Hi Arnout, Thank you for taking the time to work on the keys—I really appreciate your help with this process. I followed the steps outlined in the Apache Geode Release Guide (https://cwiki.apache.org/confluence/display/GEODE/Releasing+Apache+Geode) and opened a PR: https://github.com/apache/geode/pull/7919.
Calvin mentioned that my key had been already uploaded to https://downloads.apache.org/geode/KEYS, but I don’t see it listed there yet. For reference, my key is included in the PR files: https://github.com/apache/geode/pull/7919/files. Please let me know if there’s anything else I should do on my end to complete this step. Thanks again for your support! Best regards, Jinwoo Hwang (he/him/his) SAS® Research and Development http://JinwooHwang.com<http://jinwoohwang.com/> From: Arnout Engelen <[email protected]> Date: Sunday, September 21, 2025 at 6:01 AM To: [email protected] <[email protected]> Subject: Re: [VOTE] Apache Geode 1.15.2.RC4 EXTERNAL On Thu, Sep 11, 2025 at 7:41 PM Jinwoo Hwang <[email protected]> wrote: > Geode's KEYS file containing PGP keys we use to sign the release: > https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Fgeode%2Fblob%2Fdevelop%2FKEYS&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907768938%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=38lSQrmlCfFLoCQOdwOxOubrT3AndnGAXlEPjj%2FzDY8%3D&reserved=0<https://github.com/apache/geode/blob/develop/KEYS> When I try to verify https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect.checkpoint.com%2Fv2%2Fr01%2F___https%3A%2F%2Fdist.apache.org%2Frepos%2Fdist%2Frelease%2Fgeode%2F1.15.2%2Fapache-geode-1.15.2.tgz___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6Nzo5NmFiOjU5YmM3ZjA0N2QzZmZiOWNmNzNhYTI5MDdlYzEwMjI2ODdmNmQ1YmRkNTZlZDFiZjJlY2NlZmI3YjBjNWY4YWY6cDpUOk4&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907779931%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=%2Bry9mTl10lJynpjHhm0c5uIp7xdKLTdG9U8jV4VeX%2F0%3D&reserved=0<https://protect.checkpoint.com/v2/r01/___https://dist.apache.org/repos/dist/release/geode/1.15.2/apache-geode-1.15.2.tgz___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6Nzo5NmFiOjU5YmM3ZjA0N2QzZmZiOWNmNzNhYTI5MDdlYzEwMjI2ODdmNmQ1YmRkNTZlZDFiZjJlY2NlZmI3YjBjNWY4YWY6cDpUOk4> it seems to be signed by 62F7DA41B7D8F26C which I do not find in https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Fgeode%2Fblob%2Fdevelop%2FKEYS&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907786372%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=VPN4u%2FTOzvn0irYInU7iJDrfApePjhta8W4fJxT2q9M%3D&reserved=0<https://github.com/apache/geode/blob/develop/KEYS>. From https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect.checkpoint.com%2Fv2%2Fr01%2F___http%3A%2F%2Fkeyserver.ubuntu.com%3A11371%2Fpks%2Flookup%3Fsearch%3D62F7DA41B7D8F26C%26fingerprint%3Don%26op%3Dindex___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6NzpiMzc0Ojg0YzQ0OGVmZDI3ZTVjZDZiZDdmNzQ4MDE2ZjY5MjY2ZDg4ZTBlZmE4NGU0NDIxMDk0M2U4YWY1NmIyYWIxYTI6cDpUOk4&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907792567%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jUaL9ETzhwGQi0rVlhmpNxCzSAv7seR%2BYv%2FoQ6bhh1k%3D&reserved=0<https://protect.checkpoint.com/v2/r01/___http://keyserver.ubuntu.com:11371/pks/lookup?search=62F7DA41B7D8F26C&fingerprint=on&op=index___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6NzpiMzc0Ojg0YzQ0OGVmZDI3ZTVjZDZiZDdmNzQ4MDE2ZjY5MjY2ZDg4ZTBlZmE4NGU0NDIxMDk0M2U4YWY1NmIyYWIxYTI6cDpUOk4> it seems this is Jinwoo's key. Jinwoo: can you confirm this is indeed your key? If so, can we add this key to the KEYS file? There seem to be some docs around this in https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect.checkpoint.com%2Fv2%2Fr01%2F___https%3A%2F%2Fcwiki.apache.org%2Fconfluence%2Fdisplay%2FGEODE%2FReleasing%2BApache%2BGeode___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6Nzo4YzlhOjY2NmEzNTFkMWM5NjM5MjVlYjBjM2EyOTkwYWEyNDE1ZWE3ZmNlMTc2NWUxMjU2MTFmOTFiNzFlZmI0MzIwNzA6cDpUOk4&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907798830%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dzuDGtJWOzptRhWyIaCgj8z43%2FVdXkJn1IlCoFgfDVQ%3D&reserved=0<https://protect.checkpoint.com/v2/r01/___https://cwiki.apache.org/confluence/display/GEODE/Releasing+Apache+Geode___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6Nzo4YzlhOjY2NmEzNTFkMWM5NjM5MjVlYjBjM2EyOTkwYWEyNDE1ZWE3ZmNlMTc2NWUxMjU2MTFmOTFiNzFlZmI0MzIwNzA6cDpUOk4> Kind regards, -- Arnout Engelen ASF Security Response Apache Pekko PMC member, ASF Member NixOS Committer Independent Open Source consultant
