Ok, following this procedure omits the need to specify a keyserver. Still untrusted though:
gpg --import ~/Development/apache-isis/KEYS gpg: key 2FDB81B1: public key "Mark Struberg (Apache) <[email protected]>" imported gpg: key 77AD2E23: "Dan Haywood (CODE SIGNING KEY) <[email protected]>" not changed gpg: key 61459F7A: public key "Mohammad Nour (Personal GMail) < [email protected]>" imported gpg: key 5124D1AB: "Jeroen Christiaan van der Wal (CODE SIGNING KEY) < [email protected]>" not changed gpg: Total number processed: 4 gpg: imported: 2 (RSA: 2) gpg: unchanged: 2 gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 3 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 3u gpg: next trustdb check due at 2015-08-18 Katla:isis jvanderwal$ gpg --verify --keyserver pgp.mit.eduisis-1.0.0-source-release.asc isis-1.0.0-source-release.zip gpg: Signature made Sat 15 Dec 19:50:19 2012 CET using RSA key ID 77AD2E23 gpg: Good signature from "Dan Haywood (CODE SIGNING KEY) < [email protected]>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 60A6 847D 011F E674 7D8B E60D 76D7 491A 77AD 2E23 On Tue, Dec 18, 2012 at 9:09 PM, Dan Haywood <[email protected]>wrote: > On 18 December 2012 20:02, Jeroen van der Wal <[email protected]> wrote: > > > > > In the output I also noticed that Dan's key is not trusted: > > > > > Um, it *is* trusted, in that it is counter-signed by various other members > in the ASF web of trust: > > http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x76D7491A77AD2E23 > > > I dimly recall that there's a way to import these into your own certificate > store, the procedure might be as per [1] > > Dan > > [1] http://www.apache.org/dev/release-signing.html#keys-policy > > > > > > Will continue with further steps. > > > > There was an error in the link to the files, fixed below. > > > > -Jeroen > > > > core: > > > > > https://repository.apache.org/content/repositories/orgapacheisis-022/org/apache/isis/core/isis/1.0.0/isis-1.0.0-source-release.zip > > * > > > > > https://repository.apache.org/content/repositories/orgapacheisis-022/org/apache/isis/core/isis/1.0.0/isis-1.0.0-source-release.zip.asc > > jdo objectstore: > > > > > https://repository.apache.org/content/repositories/orgapacheisis-024/org/apache/isis/objectstore/isis-objectstore-jdo/1.0.0/isis-objectstore-jdo-1.0.0-source-release.zip > > * > > > > > https://repository.apache.org/content/repositories/orgapacheisis-024/org/apache/isis/objectstore/isis-objectstore-jdo/1.0.0/isis-objectstore-jdo-1.0.0-source-release.zip.asc > > file security: > > > > > https://repository.apache.org/content/repositories/orgapacheisis-025/org/apache/isis/security/isis-security-file/1.0.0/isis-security-file-1.0.0-source-release.zip > > * > > > > > https://repository.apache.org/content/repositories/orgapacheisis-025/org/apache/isis/security/isis-security-file/1.0.0/isis-security-file-1.0.0-source-release.zip.asc > > wicket viewer: > > > > > https://repository.apache.org/content/repositories/orgapacheisis-026/org/apache/isis/viewer/isis-viewer-wicket/1.0.0/isis-viewer-wicket-1.0.0-source-release.zip > > * > > > > > https://repository.apache.org/content/repositories/orgapacheisis-026/org/apache/isis/viewer/isis-viewer-wicket/1.0.0/isis-viewer-wicket-1.0.0-source-release.zip.asc > > restfulobjects viewer > > > > > https://repository.apache.org/content/repositories/orgapacheisis-027/org/apache/isis/viewer/isis-viewer-restfulobjects/1.0.0/isis-viewer-restfulobjects-1.0.0-source-release.zip > > * > > > > > https://repository.apache.org/content/repositories/orgapacheisis-027/org/apache/isis/viewer/isis-viewer-restfulobjects/1.0.0/isis-viewer-restfulobjects-1.0.0-source-release.zip.asc > > > > > > >
