Yes, but the problem is how to start, because the current https://people.apache.org/keys/group/sling.asc <https://people.apache.org/keys/group/sling.asc> might no longer contain public keys from people doing releases in the past. Anyway, I created https://issues.apache.org/jira/browse/SLING-9173 <https://issues.apache.org/jira/browse/SLING-9173> to track it. We can continue the discussion in the ticket. Konrad
> On 5. Mar 2020, at 11:30, Carsten Ziegeler <[email protected]> wrote: > > I think it worked back then and I think it worked automatically somehow > without us doing anything. But my memory of that time might already be > corrupted. > > Regardless, isn't the guidance now that we manage this file manually again > (reading the list at the bottom of https://people.apache.org/keys/) ? > > Regards > Carsten > > On 05.03.2020 11:14, Konrad Windszus wrote: >> Do you remember how the mechanism worked that the KEYS url >> https://www.apache.org/dist/sling/KEYS at >> https://sling.apache.org/downloads.cgi did return something after 2013 . Or >> was it broken since then? >> Konrad >>> On 5. Mar 2020, at 11:10, Carsten Ziegeler <[email protected]> wrote: >>> >>> Long time ago..I remember that we discussed that in the project and decided >>> that its not needed anymore. >>> >>> Here is what I think is how we ended up there: in the past we needed to >>> manually maintain the KEYS file, then it changed to the auto generated >>> files (https://people.apache.org/keys/group/sling.asc) and at that time we >>> decided that the auto generated file is enough and we don't have to >>> maintain a file manually anymore. I also think that at that time there was >>> a guidance to use the auto generated file. >>> >>> Now, it seems that over time this guidance has changed without us getting >>> aware of it. >>> >>> Regards >>> Carsten >>> >>> On 05.03.2020 11:02, Konrad Windszus wrote: >>>> Found it via svn log -v https://dist.apache.org/repos/dist/release/sling/ >>>> .... >>>> r2679 | cziegeler | 2013-08-05 09:26:19 +0200 (Mon, 05 Aug 2013) | 1 line >>>> Changed paths: >>>> A /release/sling/.htaccess >>>> D /release/sling/KEYS >>>> Remove obsolete keys file >>>> .... >>>> @Carsten: Do you remember? >>>> Thanks, >>>> Konrad >>>>> On 5. Mar 2020, at 10:37, Konrad Windszus <[email protected]> wrote: >>>>> >>>>> I did that for most of the download links already >>>>> (https://github.com/apache/sling-site/commit/d9c831d79013cdcb755244908f1fbe8026af70bb >>>>> >>>>> <https://github.com/apache/sling-site/commit/d9c831d79013cdcb755244908f1fbe8026af70bb>) >>>>> >>>>> Regarding KEYS it is explicitly stated in >>>>> https://people.apache.org/keys/: <https://people.apache.org/keys/:> >>>>> Note: the project group files are not directly suitable for use as KEYS >>>>> files for authenticating releases - i.e. they should not be linked from >>>>> download pages. >>>>> >>>>> So who did ever upload manually a KEYS file to dist manually and why did >>>>> it vanish? >>>>> Also do we have any process for maintaining that KEYS file manually? >>>>> >>>>> Thanks for any information >>>>> Konrad >>>>> >>>>> >>>>>> On 5. Mar 2020, at 10:20, Carsten Ziegeler <[email protected]> wrote: >>>>>> >>>>>> A mail went out to all PMCs yesterday that the dist infrastructure >>>>>> changes and https://www.apache.org/dist/ gets replaced by >>>>>> https://downloads.apache.org/. >>>>>> >>>>>> We're asked to update all our references eventually. >>>>>> >>>>>> Regards >>>>>> Carsten >>>>>> >>>>>> On 05.03.2020 10:10, Bertrand Delacretaz wrote: >>>>>>> Hi, >>>>>>> On Wed, Mar 4, 2020 at 5:17 PM Konrad Windszus <[email protected]> wrote: >>>>>>>> ...I noticed that https://www.apache.org/dist/sling/KEYS is no longer >>>>>>>> working.... >>>>>>> I just found out that https://www.apache.org/dist/ has moved to >>>>>>> https://downloads.apache.org/ >>>>>>> Redirects are in place, >>>>>>> https://www.apache.org/dist/sling/adapter-annotations-1.0.0-javadoc.jar.asc >>>>>>> for example redirects correctly. >>>>>>> I don't know why the KEYS file didn't make it, however. >>>>>>> -Bertrand >>>>>> >>>>>> -- >>>>>> -- >>>>>> Carsten Ziegeler >>>>>> Adobe Research Switzerland >>>>>> [email protected] >>>>> >>> >>> -- >>> -- >>> Carsten Ziegeler >>> Adobe Research Switzerland >>> [email protected] > > -- > -- > Carsten Ziegeler > Adobe Research Switzerland > [email protected]
