Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Ted Husted
Strangely, it still doesn't work. :( I tried concatenating the key to authorized_keys, and I tried the new key as authorized_key by itself (with the correct permissions), and deploy still prompts me for a password, over and over again. For some reason, from Cygwin, I can't ssh to people, even

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Wendy Smoak
On 3/21/07, Ted Husted [EMAIL PROTECTED] wrote: For some reason, from Cygwin, I can't ssh to people, even with the password. Unless command-line ssh works, nothing else could be expected to. I think some combination of PuTTY and scpexe:// urls (instead of scp://) should work. I'll put it on

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Antonio Petrelli
2007/3/21, Ted Husted [EMAIL PROTECTED]: For some reason, from Cygwin, I can't ssh to people, even with the password. I remember some time ago that, under windows, I had to use SSH for windows, because cygwin package was buggy: http://sshwindows.sourceforge.net/ HTH Antonio

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Ted Husted
On 3/21/07, Wendy Smoak [EMAIL PROTECTED] wrote: On 3/21/07, Ted Husted [EMAIL PROTECTED] wrote: For some reason, from Cygwin, I can't ssh to people, even with the password. Unless command-line ssh works, nothing else could be expected to. The odd part is th CygWin ssh doesn't work now even

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Brian Pontarelli
The latest version of SSH from Cygwin should work. Ensure that your authorized_keys is only read and writable by the user and not the group or everyone. Otherwise SSHD will reject it. Also ensure that the server you are connecting to has a modern version of SSH. If it doesn't you might need to

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Ted Husted
On 3/21/07, Brian Pontarelli [EMAIL PROTECTED] wrote: The latest version of SSH from Cygwin should work. How do I determine what is the latest version? Ensure that your authorized_keys is only read and writable by the user and not the group or everyone. Otherwise SSHD will reject it. Also

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Nate Drake
If it doesn't you might need to create a second file named authorized_keys2, which is used by some SSHD versions to support dsa. Lastly, I would also try turning on SSH debugging on the client side. This will often show you what is going wrong with the connection. How is client-side

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Brian Pontarelli
You don't have to have ssh-agent running in order to use certificates and keys. This only helps reduce the number of times you need to type in the passphrase for the private key. You should be able to use a DSA certificate and key file without any agent running. -bp Martin Cooper wrote: On

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Brian Pontarelli
Yeah, start with client side debugging and see if it tells you anything. You can tell the version like this: ssh -V It should be something like: OpenSSH_4.5p1, OpenSSL 0.9.8d 28 Sep 2006 Here's an example of a correct DSA pub key handling from my debug out put: $ ssh -v [EMAIL

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-21 Thread Martin Cooper
On 3/21/07, Ted Husted [EMAIL PROTECTED] wrote: On 3/21/07, Wendy Smoak [EMAIL PROTECTED] wrote: On 3/21/07, Ted Husted [EMAIL PROTECTED] wrote: For some reason, from Cygwin, I can't ssh to people, even with the password. Unless command-line ssh works, nothing else could be expected to.

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-20 Thread Ted Husted
On 2/25/07, Wendy Smoak [EMAIL PROTECTED] wrote: I use Cygwin exclusively, so I'm not having the back-and-forth issues that you describe... and that's going to be difficult to troubleshoot remotely. :( How about creating a ssh key with Cygwin, and appending it to to your authorized_keys on

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-20 Thread James Mitchell
$ssh-keygen -t dsa -- James Mitchell The Ruby Roundup http://www.rubyroundup.com/ On Mar 20, 2007, at 8:14 PM, Ted Husted wrote: On 2/25/07, Wendy Smoak [EMAIL PROTECTED] wrote: I use Cygwin exclusively, so I'm not having the back-and-forth issues that you describe... and that's going to

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-20 Thread Wendy Smoak
On 3/20/07, Ted Husted [EMAIL PROTECTED] wrote: Which Cygwin tool do we use to create a ssh key? ssh-keygen, there's an example here: http://rcsg-gsir.imsb-dsgi.nrc-cnrc.gc.ca/documents/internet/node31.html -- Wendy - To

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-03 Thread Wendy Smoak
On 2/25/07, Wendy Smoak [EMAIL PROTECTED] wrote: On 2/25/07, Ted Husted [EMAIL PROTECTED] wrote: Could you specify the exact steps that we should be following then? I added a TODO to review steps 5 and 6 on the wiki page. You mentioned March 4th for Struts 2.0.7, so that gives me a few days.

