Re: Verification of release xerces:xercesImpl:2.12.2

--000000000000a82fab060bccf166
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Louis,
   It seems to me that, for your needs you may download XercesJ 2.12.2
distributable from https://xerces.apache.org/mirrors.cgi [1].

The XercesJ release package downloaded from [1], should have a signature
conforming to one of the signing key available at
https://downloads.apache.org/xerces/j/binaries/KEYS.

On Tue, Dec 5, 2023 at 3:21=E2=80=AFPM Louis Jacomet <[email protected]> wro=
te:

> Hey folks,
>
> While upgrading the xerces version to 2.12.2 inside Gradle
> <https://github.com/gradle/gradle/>, we cannot validate that the new key
> used to sign the release is legitimate.
>
> The following key has been used:
> 6CB87B18A453990EAC9453F87D713008CC07E9AD (Aur=C3=A9lien Pupier <
> [email protected]>)
>
> But this key is not listed in the KEYS file found at
> https://downloads.apache.org/xerces/j/binaries/KEYS
>
> Can a developer confirm this signature is legitimate?
> Or point us to the right location for performing this validation?
>
> Regards,
>
> Louis Jacomet
>
> Senior Lead Software Engineer
>
> Gradle
> W. gradle.com
>
>


--=20
Regards,
Mukul Gandhi

--000000000000a82fab060bccf166
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi Louis,</div><div>=C2=A0 =C2=A0It seems to me that,=
 for your needs you may download XercesJ 2.12.2 distributable from=C2=A0<a =
href=3D"https://xerces.apache.org/mirrors.cgi">https://xerces.apache.org/mi=
rrors.cgi</a> [1].</div><div><br></div><div>The XercesJ release package dow=
nloaded from [1], should have a signature conforming to one of the signing =
key available at=C2=A0<a href=3D"https://downloads.apache.org/xerces/j/bina=
ries/KEYS" target=3D"_blank">https://downloads.apache.org/xerces/j/binaries=
/KEYS</a>.</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gm=
ail_attr">On Tue, Dec 5, 2023 at 3:21=E2=80=AFPM Louis Jacomet &lt;<a href=
=3D"mailto:[email protected]">[email protected]</a>&gt; wrote:<br></div><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:=
1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div>Hey folk=
s,</div><div><br></div><div>While upgrading the xerces version to 2.12.2 in=
side <a href=3D"https://github.com/gradle/gradle/" target=3D"_blank">Gradle=
</a>, we cannot validate that the new key used to sign the release is legit=
imate.</div><div><br></div><div>The following key has been used:</div><div>=
6CB87B18A453990EAC9453F87D713008CC07E9AD (Aur=C3=A9lien Pupier &lt;<a href=
=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>&gt;=
)</div><div><br></div><div>But this key is not listed in the KEYS file foun=
d at <a href=3D"https://downloads.apache.org/xerces/j/binaries/KEYS" target=
=3D"_blank">https://downloads.apache.org/xerces/j/binaries/KEYS</a></div><d=
iv><br></div><div>Can a developer confirm this signature is legitimate?</di=
v><div>Or point us to the right location for performing this validation?<br=
></div><div><br></div><div>Regards,<br></div><div><div><div dir=3D"ltr" cla=
ss=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=3D"l=
tr"><span><p dir=3D"ltr" style=3D"line-height:1.56;margin-top:0pt;margin-bo=
ttom:0pt"><span style=3D"background-color:transparent;color:rgb(0,0,0);font=
-family:Arial;font-size:9.5pt;font-weight:700;white-space:pre-wrap">Louis J=
acomet</span><br></p><p dir=3D"ltr" style=3D"line-height:1.8;margin-top:0pt=
;margin-bottom:0pt"><span style=3D"font-size:9pt;font-family:Arial;color:rg=
b(0,0,0);background-color:transparent;vertical-align:baseline;white-space:p=
re-wrap">Senior Lead Software Engineer</span></p><p dir=3D"ltr" style=3D"li=
ne-height:1.8;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:9.=
5pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;vertica=
l-align:baseline;white-space:pre-wrap">Gradle</span></p><span style=3D"font=
-size:9pt;font-family:Arial;color:rgb(29,162,189);background-color:transpar=
ent;vertical-align:baseline;white-space:pre-wrap">W.</span><a href=3D"https=
://gradle.com/" target=3D"_blank"><span style=3D"font-size:9pt;font-family:=
Arial;color:rgb(29,162,189);background-color:transparent;vertical-align:bas=
eline;white-space:pre-wrap"> </span><span style=3D"font-size:10pt;font-fami=
ly:Arial;color:rgb(29,162,189);background-color:transparent;vertical-align:=
baseline;white-space:pre-wrap">gradle.com</span></a></span><br></div><div d=
ir=3D"ltr"><span><span style=3D"font-size:11pt;font-family:Arial;color:rgb(=
0,0,0);background-color:transparent;vertical-align:baseline;white-space:pre=
-wrap"><br></span></span></div><div dir=3D"ltr"><span><span style=3D"font-s=
ize:11pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;ve=
rtical-align:baseline;white-space:pre-wrap"><img src=3D"https://lh4.googleu=
sercontent.com/4ES0Nz2stz5vF1grmaeKGKSI7wfJmsH0DPSDDB_REuCtwrTviRgpGXynombL=
F8pDCw7BF-rnj8nv7g9YN5uGD4VpLwEOgSMSgfmESLPU2teurpeCVGSraoQxBgcq9Dm2sXXNPNd=
M" style=3D"border: none;" width=3D"117" height=3D"33"></span></span></div>=
</div></div></div></div></div></div></div></blockquote></div><br clear=3D"a=
ll"><div><br></div><div><br></div><span class=3D"gmail_signature_prefix">--=
 </span><br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr"><di=
v>Regards,<br>Mukul Gandhi<br><br></div></div></div></div>

--000000000000a82fab060bccf166--