sergehuber opened a new pull request, #43: URL: https://github.com/apache/unomi-tracker/pull/43
## Summary Found while running the `RELEASE.md` checks for 2.0.0 on `main` (`ae00349`). - **`KEYS`**: adds the Apache code signing key of Serge Huber (RSA 4096, `16DF 7E56 7738 172F 945F 0402 7C19 D1FB BD1A B1DF`), the same as in https://downloads.apache.org/unomi/KEYS. The repository's `KEYS`, which ships in the source and npm packages, only had a DSA 1024 key for him, below the RSA 2048-bit minimum. - **`RELEASE.md`**: `git tag -s` and `gpg -ab` with `-u <your key id>`. Without it, git signs the tag with `user.signingkey`, which can be another key, such as the one that signs commits. - **`CHANGES.md`**: `rollup-plugin-license` moved to 3.7.1 (#42), so not every dependency stayed within its major version; the build output is the same. ## Test plan - [x] `gpg --import KEYS` in an empty keyring: 5 keys imported, including `7C19D1FBBD1AB1DF` - [x] `yarn lint` - [ ] CI 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