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-03 Thread Paul Benedict
I'll update the docs if I can get permissions. My confluence userid is my email address. Please grant me permissions. Wendy Smoak wrote: On 2/25/07, Wendy Smoak [EMAIL PROTECTED] wrote: On 2/25/07, Ted Husted [EMAIL PROTECTED] wrote: Could you specify the exact steps that we should be

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-03 Thread Paul Benedict
Step 5: * Remove the quotes from the passphrase. * The signing of the artifacts is aggressive. Everything gets signed, including the MD5 and SHA1 files. Those are produced and uploaded in the deployment, and there's no harm in having them, but you probably want to clean them up when you're

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-03 Thread Wendy Smoak
On 3/3/07, Paul Benedict [EMAIL PROTECTED] wrote: I'll update the docs if I can get permissions. My confluence userid is my email address. Please grant me permissions. Thanks. I took another look, and combined the former steps 5 and 6. This should do it: mvn deploy -P

Re: Struts 2 jars are missing signatures in the Maven repo

2007-03-03 Thread Don Brown
On 3/3/07, Paul Benedict [EMAIL PROTECTED] wrote: I'll update the docs if I can get permissions. My confluence userid is my email address. Please grant me permissions. You should have full access now. Don

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Ted Husted
The step by step that is being followed is here, * http://struts.apache.org/2.x/docs/creating-and-signing-a-distribution.html which includes using the release profile. I don't know why it isn't working for me. My PuTTY SSL setup is fine now, but there is still something wrong with Cygwin,

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Dave Newton
--- Ted Husted [EMAIL PROTECTED] wrote: I signed the struts2-core-2.0.6.jar by hand and uploaded it. http://people.apache.org/repo/m2-ibiblio-rsync-repository/org/apache/struts/struts2-core/2.0.6/ If someone could verify that this is correct, that would be helpful. The 2.0.6 JAR MD5 sig is

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Wendy Smoak
On 2/25/07, Ted Husted [EMAIL PROTECTED] wrote: I think I might have to step away from the release manager role. Or, at least the deployment of the Maven artifacts. I have a lot of trouble getting the Maven signing plugins or scripts to work. Signing all these Maven artifacts by hand is not

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Ted Husted
On 2/25/07, Wendy Smoak [EMAIL PROTECTED] wrote: for, the signatures really need to come from the person who built the jars. Statements like that never made sense to me. The bits should be deterministic. If we build from the same tag, we should get the same binaries. Why can't any other

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Wendy Smoak
On 2/25/07, Wendy Smoak [EMAIL PROTECTED] wrote: Prior to the gpg plugin being available I used a script to recursively sign the jars in my local repo, and then upload the signatures. I think Paul just used it for the Struts 1.3.7 signatures. It's a bash shell script (I use Cygwin), but

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Paul Benedict
It's a great script. I highly recommend it. Wendy Smoak wrote: On 2/25/07, Ted Husted [EMAIL PROTECTED] wrote: I think I might have to step away from the release manager role. Or, at least the deployment of the Maven artifacts. I have a lot of trouble getting the Maven signing plugins or

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Ted Husted
On 2/25/07, Wendy Smoak [EMAIL PROTECTED] wrote: Well, _that_ was certainly not my intent! You shouldn't have to sign them by hand -- there are far too many of them to make that a reasonable requirement. Actually, I do have the asc files in my local repository, with a timestamp that indicates

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Paul Benedict
Ted, From my personal deployment experience, the ASC files never get deployed automatically. I always have to FTP them over. It's a little bit of a hassle to do it for 9 sub-projects, but 2.x has much much more. I'd like to find a way to upload them all with a command. Paul Ted Husted

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Ted Husted
On 2/25/07, Wendy Smoak [EMAIL PROTECTED] wrote: When you have time, please post a message with the error you get about ssh keys so we can try to sort it out. There's no error. It just prompts me for a password, but PuTTY doesn't. I have the .ssh directory and known hosts file in my XP home

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Wendy Smoak
On 2/25/07, Ted Husted [EMAIL PROTECTED] wrote: Actually, I do have the asc files in my local repository, with a timestamp that indicates taht they were created when I released and deployed the Maven artifacts. So the question is why where only these files left behind? That would happen if you

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Ted Husted
On 2/25/07, Wendy Smoak [EMAIL PROTECTED] wrote: On 2/25/07, Ted Husted [EMAIL PROTECTED] wrote: Actually, I do have the asc files in my local repository, with a timestamp that indicates taht they were created when I released and deployed the Maven artifacts. So the question is why where only

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Wendy Smoak
On 2/25/07, Ted Husted [EMAIL PROTECTED] wrote: Could you specify the exact steps that we should be following then? I added a TODO to review steps 5 and 6 on the wiki page. You mentioned March 4th for Struts 2.0.7, so that gives me a few days. (I'd like to see Struts start using the release

Re: Struts 2 jars are missing signatures in the Maven repo

2007-02-25 Thread Paul Benedict
It should be noted, Wendy was kind enough after 1.3.6 to add a release profile to run the GPG plugin. But I forgot about it and did the 1.3.7 deployment of the signing by hand :-) Silly me for not remembering! Paul Wendy Smoak wrote: On 2/25/07, Ted Husted [EMAIL PROTECTED] wrote: Could