RE: TomEE package verification not working

------5UODJKD8R7NWR5PI9DY8KWZ2QC0GQZ
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable

Great :-)

Am 15=2E September 2025 19:07:46 MESZ schrieb COURTAULT Francois <francois=
=2Ecourtault@thalesgroup=2Ecom=2EINVALID>:
>THALES GROUP LIMITED DISTRIBUTION to email recipients=20
>
>Hello Richard,
>
>You probably right=2E
>Now I am able to see Markus Jung sting in the KEYS file=2E
>
>Sorry to not have performed a refresh=2E
>
>Best Regards=2E
>
>-----Original Message-----
>From: Richard Zowalla <rzo1@apache=2Eorg>=20
>Sent: vendredi 12 septembre 2025 11:06
>To: users@tomee=2Eapache=2Eorg
>Subject: Re: TomEE package verification not working
>
> curl -sS https://downloads=2Eapache=2Eorg/tomee/KEYS | grep 85FBBE98D6C3=
7CDA8A7D8FF9F9FF83A48D339D37
>      85FBBE98D6C37CDA8A7D8FF9F9FF83A48D339D37
>
>
>
>> Am 12=2E09=2E2025 um 10:43 schrieb Richard Zowalla <richard@zowalla=2Ec=
om>:
>>=20
>> Maybe force refresh your cache=2E It's definitely in that file=2E
>>=20
>>=20
>> Am 12=2E September 2025 10:08:59 MESZ schrieb COURTAULT Francois <franc=
ois=2Ecourtault@thalesgroup=2Ecom=2EINVALID>:
>>> THALES GROUP LIMITED DISTRIBUTION to email recipients=20
>>>=20
>>> Hello Richard,
>>>=20
>>> In the https://downloads=2Eapache=2Eorg/tomee/KEYS file, I don't see a=
ny=20
>>> uid           [ultimate] Markus Jung (CODE SIGNING KEY) <jungm@apache=
=2Eorg>
>>>=20
>>> If I search (CODE SIGNING KEY) in the KEYS file, I get:
>>>     - uid                  Richard Kenneth McGuire (CODE SIGNING KEY) =
<rickmcguire@apache=2Eorg>
>>>     - uid                  Jarek Gawor (CODE SIGNING KEY) <gawor@apach=
e=2Eorg>
>>>     - uid                  Jean-Louis Monteiro (CODE SIGNING KEY) <jlm=
onteiro@apache=2Eorg>
>>>       sig 3        043F71D8 2012-09-28  Jean-Louis Monteiro (CODE SIGN=
ING KEY) <jlmonteiro@apache=2Eorg>
>>>       sig          043F71D8 2012-09-28  Jean-Louis Monteiro (CODE SIGN=
ING KEY) <jlmonteiro@apache=2Eorg>
>>>     - uid          [  ultime ] Jean-Louis Monteiro (CODE SIGNING KEY) =
<jlmonteiro@apache=2Eorg>
>>>     - uid        [uneingeschr=C3=83=C2=A4nkt] Richard Zowalla (Code Si=
gning Key) <rzo1@apache=2Eorg>
>>>       sig 3        DAB472F0E5B8A431 2022-04-12  Richard Zowalla (Code =
Signing Key) <rzo1@apache=2Eorg>
>>>       sig          DAB472F0E5B8A431 2022-04-12  Richard Zowalla (Code =
Signing Key) <rzo1@apache=2Eorg>
>>> So no Markus Jung entry here=2E
>>>=20
>>> The only "uid           [ultimate]" is set for David Blevins and not f=
or Markus Jung=2E=20
>>>=20
>>> Best Regards=2E
>>>=20
>>> -----Original Message-----
>>> From: Richard Zowalla <richard@zowalla=2Ecom>=20
>>> Sent: jeudi 11 septembre 2025 19:15
>>> To: users@tomee=2Eapache=2Eorg
>>> Subject: Re: TomEE package verification not working
>>>=20
>>> The link is correct=2E The key in question is contained in the file=2E
>>>=20
>>> pub   rsa4096 2024-03-22 [SC]
>>>       85FBBE98D6C37CDA8A7D8FF9F9FF83A48D339D37
>>> uid           [ultimate] Markus Jung (CODE SIGNING KEY) <jungm@apache=
=2Eorg>
>>> sig 3        F9FF83A48D339D37 2024-03-22  [self-signature]
>>> sub   rsa4096 2024-03-22 [E]
>>> sig          F9FF83A48D339D37 2024-03-22  [self-signature]
>>>=20
>>> The only change ist, that Markus did the Release for 10=2E1=2E1=2E
>>>=20
>>> Gru=C3=9F=20
>>> Richard=20
>>>=20
>>> Am 11=2E September 2025 18:27:31 MESZ schrieb COURTAULT Francois <fran=
cois=2Ecourtault@thalesgroup=2Ecom=2EINVALID>:
>>>> THALES GROUP LIMITED DISTRIBUTION to email recipients
>>>>=20
>>>> Hello everyone,
>>>>=20
>>>> In our pipeline for building TomEE Docker base images, we do this:
>>>> + gpg --batch --verify apache-tomee-10=2E1=2E1-plus=2Etar=2Egz=2Easc =
apache-tomee-10=2E1=2E1-plus=2Etar=2Egz
>>>> gpg: Signature made Sat Aug 16 12:18:25 2025 UTC
>>>> gpg: using RSA key 85FBBE98D6C37CDA8A7D8FF9F9FF83A48D339D37
>>>> gpg: Can't check signature: No public key
>>>>=20
>>>> It was working with TomEE 10=2E1=2E0 but not anymore with TomEE 10=2E=
1=2E1=2E
>>>> The keys used are located at https://downloads=2Eapache=2Eorg/tomee/K=
EYS
>>>> Is this location still valid for TomEE keys ?
>>>>=20
>>>> What has changed between 10=2E1=2E0 and 10=2E1=2E1 ?
>>>> How to fix this issue ? any idea ?
>>>>=20
>>>> Best Regards=2E
>>>>=20
>>>>=20
>>>>=20

------5UODJKD8R7NWR5PI9DY8KWZ2QC0GQZ--