wrote:
>>
>>>
>>> Earlier this week I put signed source jars for commons pool 1.1-1.4 in
>>> the
>>> m2-ibiblio-rsynch repo. =A0I did not notice that a source jar already
>>> existed
>>> for version 1.2 in maven central. =A0That jar did not have a sig. =A0Wh=
at
>>> appears to have happened is that the new source jar did not overwrite t=
he
>>> old one in repo1, but the new sig file did get replicated. =A0The resul=
t is
>>> that the sig does not match the jar. =A0 How can we fix this?
>>> Phil
>>>
>>>
>
>