[
https://issues.apache.org/jira/browse/RANGER-750?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15471556#comment-15471556
]
Selvamohan Neethiraj edited comment on RANGER-750 at 9/7/16 7:24 PM:
---------------------------------------------------------------------
+1 for deleting the download-keys.sh file. Once I have another vote, I can go
ahead and delete the file.
The download-keys.sh is a helper script to create KEYS file:
{code}
wget https://people.apache.org/keys/group/ranger.asc -O KEYS
{code}
If we delete the file, we need to update our Release Tasks
(https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=65867946) to
use the above wget command to create/update KEYS file during every release
process.
was (Author: sneethiraj):
+1 for deleting the download-keys.sh file. Once I have another vote, I can go
ahead and delete the file.
> Spurious file in https://dist.apache.org/repos/dist/release/incubator/ranger/
> -----------------------------------------------------------------------------
>
> Key: RANGER-750
> URL: https://issues.apache.org/jira/browse/RANGER-750
> Project: Ranger
> Issue Type: Bug
> Environment:
> https://dist.apache.org/repos/dist/release/incubator/ranger/
> Reporter: Sebb
>
> he directory https://dist.apache.org/repos/dist/release/incubator/ranger/
> contains the file:
> download-keys.sh
> This does not belong on the ASF mirror system.
> Also the script is not suitable for downloading KEYS.
> The file https://people.apache.org/keys/group/ranger.asc is not guaranteed to
> contain all the keys needed to validate a signature, because the file only
> contains the current keys for the current members of the PPMC. However the
> KEYS file is also used for checking archived releases so must contain all
> keys that have ever been used to sign a release.
> Please remove the script file, and ensure that the KEYS file contains all the
> keys for every ASF release that has been made. Entries should never be
> dropped from KEYS files if they have been used to sign a release.
> Thanks
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
