Hi Dave, Thank you for the note. We agree with your guidance: the KEYS file should be kept in a single authoritative location, the release directory, so it is found on downloads.apache.org and stays consistent for everyone verifying release signatures.
To answer your question about what caused the dev-directory KEYS file to exist: it was introduced by the project's own documentation, which currently instructs a first-time release manager to append their public key to KEYS in both repositories, and includes signing/verification steps that depend on the dev copy: - Release process guide, section "3.1 KEYS File": https://github.com/apache/fesod/blob/main/website/community/release/release-version.md (and its zh-cn translation: https://github.com/apache/fesod/blob/main/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md ) explicitly lists both the Dev repository (https://dist.apache.org/repos/dist/dev/incubator/fesod) and the Release repository as places to append the public key. - CI release guide, "3. GPG 密钥": https://github.com/apache/fesod/blob/main/docs/release/rc-release-github-action.md requires the signer's key to be added to BOTH https://dist.apache.org/repos/dist/dev/incubator/fesod/KEYS and https://downloads.apache.org/incubator/fesod/KEYS. - Verification guide: https://github.com/apache/fesod/blob/main/website/community/release/verify-release.md (and its zh-cn translation: https://github.com/apache/fesod/blob/main/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/verify-release.md ) downloads KEYS from the dev directory: curl https://dist.apache.org/repos/dist/dev/incubator/fesod/KEYS > KEYS We also verified the official Apache guidance, which supports your point: the "Release Signing" doc (https://www.apache.org/dev/release-signing.html, section "The KEYS File") states the KEYS file is stored at the top level of the ASF mirror area, with the SVN location being dist/release/<project>, and "Release Publishing" (https://infra.apache.org/release-publishing.html) only ever places KEYS under dist/release; the dev directory is meant for release candidates and snapshots, not KEYS. To align with all of the above we will: 1. Consolidate all signer public keys into the single KEYS file in the release directory and delete the KEYS file from the dev directory. 2. Update the release documentation so KEYS is only appended to the release repository. 3. Update the verification and CI documentation to fetch KEYS from https://downloads.apache.org/incubator/fesod/KEYS instead of the dev directory. If you have further adjustments, we are happy to incorporate them. Best regards, Zhe Zhang Dave Fisher <[email protected]> 于2026年8月27日周四 22:12写道： > A note from a Mentor. > > KEYS files need to be maintained only in the release directory and not the > dev directory. Having them in two places can lead to synchronization > problems. People who check the signatures of releases need the KEYS file in > the release directory