RE: TomEE package verification not working

------D1Z4SNM0U8ZUZVTSFYE6YBJC8C9T3A
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable

Nope=2E No commits on the SVN since ages=2E Most likely a caching issue=2E

Am 15=2E September 2025 19:04:50 MESZ schrieb COURTAULT Francois <francois=
=2Ecourtault@thalesgroup=2Ecom=2EINVALID>:
>THALES GROUP LIMITED DISTRIBUTION to email recipients=20
>
>Hello Richard,
>
>Have you updated the KEYS file ?
>Because now I am able to see Markus Jung=2E
>
>Best Regards=2E
>
>-----Original Message-----
>From: COURTAULT Francois=20
>Sent: vendredi 12 septembre 2025 10:09
>To: users@tomee=2Eapache=2Eorg
>Subject: RE: TomEE package verification not working
>
>THALES GROUP LIMITED DISTRIBUTION to email recipients=20
>
>Hello Richard,
>
>In the https://downloads=2Eapache=2Eorg/tomee/KEYS file, I don't see any=
=20
>uid           [ultimate] Markus Jung (CODE SIGNING KEY) <jungm@apache=2Eo=
rg>
>
>If I search (CODE SIGNING KEY) in the KEYS file, I get:
>    - uid                  Richard Kenneth McGuire (CODE SIGNING KEY) <ri=
ckmcguire@apache=2Eorg>
>    - uid                  Jarek Gawor (CODE SIGNING KEY) <gawor@apache=
=2Eorg>
>    - uid                  Jean-Louis Monteiro (CODE SIGNING KEY) <jlmont=
eiro@apache=2Eorg>
>      sig 3        043F71D8 2012-09-28  Jean-Louis Monteiro (CODE SIGNING=
 KEY) <jlmonteiro@apache=2Eorg>
>      sig          043F71D8 2012-09-28  Jean-Louis Monteiro (CODE SIGNING=
 KEY) <jlmonteiro@apache=2Eorg>
>    - uid          [  ultime ] Jean-Louis Monteiro (CODE SIGNING KEY) <jl=
monteiro@apache=2Eorg>
>    - uid        [uneingeschr=C3=83=C2=A4nkt] Richard Zowalla (Code Signi=
ng Key) <rzo1@apache=2Eorg>
>      sig 3        DAB472F0E5B8A431 2022-04-12  Richard Zowalla (Code Sig=
ning Key) <rzo1@apache=2Eorg>
>      sig          DAB472F0E5B8A431 2022-04-12  Richard Zowalla (Code Sig=
ning Key) <rzo1@apache=2Eorg>
>So no Markus Jung entry here=2E
>
>The only "uid           [ultimate]" is set for David Blevins and not for =
Markus Jung=2E=20
>
>Best Regards=2E
>
>-----Original Message-----
>From: Richard Zowalla <richard@zowalla=2Ecom>=20
>Sent: jeudi 11 septembre 2025 19:15
>To: users@tomee=2Eapache=2Eorg
>Subject: Re: TomEE package verification not working
>
>The link is correct=2E The key in question is contained in the file=2E
>
>pub   rsa4096 2024-03-22 [SC]
>      85FBBE98D6C37CDA8A7D8FF9F9FF83A48D339D37
>uid           [ultimate] Markus Jung (CODE SIGNING KEY) <jungm@apache=2Eo=
rg>
>sig 3        F9FF83A48D339D37 2024-03-22  [self-signature]
>sub   rsa4096 2024-03-22 [E]
>sig          F9FF83A48D339D37 2024-03-22  [self-signature]
>
>The only change ist, that Markus did the Release for 10=2E1=2E1=2E
>
>Gru=C3=9F=20
>Richard=20
>
>Am 11=2E September 2025 18:27:31 MESZ schrieb COURTAULT Francois <francoi=
s=2Ecourtault@thalesgroup=2Ecom=2EINVALID>:
>>THALES GROUP LIMITED DISTRIBUTION to email recipients
>>
>>Hello everyone,
>>
>>In our pipeline for building TomEE Docker base images, we do this:
>>+ gpg --batch --verify apache-tomee-10=2E1=2E1-plus=2Etar=2Egz=2Easc apa=
che-tomee-10=2E1=2E1-plus=2Etar=2Egz
>>gpg: Signature made Sat Aug 16 12:18:25 2025 UTC
>>gpg: using RSA key 85FBBE98D6C37CDA8A7D8FF9F9FF83A48D339D37
>>gpg: Can't check signature: No public key
>>
>>It was working with TomEE 10=2E1=2E0 but not anymore with TomEE 10=2E1=
=2E1=2E
>>The keys used are located at https://downloads=2Eapache=2Eorg/tomee/KEYS
>>Is this location still valid for TomEE keys ?
>>
>>What has changed between 10=2E1=2E0 and 10=2E1=2E1 ?
>>How to fix this issue ? any idea ?
>>
>>Best Regards=2E
>>
>>
>>

------D1Z4SNM0U8ZUZVTSFYE6YBJC8C9T3A--