Rod Widdowson created DIGESTER-203:
--------------------------------------
Summary: Please upload GPG key 0xBEFEEF227A98B809
Key: DIGESTER-203
URL: https://issues.apache.org/jira/browse/DIGESTER-203
Project: Commons Digester
Issue Type: Task
Reporter: Rod Widdowson
Our (opensource) project has defense against supply chain attack [1]
In order to use any project we need to have validated GPG keys. In your case
it turns out that org.apache.maven.plugins:maven-dependency-plugin:3.11.0
required velocity-tools version 3.1 and this is signed by key
0xBEFEEF227A98B809 [2]
I cannot find this key either in the keys file [3] or the ASF PGP Keys page [4,
although I do see that committer (cbrisson) listed,
Can you get the key put up somewhere?
Thanks
Rod
[1]
[https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3269918721/Supply+Chain+Defence+for+the+Shibboleth+Java+Products]
[2][https://keyserver.ubuntu.com/pks/lookup?search=CE4439C1BEF3DA83B1832F9DBEFEEF227A98B809&fingerprint=on&op=index]
[3] https://downloads.apache.org/commons/KEYS
[4] [https://home.apache.org/keys/committer/]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
