On Sun, 21 Sept 2025 at 12:39, Jinwoo Hwang
<[email protected]> wrote:
>
> Hi Arnout,
>
> Thank you for taking the time to work on the keys—I really appreciate your
> help with this process.
> I followed the steps outlined in the Apache Geode Release Guide
> (https://cwiki.apache.org/confluence/display/GEODE/Releasing+Apache+Geode)
> and opened a PR: https://github.com/apache/geode/pull/7919.
>
> Calvin mentioned that my key had been already uploaded to
> https://downloads.apache.org/geode/KEYS, but I don’t see it listed there yet.
> For reference, my key is included in the PR files:
> https://github.com/apache/geode/pull/7919/files.
>
> Please let me know if there’s anything else I should do on my end to complete
> this step.
> Thanks again for your support!
Apologies, this is my mistake and should now be fixed.
I manually executed the commit to move the release from the "dev" to
"release" folder - which included copying the KEYS file over - this
inadvertently removed Jinwoo's key from the KEYS file in the "release"
folder here:
https://dist.apache.org/repos/dist/release/geode/
I did review the change but I think I had a "brain fart" moment - not
noticing it was removing rather than adding Jinwoo's key.
Sorry about that, I've reverted the change and it looks OK now
Niall
>
>
> Best regards,
>
> Jinwoo Hwang (he/him/his)
>
>
>
> SAS® Research and Development
>
> http://JinwooHwang.com<http://jinwoohwang.com/>
>
>
>
> From: Arnout Engelen <[email protected]>
> Date: Sunday, September 21, 2025 at 6:01 AM
> To: [email protected] <[email protected]>
> Subject: Re: [VOTE] Apache Geode 1.15.2.RC4
>
> EXTERNAL
>
> On Thu, Sep 11, 2025 at 7:41 PM Jinwoo Hwang <[email protected]> wrote:
>
> > Geode's KEYS file containing PGP keys we use to sign the release:
> > https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Fgeode%2Fblob%2Fdevelop%2FKEYS&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907768938%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=38lSQrmlCfFLoCQOdwOxOubrT3AndnGAXlEPjj%2FzDY8%3D&reserved=0<https://github.com/apache/geode/blob/develop/KEYS>
>
>
> When I try to verify
> https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect.checkpoint.com%2Fv2%2Fr01%2F___https%3A%2F%2Fdist.apache.org%2Frepos%2Fdist%2Frelease%2Fgeode%2F1.15.2%2Fapache-geode-1.15.2.tgz___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6Nzo5NmFiOjU5YmM3ZjA0N2QzZmZiOWNmNzNhYTI5MDdlYzEwMjI2ODdmNmQ1YmRkNTZlZDFiZjJlY2NlZmI3YjBjNWY4YWY6cDpUOk4&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907779931%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=%2Bry9mTl10lJynpjHhm0c5uIp7xdKLTdG9U8jV4VeX%2F0%3D&reserved=0<https://protect.checkpoint.com/v2/r01/___https://dist.apache.org/repos/dist/release/geode/1.15.2/apache-geode-1.15.2.tgz___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6Nzo5NmFiOjU5YmM3ZjA0N2QzZmZiOWNmNzNhYTI5MDdlYzEwMjI2ODdmNmQ1YmRkNTZlZDFiZjJlY2NlZmI3YjBjNWY4YWY6cDpUOk4>
> it
> seems to be signed by 62F7DA41B7D8F26C which I do not find in
> https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Fgeode%2Fblob%2Fdevelop%2FKEYS&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907786372%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=VPN4u%2FTOzvn0irYInU7iJDrfApePjhta8W4fJxT2q9M%3D&reserved=0<https://github.com/apache/geode/blob/develop/KEYS>.
>
> From
> https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect.checkpoint.com%2Fv2%2Fr01%2F___http%3A%2F%2Fkeyserver.ubuntu.com%3A11371%2Fpks%2Flookup%3Fsearch%3D62F7DA41B7D8F26C%26fingerprint%3Don%26op%3Dindex___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6NzpiMzc0Ojg0YzQ0OGVmZDI3ZTVjZDZiZDdmNzQ4MDE2ZjY5MjY2ZDg4ZTBlZmE4NGU0NDIxMDk0M2U4YWY1NmIyYWIxYTI6cDpUOk4&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907792567%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jUaL9ETzhwGQi0rVlhmpNxCzSAv7seR%2BYv%2FoQ6bhh1k%3D&reserved=0<https://protect.checkpoint.com/v2/r01/___http://keyserver.ubuntu.com:11371/pks/lookup?search=62F7DA41B7D8F26C&fingerprint=on&op=index___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6NzpiMzc0Ojg0YzQ0OGVmZDI3ZTVjZDZiZDdmNzQ4MDE2ZjY5MjY2ZDg4ZTBlZmE4NGU0NDIxMDk0M2U4YWY1NmIyYWIxYTI6cDpUOk4>
> it seems this is Jinwoo's key. Jinwoo: can you confirm this is indeed
> your key? If so, can we add this key to the KEYS file? There seem to be
> some docs around this in
> https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprotect.checkpoint.com%2Fv2%2Fr01%2F___https%3A%2F%2Fcwiki.apache.org%2Fconfluence%2Fdisplay%2FGEODE%2FReleasing%2BApache%2BGeode___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6Nzo4YzlhOjY2NmEzNTFkMWM5NjM5MjVlYjBjM2EyOTkwYWEyNDE1ZWE3ZmNlMTc2NWUxMjU2MTFmOTFiNzFlZmI0MzIwNzA6cDpUOk4&data=05%7C02%7CJinwoo.Hwang%40sas.com%7C162e56bf80674ccbec0308ddf8f5d4db%7Cb1c14d5c362545b3a4309552373a0c2f%7C0%7C0%7C638940456907798830%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dzuDGtJWOzptRhWyIaCgj8z43%2FVdXkJn1IlCoFgfDVQ%3D&reserved=0<https://protect.checkpoint.com/v2/r01/___https://cwiki.apache.org/confluence/display/GEODE/Releasing+Apache+Geode___.YzJ1OnNhc2luc3RpdHV0ZTpjOm86MWRlNjE0ZDRiMzY3ZDQ3ZDI0ZTU5NmI5MTRkODYwNDE6Nzo4YzlhOjY2NmEzNTFkMWM5NjM5MjVlYjBjM2EyOTkwYWEyNDE1ZWE3ZmNlMTc2NWUxMjU2MTFmOTFiNzFlZmI0MzIwNzA6cDpUOk4>
>
>
> Kind regards,
>
> --
> Arnout Engelen
> ASF Security Response
> Apache Pekko PMC member, ASF Member
> NixOS Committer
> Independent Open Source consultant
