IMO, despite all the encouragements by the ASF and the project, people do what they like. And some even may not want to have all plugins included.
Given that the project already voted favourably on the first convenience package of the 17.12 branch (which incorporates, and is based on, the releases in the two repos), it seems to me that you can go ahead by creating the .asc and .sha512 files for each of the releases in the repos and upload those together with those repo releases into http://downloads.apache.org/ofbiz. Met vriendelijke groet, Pierre Smits *Proud* *contributor** of* Apache OFBiz <https://ofbiz.apache.org/> since 2008 (without privileges) *Apache Trafodion <https://trafodion.apache.org>, Vice President* *Apache Directory <https://directory.apache.org>, PMC Member* Apache Incubator <https://incubator.apache.org>, committer Apache Steve <https://steve.apache.org>, committer On Thu, Mar 5, 2020 at 7:57 AM Jacopo Cappellato < jacopo.cappell...@gmail.com> wrote: > On Wed, Mar 4, 2020 at 4:12 PM Pierre Smits <pierresm...@apache.org> > wrote: > > > [...] > > Recently the releases became available via the official repositories on > > Github: > > > > - https://github.com/apache/ofbiz-framework/releases > > - https://github.com/apache/ofbiz-plugins/releases > > > > I tried to verify these with the function available in the ofbiz-tools > rep, > > like: > > > > ../dev/asf/ofbiz/ofbiz-tools/verify-ofbiz-release.sh > > ofbiz-framework-release17.12.01.zip > > [...] > > > Some additional details about the verification process from ASF ([*]): > "You are encouraged to download the releases from our mirrors. Signatures > and checksums are only available from the official Apache Software > Foundation site. > Our download pages point you to the mirrors for releases and to the > official site for signatures and checksums." > > [*] https://www.apache.org/info/verification.html > > Jacopo >
