Re: Verification of release xerces:xercesImpl:2.12.2

--000000000000f50430060bd43c02
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,

This is my key.
I'm not a committer of Xerces J but I handled the push to Maven repository
as there was no committer with time available to do it or respond to my
requests.
See https://issues.apache.org/jira/browse/XERCESJ-1724 and
https://issues.sonatype.org/browse/OSSRH-60102?focusedId=3D972176&page=3Dco=
m.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-9721=
76

If it is fine for committers, I can try to add my key to the place they
want, or give the information which is needed for that.

regards,


On Wed, Dec 6, 2023 at 10:38=E2=80=AFAM Louis Jacomet <[email protected]> wr=
ote:

> Hello,
>
> Sorry, I should have indicated where we obtained Xerces from.
>
> Given this is for integration with the JVM ecosystem, we are using Maven
> Central and obtained the files from there:
> https://repo.maven.apache.org/maven2/xerces/xercesImpl/2.12.2/
>
> I believe that artifacts deployed on Maven Central should be fully
> verifiable, which means the signing key should be included in documented
> KEYS for the project.
>
> Regards,
>
> Louis Jacomet
>
> Senior Lead Software Engineer
>
> Gradle
> W. gradle.com
>
>
>
>
> On Wed, Dec 6, 2023 at 1:05=E2=80=AFAM Mukul Gandhi <[email protected]> w=
rote:
>
>> Hi Louis,
>>    It seems to me that, for your needs you may download XercesJ 2.12.2
>> distributable from https://xerces.apache.org/mirrors.cgi [1].
>>
>> The XercesJ release package downloaded from [1], should have a signature
>> conforming to one of the signing key available at
>> https://downloads.apache.org/xerces/j/binaries/KEYS.
>>
>> On Tue, Dec 5, 2023 at 3:21=E2=80=AFPM Louis Jacomet <[email protected]> =
wrote:
>>
>>> Hey folks,
>>>
>>> While upgrading the xerces version to 2.12.2 inside Gradle
>>> <https://github.com/gradle/gradle/>, we cannot validate that the new
>>> key used to sign the release is legitimate.
>>>
>>> The following key has been used:
>>> 6CB87B18A453990EAC9453F87D713008CC07E9AD (Aur=C3=A9lien Pupier <
>>> [email protected]>)
>>>
>>> But this key is not listed in the KEYS file found at
>>> https://downloads.apache.org/xerces/j/binaries/KEYS
>>>
>>> Can a developer confirm this signature is legitimate?
>>> Or point us to the right location for performing this validation?
>>>
>>> Regards,
>>>
>>> Louis Jacomet
>>>
>>> Senior Lead Software Engineer
>>>
>>> Gradle
>>> W. gradle.com
>>>
>>>
>>
>>
>> --
>> Regards,
>> Mukul Gandhi
>>
>>
>
> *CONFIDENTIALITY NOTICE*: The contents of this email message, and any
> attachments, are intended solely for the addressee(s) and may contain
> confidential, proprietary and/or privileged information legally protected
> from disclosure. If you are not the intended recipient of this
> communication, or if you received this communication by mistake, please
> notify the sender immediately and delete this message and any attachments=
.
> If you are not the intended recipient, you are hereby notified that any
> use, retransmission, dissemination, copying or storage of this message or
> its attachments is strictly prohibited.
>

