Re: RAT issues [was: Re: [VOTE] JSPWiki version 2.9.0-incubating]

2012-10-08 Thread Craig L Russell
On Oct 8, 2012, at 3:59 PM, Juan Pablo Santos Rodríguez wrote: Hello, We've added support to generate RAT files (RAT report for RC3 available at [#1]) and began to play with it, via rat-ant-tasks [#2]. As noted in previous e-mails, all the JSP files lack of a proper header. So, a couple

Re: jspwiki

2012-10-08 Thread Jukka Zitting
Hi, On Sun, Oct 7, 2012 at 11:07 PM, Benson Margulies wrote: > We seem to have a problem here. I've pinged two of the mentors here > chosen by people in my gmail 'to' cache; could we get some input? JSPWiki has been troubled for quite some time. Earlier this year (prompted by concerns raised by

RAT issues [was: Re: [VOTE] JSPWiki version 2.9.0-incubating]

2012-10-08 Thread Juan Pablo Santos Rodríguez
Hello, We've added support to generate RAT files (RAT report for RC3 available at [#1]) and began to play with it, via rat-ant-tasks [#2]. As noted in previous e-mails, all the JSP files lack of a proper header. So, a couple of questions: - we pass the addLicenseHeaders argument to the report tas

Re: key signing

2012-10-08 Thread Noah Slater
Found one... Just poking around manually... J. Daniel Kulp http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x858FC4C4F43856A3 Signed by Carsten Ziegeler http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x132E49D4E41EDC7E Signed by Marcus Crafter http://pgp.mit.edu:11371/pks/lookup?op

Re: key signing

2012-10-08 Thread Noah Slater
I don't know how to check that. Heh. Would be interested in giving it a shot. Are there tools to look up graphs? On Mon, Oct 8, 2012 at 11:23 PM, Benson Margulies wrote: > Let's try a little statistically-invalid experiment of sample size > one. The last time I had a key signed at Apache, it was

Re: svn commit: r1395765 - in /incubator/public/trunk/content: clutch.txt podlings.xml projects/bigtop.xml report_due_3.txt

2012-10-08 Thread David Crossley
Please do not hand-edit the Clutch output files. http://incubator.apache.org/clutch.html#h-Graduate http://incubator.apache.org/guides/graduation.html#unincubate If people do want to run the Clutch program, then update content/podlings.xml file, then follow: http://incubator.apache.org/clutch.htm

Re: key signing

2012-10-08 Thread Benson Margulies
Let's try a little statistically-invalid experiment of sample size one. The last time I had a key signed at Apache, it was by Dan Kulp. Now, pretend that you are a suspicious user of one of the many Maven plugins releases that I RM. Can you reach Dan from yourself in the web? Is there anyone you, p

Re: key signing

2012-10-08 Thread Benson Margulies
On Mon, Oct 8, 2012 at 6:15 PM, Noah Slater wrote: > Perhaps not Tomcat, but the entire Foundation and all of it's current and > future projects should be under consideration here. The long and short of > it is that key signing can't hurt. And a key signing guide certainly can't > hurt. RMs should

Re: key signing

2012-10-08 Thread Noah Slater
Caveat: But I do think that if we do have a key signing guide (and I think we should) then it should be strict about our standards. (i.e. when and when not to sign somebody's key. Basic QA on what sort of "trust" we're trying to build here.) On Mon, Oct 8, 2012 at 11:15 PM, Noah Slater wrote: >

Re: key signing

2012-10-08 Thread Noah Slater
Perhaps not Tomcat, but the entire Foundation and all of it's current and future projects should be under consideration here. The long and short of it is that key signing can't hurt. And a key signing guide certainly can't hurt. RMs should feel free to do this, if they are interested in it, and use

Re: key signing

2012-10-08 Thread Benson Margulies
On Mon, Oct 8, 2012 at 5:18 PM, Noah Slater wrote: > On Mon, Oct 8, 2012 at 4:53 PM, Benson Margulies wrote: > >> >> There's another side to this, which I would derisively label, 'so >> what'? How does it help a user to see that my key is signed by 27 of >> my fellow Apache contributors, if the us

Re: key signing

2012-10-08 Thread Noah Slater
This is an important point. Debian has a complete toolset and guidelines for managing this. http://www.debian.org/events/keysigning To quote: People should only sign a key under at least two conditions: 1. The key owner convinces the signer that the identity in the UID is > indeed their own

Re: key signing

2012-10-08 Thread Noah Slater
On Mon, Oct 8, 2012 at 4:53 PM, Benson Margulies wrote: > > There's another side to this, which I would derisively label, 'so > what'? How does it help a user to see that my key is signed by 27 of > my fellow Apache contributors, if the user has never met any of us, > and has never met anyone who

Re: key signing

2012-10-08 Thread Ted Dunning
On Mon, Oct 8, 2012 at 7:46 PM, Marvin Humphrey wrote: > On Mon, Oct 8, 2012 at 8:51 AM, Branko Čibej wrote: > > > It says clearly, "as long as you can guarantee that you are > > communicating with the key's true owner." Which was exactly my point. > > I assert a "virtual key-signing party" proto

