Re: Verification of release xerces:xercesImpl:2.12.2

--000000000000e2bbe2060bd504e4
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Aur=C3=A9lien,

Thanks for providing a trail.

Since the Maven Central published JAR has the same SHA256 checksum as the
one downloaded from the Xerces site, this is all good.

Regards,

Louis Jacomet

Senior Lead Software Engineer

Gradle
W. gradle.com




On Wed, Dec 6, 2023 at 9:48=E2=80=AFAM Aur=C3=A9lien Pupier <apupier@redhat=
.com> wrote:

> Hello,
>
> This is my key.
> I'm not a committer of Xerces J but I handled the push to Maven repositor=
y
> as there was no committer with time available to do it or respond to my
> requests.
> See https://issues.apache.org/jira/browse/XERCESJ-1724 and
> https://issues.sonatype.org/browse/OSSRH-60102?focusedId=3D972176&page=3D=
com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-97=
2176
>
> If it is fine for committers, I can try to add my key to the place they
> want, or give the information which is needed for that.
>
> regards,
>
>
> On Wed, Dec 6, 2023 at 10:38=E2=80=AFAM Louis Jacomet <[email protected]> =
wrote:
>
>> Hello,
>>
>> Sorry, I should have indicated where we obtained Xerces from.
>>
>> Given this is for integration with the JVM ecosystem, we are using Maven
>> Central and obtained the files from there:
>> https://repo.maven.apache.org/maven2/xerces/xercesImpl/2.12.2/
>>
>> I believe that artifacts deployed on Maven Central should be fully
>> verifiable, which means the signing key should be included in documented
>> KEYS for the project.
>>
>> Regards,
>>
>> Louis Jacomet
>>
>> Senior Lead Software Engineer
>>
>> Gradle
>> W. gradle.com
>>
>>
>>
>>
>> On Wed, Dec 6, 2023 at 1:05=E2=80=AFAM Mukul Gandhi <[email protected]> =
wrote:
>>
>>> Hi Louis,
>>>    It seems to me that, for your needs you may download XercesJ 2.12.2
>>> distributable from https://xerces.apache.org/mirrors.cgi [1].
>>>
>>> The XercesJ release package downloaded from [1], should have a signatur=
e
>>> conforming to one of the signing key available at
>>> https://downloads.apache.org/xerces/j/binaries/KEYS.
>>>
>>> On Tue, Dec 5, 2023 at 3:21=E2=80=AFPM Louis Jacomet <[email protected]>=
 wrote:
>>>
>>>> Hey folks,
>>>>
>>>> While upgrading the xerces version to 2.12.2 inside Gradle
>>>> <https://github.com/gradle/gradle/>, we cannot validate that the new
>>>> key used to sign the release is legitimate.
>>>>
>>>> The following key has been used:
>>>> 6CB87B18A453990EAC9453F87D713008CC07E9AD (Aur=C3=A9lien Pupier <
>>>> [email protected]>)
>>>>
>>>> But this key is not listed in the KEYS file found at
>>>> https://downloads.apache.org/xerces/j/binaries/KEYS
>>>>
>>>> Can a developer confirm this signature is legitimate?
>>>> Or point us to the right location for performing this validation?
>>>>
>>>> Regards,
>>>>
>>>> Louis Jacomet
>>>>
>>>> Senior Lead Software Engineer
>>>>
>>>> Gradle
>>>> W. gradle.com
>>>>
>>>>
>>>
>>>
>>> --
>>> Regards,
>>> Mukul Gandhi
>>>
>>>
>>
>> *CONFIDENTIALITY NOTICE*: The contents of this email message, and any
>> attachments, are intended solely for the addressee(s) and may contain
>> confidential, proprietary and/or privileged information legally protecte=
d
>> from disclosure. If you are not the intended recipient of this
>> communication, or if you received this communication by mistake, please
>> notify the sender immediately and delete this message and any attachment=
s.
>> If you are not the intended recipient, you are hereby notified that any
>> use, retransmission, dissemination, copying or storage of this message o=
r
>> its attachments is strictly prohibited.
>>
>

--=20
*
CONFIDENTIALITY NOTICE*: The contents of this email message, and any=20
attachments, are intended solely for the addressee(s) and may contain=20
confidential, proprietary and/or privileged information legally protected=
=20
from disclosure. If you are not the intended recipient of this=20
communication, or if you received this communication by mistake, please=20
notify the sender immediately and delete this message and any attachments.=
=20
If you are not the intended recipient, you are hereby notified that any=20
use, retransmission, dissemination, copying or storage of this message or=
=20
its attachments is strictly prohibited.

