Seems the incubating project must have a DISCLAIMER file, which indicates that it is still 'incubating', and the ASF does not guarantee that it has no license issues. Not a big problem, we can remove it after we graduate as a TLP.
Alin Jerpelea <jerpe...@gmail.com> 于2022年6月5日周日 17:13写道： > Hi Duo Zhang, > > which are the remaining License issues? > I will add back the keys to the key file ASAP. > > Thanks > Alin > > > On Sun, 5 Jun 2022, 10:45 张铎(Duo Zhang), <palomino...@gmail.com> wrote: > > > ---------- Forwarded message --------- > > 发件人： 张铎(Duo Zhang) <palomino...@gmail.com> > > Date: 2022年6月5日周日 16:36 > > Subject: Re: [VOTE] Release Apache NuttX (Incubating) 10.3.0 [RC2] > > To: <gene...@incubator.apache.org> > > > > > > I could verify the gpg signature > > > > gpg --verify apache-nuttx-10.3.0-incubating.tar.gz.asc > > > gpg: 假定被签名的数据在‘apache-nuttx-10.3.0-incubating.tar.gz’ > > > gpg: 签名建立于 2022年05月05日 星期四 15时40分00秒 CST > > > gpg: 使用 RSA 密钥 FAFEEA08ABE09A8F060D984CA57CE1279F1E7328 > > > gpg: 完好的签名，来自于 “Alin Jerpelea (CODE SIGNING KEY) <jerpe...@apache.org > >” > > > [未知] > > > gpg: 警告：此密钥未被受信任签名认证！ > > > gpg: 没有证据表明此签名属于其声称的所有者。 > > > 主密钥指纹： FAFE EA08 ABE0 9A8F 060D 984C A57C E127 9F1E 7328 > > > > > > But the key FAFEEA08ABE09A8F060D984CA57CE1279F1E7328 is not in the > current > > KEYS file. I guess it was in the KEYS file in the past so I imported in > the > > past. > > > > Please update the KEYS file to add it back Alin, usually we should not > > delete keys from the KEYS file, especially when we are still using the > key > > to sign artifacts. > > > > And on the DISCLAIMER, I used to think if we can fix all the license > > problems then we can remove it. Will tell the community to add it back, > and > > remove it once NuttX becomes a TLP. > > > > Thanks Justin. > > > > Justin Mclean <jus...@classsoftware.com> 于2022年6月5日周日 10:16写道： > > > > > Hi, > > > > > > Sorry for the delay in checking the but I am also -1 binding as I can’t > > > verify the signature and teh disclaimer is missing. > > > > > > I checked: > > > - incubating in name > > > - while sha512 is correct it looks like the signature is missing from > the > > > KEYS file > > > - DISCLAIMER is missing > > > - LICENSE looks fine (but I didn’t;t do a comprehensive check) > > > - NOTICE need it’s year updated > > > - No unexpected binary files > > > - ASF files have ASF headers > > > > > > Kind Regards, > > > Justin > > > > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > > > For additional commands, e-mail: general-h...@incubator.apache.org > > > > > > > > >