Re: key signing

2012-10-08 Thread Marvin Humphrey
On Mon, Oct 8, 2012 at 8:51 AM, Branko Čibej wrote: > It says clearly, "as long as you can guarantee that you are > communicating with the key's true owner." Which was exactly my point. I assert a "virtual key-signing party" protocol incorportating Google Plus Hangouts could offer comparable ass

Re: key signing

2012-10-08 Thread Ted Dunning
On Mon, Oct 8, 2012 at 4:53 PM, Benson Margulies wrote: > On Mon, Oct 8, 2012 at 11:43 AM, Marvin Humphrey > wrote: > >> ... > >> In this respect e-mail is just as secure, so why don't we all just sign > >> keys because someone claiming to be from from Chad sent us a mail asking > >> us for a sig

Re: key signing

2012-10-08 Thread Benson Margulies
On Mon, Oct 8, 2012 at 12:47 PM, Dennis E. Hamilton wrote: > I don't understand what "keys from LDAP" are? > > Are these the same as keys whose fingerprints a ASF committer registers in > their account or something else? Yes. Sorry for the foggy phraseology. > > - Dennis > > -Original Mes

RE: key signing

2012-10-08 Thread Dennis E. Hamilton
I don't understand what "keys from LDAP" are? Are these the same as keys whose fingerprints a ASF committer registers in their account or something else? - Dennis -Original Message- From: Benson Margulies [mailto:bimargul...@gmail.com] Sent: Monday, October 08, 2012 08:54 To: general@

Re: key signing

2012-10-08 Thread Benson Margulies
On Mon, Oct 8, 2012 at 11:43 AM, Marvin Humphrey wrote: > On Mon, Oct 8, 2012 at 7:36 AM, Branko Čibej wrote: >> What guarantee do you have that a particular Skype ID is whoever you >> think it is? None at all, unless the person involved looked at your >> Skype contact list and said, yeah, that's

Re: key signing

2012-10-08 Thread Branko Čibej
On 08.10.2012 17:43, Marvin Humphrey wrote: > On Mon, Oct 8, 2012 at 7:36 AM, Branko Čibej wrote: >> What guarantee do you have that a particular Skype ID is whoever you >> think it is? None at all, unless the person involved looked at your >> Skype contact list and said, yeah, that's me. Likewise

Re: key signing

2012-10-08 Thread Marvin Humphrey
On Mon, Oct 8, 2012 at 7:36 AM, Branko Čibej wrote: > What guarantee do you have that a particular Skype ID is whoever you > think it is? None at all, unless the person involved looked at your > Skype contact list and said, yeah, that's me. Likewise for Google > Hangout. As long as they're doing t

Allura name search - What next

2012-10-08 Thread Rich Bowen
Trademarks folks, I've done a name search for 'Allura' and the results of that search are here: https://issues.apache.org/jira/browse/PODLINGNAMESEARCH-15 Is there anything I still need to do in order to get the blessing of the Trademarks folks on using this name? -- Rich Bowen rbo...@rcbowe

Re: key signing

2012-10-08 Thread Branko Čibej
On 08.10.2012 13:44, Franklin, Matthew B. wrote: >> -Original Message- >> From: Marvin Humphrey [mailto:mar...@rectangular.com] >> Sent: Friday, October 05, 2012 8:54 PM >> To: general@incubator.apache.org >> Subject: Re: key signing >> >> On Fri, Oct 5, 2012 at 8:55 AM, Jukka Zitting >>

RE: key signing

2012-10-08 Thread Franklin, Matthew B.
>-Original Message- >From: Marvin Humphrey [mailto:mar...@rectangular.com] >Sent: Friday, October 05, 2012 8:54 PM >To: general@incubator.apache.org >Subject: Re: key signing > >On Fri, Oct 5, 2012 at 8:55 AM, Jukka Zitting wrote: >> It's good to recommend people to get their keys signed b

[RESULT] [VOTE] Apache Syncope 1.0.2-incubating

2012-10-08 Thread Francesco Chicchiriccò
Hi all, after 72 hours, the vote for Syncope 1.0.2-incubating [1] *passes* with 3 IPMC + 0 non-IPMC votes. +1 (IPMC / binding) * Colm O hEigeartaigh (vote given via syncope-dev mailing list) * Emmanuel Lécharny (vote given via syncope-dev mailing list) * Jean-Baptiste Onofré (vote given via syncop

Re: [VOTE] Graduate Isis podling from Apache Incubator

2012-10-08 Thread Dan Haywood
Since more than 72 hours have elapse and we have had sufficient activity, I am now closing this vote. I will post the results in a separate thread. On 7 October 2012 21:26, Mohammad Nour El-Din wrote: > [x] +1 Graduate Isis podling from Apache Incubator > > On Fri, Oct 5, 2012 at 5:44 PM, Jukka

[RESULT] [VOTE] Graduate Isis podling from Apache Incubator

2012-10-08 Thread Dan Haywood
The vote to graduate Isis from the incubator is SUCCESSFUL. There were 5 +1's: - Mark Struberg - Benson Marguiles - Bertrand Delacretaz - Jukka Zitting - Mohammad Nour El-Din No other votes were passed. Jukka suggested an alteration to one phrase of the resolution. However, no-one else commente