Re: status of PGP support in Maven

[Craig L Russell]

On Sep 17, 2008, at 5:32 PM, Henning Schmiedehausen wrote:

The only way around that I can see right away in a heavily mirrored

central all the time. Which represents a single point of failure and a
non-scaling element.

system, is to pull the signatures (and probably even the checksums) from

I do understand the single point of failure, which means that if Apache central happens to be down, users cannot get to the signatures.

Craig

Craig L Russell
Architect, Sun Java Enterprise System http://db.apache.org/jdo
408 276-5638 mailto:[EMAIL PROTECTED]
P.S. A good JDO? O, Gasp!

But I don't see the scaling problem. I understand that to download an artifact that's more than 200 bytes, you really need mirrors to relieve the burden on Apache central. But I'd guess that our central server could handle a few hundred (thousand?) xxx.asc file downloads per minute, far in excess of the load. To me, the only place to store .asc files for all artifacts is in central. Not maven central, and not mirrors.

smime.p7s
Description: S/MIME cryptographic signature