--000000000000f50430060bd43c02
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hello,</div><div><br></div><div>This is my key.<br></=
div><div>I&#39;m not a committer of Xerces J but I handled the push to Mave=
n repository as there was no committer with time available to do it or resp=
ond to my requests.<br></div><div>See <a href=3D"https://issues.apache.org/=
jira/browse/XERCESJ-1724">https://issues.apache.org/jira/browse/XERCESJ-172=
4</a> and <a href=3D"https://issues.sonatype.org/browse/OSSRH-60102?focused=
Id=3D972176&amp;page=3Dcom.atlassian.jira.plugin.system.issuetabpanels:comm=
ent-tabpanel#comment-972176">https://issues.sonatype.org/browse/OSSRH-60102=
?focusedId=3D972176&amp;page=3Dcom.atlassian.jira.plugin.system.issuetabpan=
els:comment-tabpanel#comment-972176</a></div><div><br></div><div>If it is f=
ine for committers, I can try to add my key to the place they want, or give=
 the information which is needed for that.<br><br></div><div>regards,<br></=
div><div><br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" cl=
ass=3D"gmail_attr">On Wed, Dec 6, 2023 at 10:38=E2=80=AFAM Louis Jacomet &l=
t;<a href=3D"mailto:[email protected]">[email protected]</a>&gt; wrote:<br></=
div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div=
>Hello,</div><div><br></div><div>Sorry, I should have indicated where we ob=
tained Xerces from.</div><div><br></div><div>Given this is for integration =
with the JVM ecosystem, we are using Maven Central and obtained the files f=
rom there: <a href=3D"https://repo.maven.apache.org/maven2/xerces/xercesImp=
l/2.12.2/" target=3D"_blank">https://repo.maven.apache.org/maven2/xerces/xe=
rcesImpl/2.12.2/</a></div><div><br></div><div>I believe that artifacts depl=
oyed on Maven Central should be fully verifiable, which means the signing k=
ey should be included in documented KEYS for the project.</div><div><br></d=
iv><div>Regards,<br></div><div><div><div dir=3D"ltr" class=3D"gmail_signatu=
re"><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=3D"ltr"><span><p dir=3D=
"ltr" style=3D"line-height:1.56;margin-top:0pt;margin-bottom:0pt"><span sty=
le=3D"background-color:transparent;color:rgb(0,0,0);font-family:Arial;font-=
size:9.5pt;font-weight:700;white-space:pre-wrap">Louis Jacomet</span><br></=
p><p dir=3D"ltr" style=3D"line-height:1.8;margin-top:0pt;margin-bottom:0pt"=
><span style=3D"font-size:9pt;font-family:Arial;color:rgb(0,0,0);background=
-color:transparent;vertical-align:baseline;white-space:pre-wrap">Senior Lea=
d Software Engineer</span></p><p dir=3D"ltr" style=3D"line-height:1.8;margi=
n-top:0pt;margin-bottom:0pt"><span style=3D"font-size:9.5pt;font-family:Ari=
al;color:rgb(0,0,0);background-color:transparent;vertical-align:baseline;wh=
ite-space:pre-wrap">Gradle</span></p><span style=3D"font-size:9pt;font-fami=
ly:Arial;color:rgb(29,162,189);background-color:transparent;vertical-align:=
baseline;white-space:pre-wrap">W.</span><a href=3D"https://gradle.com/" tar=
get=3D"_blank"><span style=3D"font-size:9pt;font-family:Arial;color:rgb(29,=
162,189);background-color:transparent;vertical-align:baseline;white-space:p=
re-wrap"> </span><span style=3D"font-size:10pt;font-family:Arial;color:rgb(=
29,162,189);background-color:transparent;vertical-align:baseline;white-spac=
e:pre-wrap">gradle.com</span></a></span><br></div><div dir=3D"ltr"><span><s=
pan style=3D"font-size:11pt;font-family:Arial;color:rgb(0,0,0);background-c=
olor:transparent;vertical-align:baseline;white-space:pre-wrap"><br></span><=
/span></div><div dir=3D"ltr"><span><span style=3D"font-size:11pt;font-famil=
y:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:baseli=
ne;white-space:pre-wrap"><img src=3D"https://lh4.googleusercontent.com/4ES0=
Nz2stz5vF1grmaeKGKSI7wfJmsH0DPSDDB_REuCtwrTviRgpGXynombLF8pDCw7BF-rnj8nv7g9=
YN5uGD4VpLwEOgSMSgfmESLPU2teurpeCVGSraoQxBgcq9Dm2sXXNPNdM" style=3D"border:=
 medium;" width=3D"117" height=3D"33"></span></span><br></div></div></div><=
/div></div></div><br></div></div><br><div class=3D"gmail_quote"><div dir=3D=
"ltr" class=3D"gmail_attr">On Wed, Dec 6, 2023 at 1:05=E2=80=AFAM Mukul Gan=
dhi &lt;<a href=3D"mailto:[email protected]" target=3D"_blank">mukulg@apach=
e.org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"ma=
rgin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:=
1ex"><div dir=3D"ltr"><div>Hi Louis,</div><div>=C2=A0 =C2=A0It seems to me =
that, for your needs you may download XercesJ 2.12.2 distributable from=C2=
=A0<a href=3D"https://xerces.apache.org/mirrors.cgi" target=3D"_blank">http=
s://xerces.apache.org/mirrors.cgi</a> [1].</div><div><br></div><div>The Xer=