so that it is found on downloads.apache.org. > > If there is documentation or an example that caused the dev directory KEYS > file to be created then I would like to know about it. > > Best, > Dave > > > On Aug 26, 2026, at 11:53 PM, [email protected] wrote: > > > > Author: zhangzhe > > Date: Thu Aug 27 06:53:50 2026 > > New Revision: 87018 > > > > Log: > > Add release signing key for [email protected] (dev KEYS) > > > > Modified: > > dev/incubator/fesod/KEYS > > > > Modified: dev/incubator/fesod/KEYS > > > ============================================================================== > > --- dev/incubator/fesod/KEYS Thu Aug 27 06:44:29 2026 (r87017) > > +++ dev/incubator/fesod/KEYS Thu Aug 27 06:53:50 2026 (r87018) > > @@ -115,3 +115,38 @@ ZS+es4BV94zz7tKH0i7VyroUeHFDyeOSxsdj6eIV > > /X4= > > =InfL > > -----END PGP PUBLIC KEY BLOCK----- > > + > > +pub rsa4096 2026-08-27 [SC] > > + CCCFA0EAA4BFB4A441D4D770FDD68C1D3497B880 > > +uid [ultimate] zhangzhe <[email protected]> > > +sig 3 FDD68C1D3497B880 2026-08-27 [self-signature] > > + > > +-----BEGIN PGP PUBLIC KEY BLOCK----- > > + > > +mQINBGqP2IcBEACvLRamY7JqMO3Hq8yUOY66Si8aSOLMAVm4b/bG1TYaojFz18mI > > +zdSrGlKsHQQ7WGlGkizt85W2LTHDfKhk/n2thAk7ZKm8jC+pFnF5oLwDYjmlJEcO > > +ecU1p0bWCERALM1Z4TvHx2/3ndcsUY4jVIceXYqjc/P+1cCY3cJz+mfV9X9xP/7u > > +OUfuJ1n6Q/4XvhyXUdZCeWfmXQcUMt77I5ZGu570stXkbJ3iYo4Qt+uL7OKpTxn6 > > +McbgVtnAfM+UGoc1by8YzJsHmaljjhW2c+VIdEDel1F5ur0Z2iaJYrAHsY+0+ERQ > > +g8GptCT9y0NYpXFs1U8kbZM2EtZsP0Yfp0cKCbjDz4zZcFPlViVWNu3mNvIdgCTV > > +YkQ3NwExVcP0sD+dMW+DHFIfQX6vajMxMFWx0X6q56u51+YfOg5+pfSNSZrzInZE > > +lXD/ud9QAKfaqTIQmWx0/7QonAMPj2KV8LnsJx2FFXbmqPSEBW1FCLhO1lxPJUGQ > > +WQd4XMwm5Wt+pwiE2iqH6ceBFn+n4c5bvu6WN9xUvMehq17tBOaKxEL8zozMida0 > > +WKBDSNOdCtl3SvvDXYFAgHO1+LpvISWBty51Aktx54HcLqWL05PfpC+4AxC1HII9 > > +0BJ0C96zxpngX+ZYa4ZoluIN2gSPPbrM+p6kjbwU/lVM7B2kBhserp7WRwARAQAB > > +tB56aGFuZ3poZSA8emhhbmd6aGVAYXBhY2hlLm9yZz6JAm0EEwEIAFcWIQTMz6Dq > > +pL+0pEHU13D91owdNJe4gAUCao/YhxsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwy > > +LDECGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQ/daMHTSXuIADNxAA > > +jP4IzFm6PdoTyaddEoSirtjRAWBphhGN/YQlu5DHMrkmjUsRFGe8T1GMbpODMdXr > > +su4V5YrxGOKNWdNwr3N93TVHduRELfZ31VPl4oRETTb+ZhnAozEC0bjnBcSLLc7m > > +zzbtVrfYeM/bZg/ZSDQW+p310tZcom1aen08Sl7AXQhCwi0Z28tt/iraCnyLDqUy > > +t/y3nNtaf0ugrBj9vP3OH02mZqWmu8xYK7tAHFo71SS2p6eBMLx1drWnHTkO4aAc > > +JSiLJUTuXI4fh62+Nxpb4sT+4xbsyIfKxEgdGerRdbent0PdItidFQf3u9FqZdu3 > > +aXxBHoXei/r56g3KR1Zwy8WWqzjfltkZL+aDUa1CnLg43uowi98m01Xx7alMl+M5 > > +4ET930R2MBOXessss04KsFDkAsZXMMqMA8T3wKg+OXOf7HfzSJeCMKwDy2EMEqKC > > +Or1/tb0pp8VmxJg5VQ5ZTyi+DMolS2bw7rvOljFH97+48XW8mTquJragoXGVjmPG > > +yc0qKT61fzGztfxOiZB4Y0MmX5O4P1WSfnrAPrsNam+OXsEv61J2CmalSQJp0Cef > > +/sP02Ln8xMEJMZWM9IMZZAq5fPG5OEBt0z5BCLL4utNEPwbjU8EB0nlZnJAhHjo8 > > +bW0ANIr6g18D+bJ6yDPdfww0ARyYNtYOmrSFw4GZADU= > > +=JDb9 > > +-----END PGP PUBLIC KEY BLOCK----- > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
