klcodanr commented on issue #2: SLING-8029 Retrieve gpg key automatically if it is missing in keyring URL: https://github.com/apache/sling-tooling-release/pull/2#issuecomment-431391243 That scenario could happen now if someone lost control of their ASF account. It would just have a manual step to update the key. I would think though that the script should display a warning, display some explanation on how to update the key and have the user to perform the update. Ideally if it could display some sort of helpful information on whether the key is expired, revoked, etc that would be good to help determine if the key update can be trusted.
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org With regards, Apache Git Services