cesJ release package downloaded from [1], should have a signature conformin=
g to one of the signing key available at=C2=A0<a href=3D"https://downloads.=
apache.org/xerces/j/binaries/KEYS" target=3D"_blank">https://downloads.apac=
he.org/xerces/j/binaries/KEYS</a>.</div><br><div class=3D"gmail_quote"><div=
 dir=3D"ltr" class=3D"gmail_attr">On Tue, Dec 5, 2023 at 3:21=E2=80=AFPM Lo=
uis Jacomet &lt;<a href=3D"mailto:[email protected]" target=3D"_blank">louis=
@gradle.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex"><div dir=3D"ltr"><div>Hey folks,</div><div><br></div><div>While =
upgrading the xerces version to 2.12.2 inside <a href=3D"https://github.com=
/gradle/gradle/" target=3D"_blank">Gradle</a>, we cannot validate that the =
new key used to sign the release is legitimate.</div><div><br></div><div>Th=
e following key has been used:</div><div>6CB87B18A453990EAC9453F87D713008CC=
07E9AD (Aur=C3=A9lien Pupier &lt;<a href=3D"mailto:[email protected]" targ=
et=3D"_blank">[email protected]</a>&gt;)</div><div><br></div><div>But this=
 key is not listed in the KEYS file found at <a href=3D"https://downloads.a=
pache.org/xerces/j/binaries/KEYS" target=3D"_blank">https://downloads.apach=
e.org/xerces/j/binaries/KEYS</a></div><div><br></div><div>Can a developer c=
onfirm this signature is legitimate?</div><div>Or point us to the right loc=
ation for performing this validation?<br></div><div><br></div><div>Regards,=
<br></div><div><div><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"=
ltr"><div><div dir=3D"ltr"><div dir=3D"ltr"><span><p dir=3D"ltr" style=3D"l=
ine-height:1.56;margin-top:0pt;margin-bottom:0pt"><span style=3D"background=
-color:transparent;color:rgb(0,0,0);font-family:Arial;font-size:9.5pt;font-=
weight:700;white-space:pre-wrap">Louis Jacomet</span><br></p><p dir=3D"ltr"=
 style=3D"line-height:1.8;margin-top:0pt;margin-bottom:0pt"><span style=3D"=
font-size:9pt;font-family:Arial;color:rgb(0,0,0);background-color:transpare=
nt;vertical-align:baseline;white-space:pre-wrap">Senior Lead Software Engin=
eer</span></p><p dir=3D"ltr" style=3D"line-height:1.8;margin-top:0pt;margin=
-bottom:0pt"><span style=3D"font-size:9.5pt;font-family:Arial;color:rgb(0,0=
,0);background-color:transparent;vertical-align:baseline;white-space:pre-wr=
ap">Gradle</span></p><span style=3D"font-size:9pt;font-family:Arial;color:r=
gb(29,162,189);background-color:transparent;vertical-align:baseline;white-s=
pace:pre-wrap">W.</span><a href=3D"https://gradle.com/" target=3D"_blank"><=
span style=3D"font-size:9pt;font-family:Arial;color:rgb(29,162,189);backgro=
und-color:transparent;vertical-align:baseline;white-space:pre-wrap"> </span=
><span style=3D"font-size:10pt;font-family:Arial;color:rgb(29,162,189);back=
ground-color:transparent;vertical-align:baseline;white-space:pre-wrap">grad=
le.com</span></a></span><br></div><div dir=3D"ltr"><span><span style=3D"fon=
t-size:11pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent=
;vertical-align:baseline;white-space:pre-wrap"><br></span></span></div><div=
 dir=3D"ltr"><span><span style=3D"font-size:11pt;font-family:Arial;color:rg=
b(0,0,0);background-color:transparent;vertical-align:baseline;white-space:p=
re-wrap"><img src=3D"https://lh4.googleusercontent.com/4ES0Nz2stz5vF1grmaeK=
GKSI7wfJmsH0DPSDDB_REuCtwrTviRgpGXynombLF8pDCw7BF-rnj8nv7g9YN5uGD4VpLwEOgSM=
SgfmESLPU2teurpeCVGSraoQxBgcq9Dm2sXXNPNdM" style=3D"border: medium;" width=
=3D"117" height=3D"33"></span></span></div></div></div></div></div></div></=
div></div></blockquote></div><br clear=3D"all"><div><br></div><div><br></di=
v><span class=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" cla=
ss=3D"gmail_signature"><div dir=3D"ltr"><div>Regards,<br>Mukul Gandhi<br><b=
r></div></div></div></div>
</blockquote></div>

<br>
<b style=3D"color:rgb(128,128,128);font-size:x-small"><br>CONFIDENTIALITY N=
OTICE</b><span style=3D"color:rgb(128,128,128);font-size:x-small">: The con=
tents of this email message, and any attachments, are intended solely for t=
he addressee(s) and may contain confidential, proprietary and/or privileged=
 information legally protected from disclosure. If you are not the intended=
 recipient of this communication, or if you received this communication by =
mistake, please notify the sender immediately and delete this message and a=
ny attachments. If you are not the intended recipient, you are hereby notif=
ied that any use, retransmission, dissemination, copying or storage of this=
 message or its attachments is strictly prohibited.</span><br></blockquote>=
</div>

--000000000000f50430060bd43c02--