Issue 123134 - Missing keys for Linux builds in dist/openoffice/KEYS
Summary: Missing keys for Linux builds in dist/openoffice/KEYS
Status: CLOSED FIXED_WITHOUT_CODE
Alias: None
Product: Infrastructure
Classification: Infrastructure
Component: Downloads (show other issues)
Version: current
Hardware: All All
: P1 (highest) Critical (vote)
Target Milestone: ---
Assignee: jsc
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-08-29 01:29 UTC by Ariel Constenla-Haile
Modified: 2016-04-07 16:03 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description Ariel Constenla-Haile 2013-08-29 01:29:40 UTC 
As reported here http://markmail.org/message/o2ri35uh4g4vbhji
the keys file on http://www.apache.org/dist/openoffice/KEYS only has jsc key (win and mac builds).

It would be better to follow subversion project, that links to the keys on people.apache.org: http://subversion.apache.org/download/#verifying
Comment 1 jsc 2013-08-29 07:30:52 UTC 
I agree and I changed the link to the KEY file and use now the one from the people.apache.org server

https://people.apache.org/keys/group/openoffice.asc
Comment 2 SVN Robot 2013-08-29 20:30:28 UTC 
"marcus" committed SVN revision 1518809 
#123134# Updated link
Comment 3 SVN Robot 2013-08-29 20:30:47 UTC 
"marcus" committed SVN revision 1518810 
#123134# Updated link
Comment 4 Marcus 2013-08-29 20:35:15 UTC 
I've changed the link also on the download webpages.
Comment 5 orcmid 2016-04-07 16:03:27 UTC 
(In reply to Marcus from comment #4)
> I've changed the link also on the download webpages.

The policy on KEYS files is to *not* use the group keys location.  The KEYS file at dist/openoffice/KEYS should have only keys that have ever been used to sign releases and no such key should be removed.  That is, the KEYS file at dist/openoffice/KEYS is cumulative.  That is so an old release can still be checked.  (To detect a revocation, the latest version is needed from a key server though.)

The KEYS file at group/openoffice.asc will have keys removed when a committer removes that key from their profile or when the committer retires from Apache OpenOffice.  

See <https://people.apache.org/keys/> for details.

It might not be necessary to do anything about the current dist/openoffice/KEYS, even if it now has more KEYS than have been used on releases made at Apache OpenOffice since incubation started.