[
https://issues.apache.org/jira/browse/DIGESTER-203?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Rod Widdowson closed DIGESTER-203.
----------------------------------
Resolution: Invalid
Wrong case
> Please upload GPG key 0xBEFEEF227A98B809
> -----------------------------------------
>
> Key: DIGESTER-203
> URL: https://issues.apache.org/jira/browse/DIGESTER-203
> Project: Commons Digester
> Issue Type: Task
> Reporter: Rod Widdowson
> Priority: Major
>
> Our (opensource) project has defense against supply chain attack [1]
> In order to use any project we need to have validated GPG keys. In your
> case it turns out that
> org.apache.maven.plugins:maven-dependency-plugin:3.11.0 required
> velocity-tools version 3.1 and this is signed by key 0xBEFEEF227A98B809 [2]
> I cannot find this key either in the keys file [3] or the ASF PGP Keys page
> [4, although I do see that committer (cbrisson) listed,
> Can you get the key put up somewhere?
> Thanks
>
> Rod
>
> [1]
> [https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3269918721/Supply+Chain+Defence+for+the+Shibboleth+Java+Products]
> [2][https://keyserver.ubuntu.com/pks/lookup?search=CE4439C1BEF3DA83B1832F9DBEFEEF227A98B809&fingerprint=on&op=index]
> [3] https://downloads.apache.org/commons/KEYS
> [4] [https://home.apache.org/keys/committer/]
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
