[
https://issues.apache.org/jira/browse/HADOOP-13577?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15459892#comment-15459892
]
Allen Wittenauer commented on HADOOP-13577:
-------------------------------------------
The whole point of having KEYS, sigs, etc come from a different server is to
make sure that the mirror site didn't get compromised. This is why httpd,
maven, etc, are all doing the same thing--we all point to dist.apache.org to
download these files. These files are lightweight compared to the rest of the
content and should be fine to be downloaded from apache.org.
> Download page should link the ASF mirrora for KEYS, sigs, hashes
> ----------------------------------------------------------------
>
> Key: HADOOP-13577
> URL: https://issues.apache.org/jira/browse/HADOOP-13577
> Project: Hadoop Common
> Issue Type: Bug
> Environment: http://hadoop.apache.org/releases.html
> Reporter: Sebb
>
> The download page currently points to
> https://dist.apache.org/repos/dist/release/hadoop/...
> for KEYS, sigs and hashes.
> However the dist SVN tree is not designed for this; such files must be
> downloaded from the ASF mirrors, i.e
> https://www.apache.org/dist/hadoop/...
> Please can you adjust the links accordingly?
> The links should use HTTPS.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
