Verification of release xerces:xercesImpl:2.12.2

--000000000000f27069060bc02a27
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hey folks,

While upgrading the xerces version to 2.12.2 inside Gradle
<https://github.com/gradle/gradle/>, we cannot validate that the new key
used to sign the release is legitimate.

The following key has been used:
6CB87B18A453990EAC9453F87D713008CC07E9AD (Aur=C3=A9lien Pupier <
[email protected]>)

But this key is not listed in the KEYS file found at
https://downloads.apache.org/xerces/j/binaries/KEYS

Can a developer confirm this signature is legitimate?
Or point us to the right location for performing this validation?

Regards,

Louis Jacomet

Senior Lead Software Engineer

Gradle
W. gradle.com

--=20
*
CONFIDENTIALITY NOTICE*: The contents of this email message, and any=20
attachments, are intended solely for the addressee(s) and may contain=20
confidential, proprietary and/or privileged information legally protected=
=20
from disclosure. If you are not the intended recipient of this=20
communication, or if you received this communication by mistake, please=20
notify the sender immediately and delete this message and any attachments.=
=20
If you are not the intended recipient, you are hereby notified that any=20
use, retransmission, dissemination, copying or storage of this message or=
=20
its attachments is strictly prohibited.

--000000000000f27069060bc02a27
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hey folks,</div><div><br></div><div>While upgrading t=
he xerces version to 2.12.2 inside <a href=3D"https://github.com/gradle/gra=
dle/">Gradle</a>, we cannot validate that the new key used to sign the rele=
ase is legitimate.</div><div><br></div><div>The following key has been used=
:</div><div>6CB87B18A453990EAC9453F87D713008CC07E9AD (Aur=C3=A9lien Pupier =
&lt;<a href=3D"mailto:[email protected]">[email protected]</a>&gt;)</div>=
<div><br></div><div>But this key is not listed in the KEYS file found at <a=
 href=3D"https://downloads.apache.org/xerces/j/binaries/KEYS">https://downl=
oads.apache.org/xerces/j/binaries/KEYS</a></div><div><br></div><div>Can a d=
eveloper confirm this signature is legitimate?</div><div>Or point us to the=
 right location for performing this validation?<br></div><div><br></div><di=
v>Regards,<br></div><div><div><div dir=3D"ltr" class=3D"gmail_signature" da=
ta-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><di=
v dir=3D"ltr"><span><p dir=3D"ltr" style=3D"line-height:1.56;margin-top:0pt=
;margin-bottom:0pt"><span style=3D"background-color:transparent;color:rgb(0=
,0,0);font-family:Arial;font-size:9.5pt;font-weight:700;white-space:pre-wra=
p">Louis Jacomet</span><br></p><p dir=3D"ltr" style=3D"line-height:1.8;marg=
in-top:0pt;margin-bottom:0pt"><span style=3D"font-size:9pt;font-family:Aria=
l;color:rgb(0,0,0);background-color:transparent;vertical-align:baseline;whi=
te-space:pre-wrap">Senior Lead Software Engineer</span></p><p dir=3D"ltr" s=
tyle=3D"line-height:1.8;margin-top:0pt;margin-bottom:0pt"><span style=3D"fo=
nt-size:9.5pt;font-family:Arial;color:rgb(0,0,0);background-color:transpare=
nt;vertical-align:baseline;white-space:pre-wrap">Gradle</span></p><span sty=
le=3D"font-size:9pt;font-family:Arial;color:rgb(29,162,189);background-colo=
r:transparent;vertical-align:baseline;white-space:pre-wrap">W.</span><a hre=
f=3D"https://gradle.com/" target=3D"_blank"><span style=3D"font-size:9pt;fo=
nt-family:Arial;color:rgb(29,162,189);background-color:transparent;vertical=
-align:baseline;white-space:pre-wrap"> </span><span style=3D"font-size:10pt=
;font-family:Arial;color:rgb(29,162,189);background-color:transparent;verti=
cal-align:baseline;white-space:pre-wrap">gradle.com</span></a></span><br></=
div><div dir=3D"ltr"><span><span style=3D"font-size:11pt;font-family:Arial;=
color:rgb(0,0,0);background-color:transparent;vertical-align:baseline;white=
-space:pre-wrap"><br></span></span></div><div dir=3D"ltr"><span><span style=
=3D"font-size:11pt;font-family:Arial;color:rgb(0,0,0);background-color:tran=
sparent;vertical-align:baseline;white-space:pre-wrap"><img src=3D"https://l=
h4.googleusercontent.com/4ES0Nz2stz5vF1grmaeKGKSI7wfJmsH0DPSDDB_REuCtwrTviR=
gpGXynombLF8pDCw7BF-rnj8nv7g9YN5uGD4VpLwEOgSMSgfmESLPU2teurpeCVGSraoQxBgcq9=
Dm2sXXNPNdM" style=3D"border:none" width=3D"117" height=3D"33"></span></spa=
n><br></div></div></div></div></div></div></div></div>

<br>
<b style=3D"color:rgb(128,128,128);font-size:x-small"><br>CONFIDENTIALITY N=
OTICE</b><span style=3D"color:rgb(128,128,128);font-size:x-small">: The con=
tents of this email message, and any attachments, are intended solely for t=
he addressee(s) and may contain confidential, proprietary and/or privileged=
 information legally protected from disclosure. If you are not the intended=
 recipient of this communication, or if you received this communication by =
mistake, please notify the sender immediately and delete this message and a=
ny attachments. If you are not the intended recipient, you are hereby notif=
ied that any use, retransmission, dissemination, copying or storage of this=
 message or its attachments is strictly prohibited.</span><br>
--000000000000f27069060bc02a27--