Rod Widdowson created DIGESTER-202:
--------------------------------------
Summary: Please update keys for [email protected] on
https://home.apache.org/keys/committer/
Key: DIGESTER-202
URL: https://issues.apache.org/jira/browse/DIGESTER-202
Project: Commons Digester
Issue Type: Bug
Affects Versions: 3.2
Reporter: Rod Widdowson
As background our opensource project has built some defense against supply
chain attacks [1]
By my calculation version 3.2 is signed by key 0xCAF5EC5919FEA27D
I can see this key here [2], but I expected to be able to see it at an official
location [3]
The key for [email protected] at that site appears to be unrelated [4]
[1]
https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3269918721/Supply+Chain+Defence+for+the+Shibboleth+Java+Products
[2]
https://keyserver.ubuntu.com/pks/lookup?search=0xCAF5EC5919FEA27D&fingerprint=on&op=index
[3] https://home.apache.org/keys/committer/
[4]
https://keyserver.ubuntu.com/pks/lookup?search=94C3410848CF8630%20&fingerprint=on&op=index
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
