Re: Verification of release xerces:xercesImpl:2.12.2

--000000000000297f59060bd4017a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,

Sorry, I should have indicated where we obtained Xerces from.

Given this is for integration with the JVM ecosystem, we are using Maven
Central and obtained the files from there:
https://repo.maven.apache.org/maven2/xerces/xercesImpl/2.12.2/

I believe that artifacts deployed on Maven Central should be fully
verifiable, which means the signing key should be included in documented
KEYS for the project.

Regards,

Louis Jacomet

Senior Lead Software Engineer

Gradle
W. gradle.com




On Wed, Dec 6, 2023 at 1:05=E2=80=AFAM Mukul Gandhi <[email protected]> wro=
te:

> Hi Louis,
>    It seems to me that, for your needs you may download XercesJ 2.12.2
> distributable from https://xerces.apache.org/mirrors.cgi [1].
>
> The XercesJ release package downloaded from [1], should have a signature
> conforming to one of the signing key available at
> https://downloads.apache.org/xerces/j/binaries/KEYS.
>
> On Tue, Dec 5, 2023 at 3:21=E2=80=AFPM Louis Jacomet <[email protected]> w=
rote:
>
>> Hey folks,
>>
>> While upgrading the xerces version to 2.12.2 inside Gradle
>> <https://github.com/gradle/gradle/>, we cannot validate that the new key
>> used to sign the release is legitimate.
>>
>> The following key has been used:
>> 6CB87B18A453990EAC9453F87D713008CC07E9AD (Aur=C3=A9lien Pupier <
>> [email protected]>)
>>
>> But this key is not listed in the KEYS file found at
>> https://downloads.apache.org/xerces/j/binaries/KEYS
>>
>> Can a developer confirm this signature is legitimate?
>> Or point us to the right location for performing this validation?
>>
>> Regards,
>>
>> Louis Jacomet
>>
>> Senior Lead Software Engineer
>>
>> Gradle
>> W. gradle.com
>>
>>
>
>
> --
> Regards,
> Mukul Gandhi
>
>

--=20
*
CONFIDENTIALITY NOTICE*: The contents of this email message, and any=20
attachments, are intended solely for the addressee(s) and may contain=20
confidential, proprietary and/or privileged information legally protected=
=20
from disclosure. If you are not the intended recipient of this=20
communication, or if you received this communication by mistake, please=20
notify the sender immediately and delete this message and any attachments.=
=20
If you are not the intended recipient, you are hereby notified that any=20
use, retransmission, dissemination, copying or storage of this message or=
=20
its attachments is strictly prohibited.

