David, I see the issue. Your new key is missing the key fingerprint.
The Dockerfile uses the finger print to import they keys. I am not sure why it was written that way. Maybe we should go a different direction? I will admit gpg is not my strong suit. I am thinking that I can pull they KEY file and use the public keys in there. Is there any reason to pull them from the key servers other than having to parse the KEY file? Thanks, Rod. On 5/28/21, 8:36 PM, "David Blevins" <[email protected]> wrote: > On May 28, 2021, at 3:23 PM, Jenkins, Rodney J (Rod) <[email protected]> wrote: > > David, > > While I was working the Docker images for 9.0.0-M7, I could not use the keys file to verify the downloads. Does the keys file need an update? > Hey Rod! I used a new key and uploaded it as part of the build. It should be the last public key in the file: - https://dist.apache.org/repos/dist/release/tomee/KEYS If it doesn't work, I'll try myself Tuesday. -David
