Do you remember how the mechanism worked that the KEYS url https://www.apache.org/dist/sling/KEYS at https://sling.apache.org/downloads.cgi did return something after 2013 . Or was it broken since then? Konrad
> On 5. Mar 2020, at 11:10, Carsten Ziegeler <[email protected]> wrote: > > Long time ago..I remember that we discussed that in the project and decided > that its not needed anymore. > > Here is what I think is how we ended up there: in the past we needed to > manually maintain the KEYS file, then it changed to the auto generated files > (https://people.apache.org/keys/group/sling.asc) and at that time we decided > that the auto generated file is enough and we don't have to maintain a file > manually anymore. I also think that at that time there was a guidance to use > the auto generated file. > > Now, it seems that over time this guidance has changed without us getting > aware of it. > > Regards > Carsten > > On 05.03.2020 11:02, Konrad Windszus wrote: >> Found it via svn log -v https://dist.apache.org/repos/dist/release/sling/ >> .... >> r2679 | cziegeler | 2013-08-05 09:26:19 +0200 (Mon, 05 Aug 2013) | 1 line >> Changed paths: >> A /release/sling/.htaccess >> D /release/sling/KEYS >> Remove obsolete keys file >> .... >> @Carsten: Do you remember? >> Thanks, >> Konrad >>> On 5. Mar 2020, at 10:37, Konrad Windszus <[email protected]> wrote: >>> >>> I did that for most of the download links already >>> (https://github.com/apache/sling-site/commit/d9c831d79013cdcb755244908f1fbe8026af70bb >>> >>> <https://github.com/apache/sling-site/commit/d9c831d79013cdcb755244908f1fbe8026af70bb>) >>> >>> Regarding KEYS it is explicitly stated in https://people.apache.org/keys/: >>> <https://people.apache.org/keys/:> >>> Note: the project group files are not directly suitable for use as KEYS >>> files for authenticating releases - i.e. they should not be linked from >>> download pages. >>> >>> So who did ever upload manually a KEYS file to dist manually and why did it >>> vanish? >>> Also do we have any process for maintaining that KEYS file manually? >>> >>> Thanks for any information >>> Konrad >>> >>> >>>> On 5. Mar 2020, at 10:20, Carsten Ziegeler <[email protected]> wrote: >>>> >>>> A mail went out to all PMCs yesterday that the dist infrastructure changes >>>> and https://www.apache.org/dist/ gets replaced by >>>> https://downloads.apache.org/. >>>> >>>> We're asked to update all our references eventually. >>>> >>>> Regards >>>> Carsten >>>> >>>> On 05.03.2020 10:10, Bertrand Delacretaz wrote: >>>>> Hi, >>>>> On Wed, Mar 4, 2020 at 5:17 PM Konrad Windszus <[email protected]> wrote: >>>>>> ...I noticed that https://www.apache.org/dist/sling/KEYS is no longer >>>>>> working.... >>>>> I just found out that https://www.apache.org/dist/ has moved to >>>>> https://downloads.apache.org/ >>>>> Redirects are in place, >>>>> https://www.apache.org/dist/sling/adapter-annotations-1.0.0-javadoc.jar.asc >>>>> for example redirects correctly. >>>>> I don't know why the KEYS file didn't make it, however. >>>>> -Bertrand >>>> >>>> -- >>>> -- >>>> Carsten Ziegeler >>>> Adobe Research Switzerland >>>> [email protected] >>> > > -- > -- > Carsten Ziegeler > Adobe Research Switzerland > [email protected]
