I’ve added Davyd’s key to the logging KEYS file. It appears I had already signed it a while back but hadn’t copied it to this KEYS file already. Do note that his key was available in https://downloads.apache.org/logging/log4net/KEYS <https://downloads.apache.org/logging/log4net/KEYS> which isn’t as obvious as the parent directory, so the only change here was copying the same key. -- Matt Sicker
> On Dec 18, 2021, at 17:22, Robert Middleton <[email protected]> wrote: > > I think Matt or somebody would just have to add your key to the KEYS file. > > Otherwise, I have validated the checksums and the key, so +1 from me. > I did not validate that anything builds, as I don't do .NET. > > -Robert Middleton > > On Fri, Dec 17, 2021 at 5:53 AM Davyd McColl <[email protected]> wrote: >> >> Hi Robert >> >> I checked and saw the same sha discrepencies - the only reason I can think >> of is perhaps I interrupted a release script such that I had updated >> artifacts but interrupted before the shas were computed. Fixed-up now, >> thanks for the heads-up. Just to be sure, I've updated the release artifacts >> at GitHub too. >> >> -d >> >> On 2021-12-17 08:28:35, Davyd McColl <[email protected]> wrote: >> Hi Robert >> Binaries are signed with my key, though I remember someone raising that my >> key wasn't in a known area last time, so I'd appreciate help with that. I >> had a key signing party with Ralph and Matt quite a long time ago, but >> perhaps there's something I was supposed to do that I didn't ): >> The sha mismatch is more concerning because the production of artifacts is >> automated from a script in the repo, so I'll need to go double-check what's >> going on there. Thanks for the heads-up though. >> -d >> >> On December 17, 2021 02:17:24 Robert Middleton <[email protected]> wrote: >> I have updated staging docs and I _think_ I've done the right thing with >> respect to getting binaries and source up to the dev repo at >> https://dist.apache.org/repos/dist/dev/logging >> [https://dist.apache.org/repos/dist/dev/logging], but the download links on >> the staging docs point to the release download area, so I'm not sure if I >> should rather upload there so that staging documentation "works as >> expected" for the vote to continue. >> >> >> My understanding is that you don't upload to the release area until >> the release is done. Having the staging docs point at the release >> area is fine to me at least(it's what I do for log4cxx), since that's >> effectively a known issue with a release vote in my mind. >> Anyway, I checked the binaries on >> https://dist.apache.org/repos/dist/dev/logging >> [https://dist.apache.org/repos/dist/dev/logging], unfortunately it seems >> as though there may be two problems: >> 1. SHA512 does not match the zip files at all >> 2. Signature doesn't seem to be valid, or I don't have the pubkey. >> Which key is it signed with? >> -Robert Middleton >> On Thu, Dec 16, 2021 at 8:47 AM Davyd McColl <[email protected]> wrote: >> >> >> Hi all >> I'd like to raise a vote to release log4net 2.0.14. Changelog is up on the >> pre-release page at >> https://github.com/apache/logging-log4net/releases/tag/rc%2F2.0.14-rc1 >> [https://github.com/apache/logging-log4net/releases/tag/rc%2F2.0.14-rc1] >> I have updated staging docs and I _think_ I've done the right thing with >> respect to getting binaries and source up to the dev repo at >> https://dist.apache.org/repos/dist/dev/logging >> [https://dist.apache.org/repos/dist/dev/logging], but the download links on >> the staging docs point to the release download area, so I'm not sure if I >> should rather upload there so that staging documentation "works as >> expected" for the vote to continue. >> Thanks Ralph for assisting me in being able to uplodate artifacts myself. >> Much appreciated. >> -d >> PS. This email is a duplicate of the one sent from my work email ( >> [email protected]) which I believe has been lost somewhere along the >> way. Please ignore the other if it pops up. >> >> -- >> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- >> If you say that getting the money is the most important thing >> You will spend your life completely wasting your time >> You will be doing things you don't like doing >> In order to go on living >> That is, to go on doing things you don't like doing >> Which is stupid. >> - Alan Watts >> https://www.youtube.com/watch?v=-gXTZM_uPMY >> [https://www.youtube.com/watch?v=-gXTZM_uPMY] >> *Quidquid latine dictum sit, altum sonatur. *
