Mailing-List: contact user-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@zookeeper.apache.org
Received-SPF: pass (athena.apache.org: domain of phunt1@gmail.com designates
 209.85.215.51 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <87zjd8mg4c.fsf@ip-10-56-193-148.eu-west-1.compute.internal>
References: 
 <CAB_jBhjxmUumUJB7jYZUE1pNTH=YaSsfgigFk4nQUH8BoQhm=w@mail.gmail.com>
 <87zjd8mg4c.fsf@ip-10-56-193-148.eu-west-1.compute.internal>
From: Patrick Hunt <phunt1@gmail.com>
Date: Tue, 7 Oct 2014 14:43:46 -0700
Message-ID: 
 <CANLc_9LOiaHiGA_guKcusr7Hyprvrc4VqdwmEe2cZZyQBCq3qA@mail.gmail.com>
Subject: Re: verifying downloads of release tarballs
To: UserZooKeeper <user@zookeeper.apache.org>
Content-Type: text/plain; charset=UTF-8

I think that's the legacy file - there is also this file, which seems
more up to date:

http://www.apache.org/dist/zookeeper/KEYS

Patrick

On Tue, Oct 7, 2014 at 1:35 AM, Ivan Kelly <ivank@apache.org> wrote:
> The keys in use should be in
> https://svn.apache.org/repos/asf/zookeeper/dist/KEYS
>
> -Ivan
>
> Warren Turkal writes:
>
>> Hey everyone,
>>
>> I have a couple questions about verifying the tarballs I download for
>> Zookeeper.
>>
>> I don't see any listing of an official release manager identity and their
>> pub key. Therefore, I don't know which key I should be getting to verify a
>> signature against. Is there a list somewhere of the release manager
>> identity. Ideally, I'd also be able to get the key from an Apache site
>> protected by TLS (maybe even HTTPS). Am I just missing this info? If so,
>> where is the info?
>>
>> Also, I don't see corresponding .asc signature files that can be used to
>> verify the authenticity of the archives even if I did have a pub key. Are
>> these located in some special location other than in the directories along
>> side the released tarballs?
>>
>> Alternatively, is there a better way to retrieve crypto-secured releases
>> than just downloading the release tarballs?
>>
>> Thanks,
>> wt
>