Radu, Unfortunately you did not answer the question before, but the folder at Sling (I know the Update site may consist of several other signed JARs) brings us in the right direction.
Following a release of say devicemap-data-1.0.4 into a signed ZIP file and/or Maven repository, could we also put the XML files into a proper form (of a W3C Device Repository, somewhat similar to what you have in the P2 repo) so all clients that support remote URL loading may use that? It should not be a problem to sign each XML file individually like it's done with Maven POMs (also XML files) but again, the signed archive of a new version as well as the Maven repository are worthless, especially for the .NET clients, those don't know JAR files or Maven. And since the Maven repo also contains signed JAR files, this repo is no good for .NET, only a local or remote folder/URL. Would that work after a release? Only then such release would be "productive" and useful to a final release of clients that can be releases (e.g. the Java client) otherwise we would all waste our time because the clients cannot use the archives. Is there a way to do that after a release? Thanks, Werner On Wed, Sep 7, 2016 Radu wrote: Werner, Why is it so hard to understand that a release, even for data files, needs to follow a process? Why do we always need to have a never-ending list of messages (10 from you alone on this thread) for simple things? Why do we always need to point fingers at other projects when the release process is the same for every ASF project? Instead of writing 10 messages you could have spent that time more productively by just preparing the signed release archive... Just a FYI: the Sling example you're pointing at with a not-working URL is actually the expansion of a *signed release archive* -http://apache.org/dist/sling/org.apache.sling.ide.p2update-1.1.0.zip - and is there for convenience. Regards, Radu