--000000000000297f59060bd4017a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hello,</div><div><br></div><div>Sorry, I should have =
indicated where we obtained Xerces from.</div><div><br></div><div>Given thi=
s is for integration with the JVM ecosystem, we are using Maven Central and=
 obtained the files from there: <a href=3D"https://repo.maven.apache.org/ma=
ven2/xerces/xercesImpl/2.12.2/">https://repo.maven.apache.org/maven2/xerces=
/xercesImpl/2.12.2/</a></div><div><br></div><div>I believe that artifacts d=
eployed on Maven Central should be fully verifiable, which means the signin=
g key should be included in documented KEYS for the project.</div><div><br>=
</div><div>Regards,<br></div><div><div><div dir=3D"ltr" class=3D"gmail_sign=
ature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D=
"ltr"><div dir=3D"ltr"><span><p dir=3D"ltr" style=3D"line-height:1.56;margi=
n-top:0pt;margin-bottom:0pt"><span style=3D"background-color:transparent;co=
lor:rgb(0,0,0);font-family:Arial;font-size:9.5pt;font-weight:700;white-spac=
e:pre-wrap">Louis Jacomet</span><br></p><p dir=3D"ltr" style=3D"line-height=
:1.8;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:9pt;font-fa=
mily:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:bas=
eline;white-space:pre-wrap">Senior Lead Software Engineer</span></p><p dir=
=3D"ltr" style=3D"line-height:1.8;margin-top:0pt;margin-bottom:0pt"><span s=
tyle=3D"font-size:9.5pt;font-family:Arial;color:rgb(0,0,0);background-color=
:transparent;vertical-align:baseline;white-space:pre-wrap">Gradle</span></p=
><span style=3D"font-size:9pt;font-family:Arial;color:rgb(29,162,189);backg=
round-color:transparent;vertical-align:baseline;white-space:pre-wrap">W.</s=
pan><a href=3D"https://gradle.com/" target=3D"_blank"><span style=3D"font-s=
ize:9pt;font-family:Arial;color:rgb(29,162,189);background-color:transparen=
t;vertical-align:baseline;white-space:pre-wrap"> </span><span style=3D"font=
-size:10pt;font-family:Arial;color:rgb(29,162,189);background-color:transpa=
rent;vertical-align:baseline;white-space:pre-wrap">gradle.com</span></a></s=
pan><br></div><div dir=3D"ltr"><span><span style=3D"font-size:11pt;font-fam=
ily:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:base=
line;white-space:pre-wrap"><br></span></span></div><div dir=3D"ltr"><span><=
span style=3D"font-size:11pt;font-family:Arial;color:rgb(0,0,0);background-=
color:transparent;vertical-align:baseline;white-space:pre-wrap"><img src=3D=
"https://lh4.googleusercontent.com/4ES0Nz2stz5vF1grmaeKGKSI7wfJmsH0DPSDDB_R=
EuCtwrTviRgpGXynombLF8pDCw7BF-rnj8nv7g9YN5uGD4VpLwEOgSMSgfmESLPU2teurpeCVGS=
raoQxBgcq9Dm2sXXNPNdM" style=3D"border: medium;" width=3D"117" height=3D"33=
"></span></span><br></div></div></div></div></div></div><br></div></div><br=
><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, D=
ec 6, 2023 at 1:05=E2=80=AFAM Mukul Gandhi &lt;<a href=3D"mailto:mukulg@apa=
che.org">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gma=
il_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,2=
04,204);padding-left:1ex"><div dir=3D"ltr"><div>Hi Louis,</div><div>=C2=A0 =
=C2=A0It seems to me that, for your needs you may download XercesJ 2.12.2 d=
istributable from=C2=A0<a href=3D"https://xerces.apache.org/mirrors.cgi" ta=
rget=3D"_blank">https://xerces.apache.org/mirrors.cgi</a> [1].</div><div><b=
r></div><div>The XercesJ release package downloaded from [1], should have a=
 signature conforming to one of the signing key available at=C2=A0<a href=
=3D"https://downloads.apache.org/xerces/j/binaries/KEYS" target=3D"_blank">=
https://downloads.apache.org/xerces/j/binaries/KEYS</a>.</div><br><div clas=
s=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Dec 5, 2023=
 at 3:21=E2=80=AFPM Louis Jacomet &lt;<a href=3D"mailto:[email protected]" t=
arget=3D"_blank">[email protected]</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div>Hey folks,</div><div=
><br></div><div>While upgrading the xerces version to 2.12.2 inside <a href=
=3D"https://github.com/gradle/gradle/" target=3D"_blank">Gradle</a>, we can=
not validate that the new key used to sign the release is legitimate.</div>=
<div><br></div><div>The following key has been used:</div><div>6CB87B18A453=
990EAC9453F87D713008CC07E9AD (Aur=C3=A9lien Pupier &lt;<a href=3D"mailto:ap=
[email protected]" target=3D"_blank">[email protected]</a>&gt;)</div><div><=
br></div><div>But this key is not listed in the KEYS file found at <a href=
=3D"https://downloads.apache.org/xerces/j/binaries/KEYS" target=3D"_blank">=
https://downloads.apache.org/xerces/j/binaries/KEYS</a></div><div><br></div=
><div>Can a developer confirm this signature is legitimate?</div><div>Or po=
int us to the right location for performing this validation?<br></div><div>=
<br></div><div>Regards,<br></div><div><div><div dir=3D"ltr" class=3D"gmail_=
signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=3D"ltr"><span><p=
 dir=3D"ltr" style=3D"line-height:1.56;margin-top:0pt;margin-bottom:0pt"><s=
pan style=3D"background-color:transparent;color:rgb(0,0,0);font-family:Aria=
l;font-size:9.5pt;font-weight:700;white-space:pre-wrap">Louis Jacomet</span=
><br></p><p dir=3D"ltr" style=3D"line-height:1.8;margin-top:0pt;margin-bott=
om:0pt"><span style=3D"font-size:9pt;font-family:Arial;color:rgb(0,0,0);bac=
kground-color:transparent;vertical-align:baseline;white-space:pre-wrap">Sen=
ior Lead Software Engineer</span></p><p dir=3D"ltr" style=3D"line-height:1.=
8;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:9.5pt;font-fam=
ily:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:base=
line;white-space:pre-wrap">Gradle</span></p><span style=3D"font-size:9pt;fo=
nt-family:Arial;color:rgb(29,162,189);background-color:transparent;vertical=
-align:baseline;white-space:pre-wrap">W.</span><a href=3D"https://gradle.co=
m/" target=3D"_blank"><span style=3D"font-size:9pt;font-family:Arial;color:=
rgb(29,162,189);background-color:transparent;vertical-align:baseline;white-=
space:pre-wrap"> </span><span style=3D"font-size:10pt;font-family:Arial;col=
or:rgb(29,162,189);background-color:transparent;vertical-align:baseline;whi=
te-space:pre-wrap">gradle.com</span></a></span><br></div><div dir=3D"ltr"><=
span><span style=3D"font-size:11pt;font-family:Arial;color:rgb(0,0,0);backg=
round-color:transparent;vertical-align:baseline;white-space:pre-wrap"><br><=
/span></span></div><div dir=3D"ltr"><span><span style=3D"font-size:11pt;fon=
t-family:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align=
:baseline;white-space:pre-wrap"><img src=3D"https://lh4.googleusercontent.c=
om/4ES0Nz2stz5vF1grmaeKGKSI7wfJmsH0DPSDDB_REuCtwrTviRgpGXynombLF8pDCw7BF-rn=
j8nv7g9YN5uGD4VpLwEOgSMSgfmESLPU2teurpeCVGSraoQxBgcq9Dm2sXXNPNdM" style=3D"=
border: medium;" width=3D"117" height=3D"33"></span></span></div></div></di=
v></div></div></div></div></div></blockquote></div><br clear=3D"all"><div><=
br></div><div><br></div><span class=3D"gmail_signature_prefix">-- </span><b=
r><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr"><div>Regards,=
<br>Mukul Gandhi<br><br></div></div></div></div>
</blockquote></div>

<br>
<b style=3D"color:rgb(128,128,128);font-size:x-small"><br>CONFIDENTIALITY N=
OTICE</b><span style=3D"color:rgb(128,128,128);font-size:x-small">: The con=
tents of this email message, and any attachments, are intended solely for t=
he addressee(s) and may contain confidential, proprietary and/or privileged=
 information legally protected from disclosure. If you are not the intended=
 recipient of this communication, or if you received this communication by =
mistake, please notify the sender immediately and delete this message and a=
ny attachments. If you are not the intended recipient, you are hereby notif=
ied that any use, retransmission, dissemination, copying or storage of this=
 message or its attachments is strictly prohibited.</span><br>
--000000000000297f59060bd4017a--