checker.apache.org is a new automated ASF dev tool to help projects check for problems in their www.apache.org/dist/ files.

https://checker.apache.org/doc/README.html

On 05/04/18 17:08, Andy Seaborne wrote:
...
2/
To establish the proof chain for signed artifacts in /dist/project/, I
have been asked to try out the new META files.

https://checker.apache.org/doc/README.html#ch-meta

There are two files

/dist/jena/META
/dist/jena/META.asc

META says who signs what, and is itself signed by the PMC chair.

The signing chain for Jena now shows from route from the ASF key (obtained over https) through the signed files in dist/jena:

https://checker.apache.org/paths/jena/META.html

and more details about the project are at:

https://checker.apache.org/projs/jena.html

and to browse the checker report on the dist files:

https://checker.apache.org/paths/jena/

    Andy

Reply via email to