Re: Jython 2.7.2 final

Hi Adam,

The bazel.build includes an SHA1 checksum, which can be used for limited
verification. It is still however hosted on the same server infrastructure.

Providing the users the means to verify the installer against the PGP
public key of someone doing the release is less vulnerable to malicious
actors (*assuming the* * developers who perform a release keep their
private key.. private).*

So in a nutshell, the PGP verification is more resilient security wise.

Cheers,
Eero

On Sat, May 2, 2020 at 3:14 PM Adam Burke <[email protected]> wrote:

> Thanks Eero. Sorry this flew under the radar earlier.
>
> I guess the intent on the download page is all that information is
> available using the "metadata" link, eg
>
> Jython Installer
> <https://repo1.maven.org/maven2/org/python/jython-installer/2.7.2/jython-installer-2.7.2.jar> -
> Use this to install Jython. (metadata
> <https://search.maven.org/artifact/org.python/jython-installer/2.7.2/jar>)
>
>
> Do you think that's too obscure, or introduces some security risk? I note
> the CPython download page links to the .asc sig file for their downloads
> too.
>
> Cheers
> Adam
>
>
> On Sun, 5 Apr 2020 at 23:17, Eero Aaltonen <[email protected]> wrote:
>
>> Thank you for your hard work on making the release!
>>
>> The obvious place to download the release
>> https://www.jython.org/download.html
>>
>> Currently does not have obvious instructions for verifying the download.
>> Everything required for that however seems to be in place:
>> * https://repo1.maven.org/maven2/org/python/jython-installer/2.7.2/
>> .asc signatures
>> *
>> https://jython-devguide.readthedocs.io/en/latest/release_jy.html#publication
>> releases (Jeff's) public key on the keyserver.
>>
>> In case you wish to add verification instructions to the download page, I
>> make a sketch while doing that myself
>>
>>
>> ## Download release and signature
>>
>> Download files
>>
>> * `jython-installer-2.7.2.jar`
>> * `jython-installer-2.7.2.jar.asc` from example
>> https://repo1.maven.org/maven2/org/python/jython-installer/2.7.2/
>>
>> ## Identify Signing Key
>>
>> `gpg --verify jython-installer-2.7.2.jar.asc jython-installer-2.7.2.jar`
>>
>> ## Search and Import Key
>>
>> `gpg --keyserver hkp://pool.sks-keyservers.net --search-keys
>> C8C4B9DC1E031F788B12882B875C3EF9DC4638E3`
>>
>> ## Verify
>>
>> Run the verification command again
>>
>> `gpg --verify jython-installer-2.7.2.jar.asc jython-installer-2.7.2.jar`
>> _______________________________________________
>> Jython-dev mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/jython-dev
>>
>

_______________________________________________
Jython-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/jython-dev