[
https://issues.apache.org/jira/browse/DIGESTER-202?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18112074#comment-18112074
]
Rod Widdowson commented on DIGESTER-202:
----------------------------------------
Gary,
Thanks so much. I spent an hour looking for it today (having found it three
days ago while looking for the keys for org.apache.ant) and could but stumbled
on that page instead.
I see that key there.
please close this case with my apologies for the PEBKAC
Rod
> Please update keys for [email protected] on
> https://home.apache.org/keys/committer/
> -------------------------------------------------------------------------------------------
>
> Key: DIGESTER-202
> URL: https://issues.apache.org/jira/browse/DIGESTER-202
> Project: Commons Digester
> Issue Type: Bug
> Affects Versions: 3.2
> Reporter: Rod Widdowson
> Priority: Minor
>
> As background our opensource project has built some defense against supply
> chain attacks [1]
> By my calculation version 3.2 is signed by key 0xCAF5EC5919FEA27D
> I can see this key here [2], but I expected to be able to see it at an
> official location [3]
> The key for [email protected] at that site appears to be unrelated [4]
> [1]
> https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3269918721/Supply+Chain+Defence+for+the+Shibboleth+Java+Products
> [2]
> https://keyserver.ubuntu.com/pks/lookup?search=0xCAF5EC5919FEA27D&fingerprint=on&op=index
> [3] https://home.apache.org/keys/committer/
> [4]
> https://keyserver.ubuntu.com/pks/lookup?search=94C3410848CF8630%20&fingerprint=on&op=index
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
