Re: svn commit: r86005 - dev/subversion
"Evgeny Kotkov via dev" <[email protected]>
| Newsgroups | gmane.comp.version-control.subversion.devel |
|---|---|
| Message-ID | <CAP_GPNhb+uQQih0tXmQqBG_bQaeOt+j-Nm_A4TfDNMT_y+Rcpw@mail.gmail.com> |
Branko Čibej <[email protected]> writes: > I don't think this is correct. All the keys ever used to sign releases > should be in here, even if they're now expired or revoked. In other > words, the old fingerprints should still be listed on id.apache.org, > which is the source of truth. We seem to maintain two different kinds of KEYS files: - https://dist.apache.org/repos/dist/release/subversion/KEYS - https://dist.apache.org/repos/dist/dev/subversion/subversion-1.15.0-rc3.KEYS The first is append-only and keeps every key that has ever been used to sign a release. The second is a point-in-time snapshot of the committers' current public keys, and it is valid only for a specific release. So I regenerated it to match the current state. I don't remember exactly why we have this distinction, but I believe there was a lengthy discussion about it on dev@ at some point… Thanks, Evgeny Kotkov