Re: TomEE package verification not working

--Apple-Mail=_91EEA9FC-9F69-4E8D-84C3-642DEE027B31
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

 curl -sS https://downloads.apache.org/tomee/KEYS | grep =
85FBBE98D6C37CDA8A7D8FF9F9FF83A48D339D37
      85FBBE98D6C37CDA8A7D8FF9F9FF83A48D339D37



> Am 12.09.2025 um 10:43 schrieb Richard Zowalla <[email protected]>:
>=20
> Maybe force refresh your cache. It's definitely in that file.
>=20
>=20
> Am 12. September 2025 10:08:59 MESZ schrieb COURTAULT Francois =
<[email protected]>:
>> THALES GROUP LIMITED DISTRIBUTION to email recipients=20
>>=20
>> Hello Richard,
>>=20
>> In the https://downloads.apache.org/tomee/KEYS file, I don't see any=20=

>> uid           [ultimate] Markus Jung (CODE SIGNING KEY) =
<[email protected]>
>>=20
>> If I search (CODE SIGNING KEY) in the KEYS file, I get:
>>     - uid                  Richard Kenneth McGuire (CODE SIGNING KEY) =
<[email protected]>
>>     - uid                  Jarek Gawor (CODE SIGNING KEY) =
<[email protected]>
>>     - uid                  Jean-Louis Monteiro (CODE SIGNING KEY) =
<[email protected]>
>>       sig 3        043F71D8 2012-09-28  Jean-Louis Monteiro (CODE =
SIGNING KEY) <[email protected]>
>>       sig          043F71D8 2012-09-28  Jean-Louis Monteiro (CODE =
SIGNING KEY) <[email protected]>
>>     - uid          [  ultime ] Jean-Louis Monteiro (CODE SIGNING KEY) =
<[email protected]>
>>     - uid        [uneingeschr=C3=83=C2=A4nkt] Richard Zowalla (Code =
Signing Key) <[email protected]>
>>       sig 3        DAB472F0E5B8A431 2022-04-12  Richard Zowalla (Code =
Signing Key) <[email protected]>
>>       sig          DAB472F0E5B8A431 2022-04-12  Richard Zowalla (Code =
Signing Key) <[email protected]>
>> So no Markus Jung entry here.
>>=20
>> The only "uid           [ultimate]" is set for David Blevins and not =
for Markus Jung.=20
>>=20
>> Best Regards.
>>=20
>> -----Original Message-----
>> From: Richard Zowalla <[email protected]>=20
>> Sent: jeudi 11 septembre 2025 19:15
>> To: [email protected]
>> Subject: Re: TomEE package verification not working
>>=20
>> The link is correct. The key in question is contained in the file.
>>=20
>> pub   rsa4096 2024-03-22 [SC]
>>       85FBBE98D6C37CDA8A7D8FF9F9FF83A48D339D37
>> uid           [ultimate] Markus Jung (CODE SIGNING KEY) =
<[email protected]>
>> sig 3        F9FF83A48D339D37 2024-03-22  [self-signature]
>> sub   rsa4096 2024-03-22 [E]
>> sig          F9FF83A48D339D37 2024-03-22  [self-signature]
>>=20
>> The only change ist, that Markus did the Release for 10.1.1.
>>=20
>> Gru=C3=9F=20
>> Richard=20
>>=20
>> Am 11. September 2025 18:27:31 MESZ schrieb COURTAULT Francois =
<[email protected]>:
>>> THALES GROUP LIMITED DISTRIBUTION to email recipients
>>>=20
>>> Hello everyone,
>>>=20
>>> In our pipeline for building TomEE Docker base images, we do this:
>>> + gpg --batch --verify apache-tomee-10.1.1-plus.tar.gz.asc =
apache-tomee-10.1.1-plus.tar.gz
>>> gpg: Signature made Sat Aug 16 12:18:25 2025 UTC
>>> gpg: using RSA key 85FBBE98D6C37CDA8A7D8FF9F9FF83A48D339D37
>>> gpg: Can't check signature: No public key
>>>=20
>>> It was working with TomEE 10.1.0 but not anymore with TomEE 10.1.1.
>>> The keys used are located at https://downloads.apache.org/tomee/KEYS
>>> Is this location still valid for TomEE keys ?
>>>=20
>>> What has changed between 10.1.0 and 10.1.1 ?
>>> How to fix this issue ? any idea ?
>>>=20
>>> Best Regards.
>>>=20
>>>=20
>>>=20


--Apple-Mail=_91EEA9FC-9F69-4E8D-84C3-642DEE027B31--