On 26/07/2016 08:19, Thorsten Schöning wrote: > Hi all, > > the docs about release management for incubating projects make clear > that the release needs to be signed[1] and in the end associated with > the project AND the WOT of Apache in general[2]. > > Is there some way to check what the owner of a PGP key for former > releases has done to get his association to the WOT, if any? I would > like to understand the needed process better and e.g. found the > following: > > http://pgp.surfnet.nl:11371/pks/lookup?op=vindex&fingerprint=on&search=0x2E114322 > > Are all those people/keys on this list someone who signed the key I > searched for and provided association with the WOT this way?
Yes. > Are the mentioned possibilities in [2] the only way to get such an > association to the WOT? I usually don't visit conferences or > keysigning parties or such. It depends on what the signer is prepared to accept as proof of identity. In most cases, a face to face meeting is required. > Am I correct that releases can't be published without such an > association to the WOT at all and BEFOREHAND? No. The release manager's key MUST be added to the project's KEY file *before* signing the release. The release manager MUST upload their key to a public key server (e.g. pgp.mit.edu) *before* signing the release Releases MUST be signed. The release manager SHOULD add their key to their profile on id.apache.org The release manager SHOULD add their key to the ASF WoT at the earliest opportunity. If you don't visit conferences then one option is to use [3] to find a nearby committer who might be able to sign your key. HTH, Mark > Else one could sign and > publish a release and loose the key afterwards or else and the release > would be left without the needed association. > > Thanks! > > [1]: http://incubator.apache.org/guides/releasemanagement.html#signing > [2]: http://www.apache.org/dev/openpgp.html#apache-wot-link [3] http://community.zones.apache.org/map.html --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