--000000000000e2bbe2060bd504e4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi Aur=C3=A9lien,</div><div><br></div><div>Thanks for=
 providing a trail.</div><div><br></div><div>Since the Maven Central publis=
hed JAR has the same SHA256 checksum as the one downloaded from the Xerces =
site, this is all good.</div><div><br></div><div>Regards,<br></div><div><di=
v><div dir=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"gmail_signat=
ure"><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=3D"ltr"><span><p dir=
=3D"ltr" style=3D"line-height:1.56;margin-top:0pt;margin-bottom:0pt"><span =
style=3D"background-color:transparent;color:rgb(0,0,0);font-family:Arial;fo=
nt-size:9.5pt;font-weight:700;white-space:pre-wrap">Louis Jacomet</span><br=
></p><p dir=3D"ltr" style=3D"line-height:1.8;margin-top:0pt;margin-bottom:0=
pt"><span style=3D"font-size:9pt;font-family:Arial;color:rgb(0,0,0);backgro=
und-color:transparent;vertical-align:baseline;white-space:pre-wrap">Senior =
Lead Software Engineer</span></p><p dir=3D"ltr" style=3D"line-height:1.8;ma=
rgin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:9.5pt;font-family:=
Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:baseline=
;white-space:pre-wrap">Gradle</span></p><span style=3D"font-size:9pt;font-f=
amily:Arial;color:rgb(29,162,189);background-color:transparent;vertical-ali=
gn:baseline;white-space:pre-wrap">W.</span><a href=3D"https://gradle.com/" =
target=3D"_blank"><span style=3D"font-size:9pt;font-family:Arial;color:rgb(=
29,162,189);background-color:transparent;vertical-align:baseline;white-spac=
e:pre-wrap"> </span><span style=3D"font-size:10pt;font-family:Arial;color:r=
gb(29,162,189);background-color:transparent;vertical-align:baseline;white-s=
pace:pre-wrap">gradle.com</span></a></span><br></div><div dir=3D"ltr"><span=
><span style=3D"font-size:11pt;font-family:Arial;color:rgb(0,0,0);backgroun=
d-color:transparent;vertical-align:baseline;white-space:pre-wrap"><br></spa=
n></span></div><div dir=3D"ltr"><span><span style=3D"font-size:11pt;font-fa=
mily:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:bas=
eline;white-space:pre-wrap"><img src=3D"https://lh4.googleusercontent.com/4=
ES0Nz2stz5vF1grmaeKGKSI7wfJmsH0DPSDDB_REuCtwrTviRgpGXynombLF8pDCw7BF-rnj8nv=
7g9YN5uGD4VpLwEOgSMSgfmESLPU2teurpeCVGSraoQxBgcq9Dm2sXXNPNdM" style=3D"bord=
er: medium;" width=3D"117" height=3D"33"></span></span><br></div></div></di=
v></div></div></div><br></div></div><br><div class=3D"gmail_quote"><div dir=
=3D"ltr" class=3D"gmail_attr">On Wed, Dec 6, 2023 at 9:48=E2=80=AFAM Aur=C3=
=A9lien Pupier &lt;<a href=3D"mailto:[email protected]">[email protected]=
</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:=
0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">=
<div dir=3D"ltr"><div>Hello,</div><div><br></div><div>This is my key.<br></=
div><div>I&#39;m not a committer of Xerces J but I handled the push to Mave=
n repository as there was no committer with time available to do it or resp=
ond to my requests.<br></div><div>See <a href=3D"https://issues.apache.org/=
jira/browse/XERCESJ-1724" target=3D"_blank">https://issues.apache.org/jira/=
browse/XERCESJ-1724</a> and <a href=3D"https://issues.sonatype.org/browse/O=
SSRH-60102?focusedId=3D972176&amp;page=3Dcom.atlassian.jira.plugin.system.i=
ssuetabpanels:comment-tabpanel#comment-972176" target=3D"_blank">https://is=
sues.sonatype.org/browse/OSSRH-60102?focusedId=3D972176&amp;page=3Dcom.atla=
ssian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-972176</a>=
</div><div><br></div><div>If it is fine for committers, I can try to add my=
 key to the place they want, or give the information which is needed for th=
at.<br><br></div><div>regards,<br></div><div><br></div></div><br><div class=
=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Dec 6, 2023 =
at 10:38=E2=80=AFAM Louis Jacomet &lt;<a href=3D"mailto:[email protected]" t=
arget=3D"_blank">[email protected]</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div>Hello,</div><div><br=
></div><div>Sorry, I should have indicated where we obtained Xerces from.</=
div><div><br></div><div>Given this is for integration with the JVM ecosyste=
m, we are using Maven Central and obtained the files from there: <a href=3D=
"https://repo.maven.apache.org/maven2/xerces/xercesImpl/2.12.2/" target=3D"=
_blank">https://repo.maven.apache.org/maven2/xerces/xercesImpl/2.12.2/</a><=
/div><div><br></div><div>I believe that artifacts deployed on Maven Central=
 should be fully verifiable, which means the signing key should be included=
 in documented KEYS for the project.</div><div><br></div><div>Regards,<br><=
/div><div><div><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">=
<div><div dir=3D"ltr"><div dir=3D"ltr"><span><p dir=3D"ltr" style=3D"line-h=
eight:1.56;margin-top:0pt;margin-bottom:0pt"><span style=3D"background-colo=
r:transparent;color:rgb(0,0,0);font-family:Arial;font-size:9.5pt;font-weigh=
t:700;white-space:pre-wrap">Louis Jacomet</span><br></p><p dir=3D"ltr" styl=
e=3D"line-height:1.8;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-=
size:9pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;ve=
rtical-align:baseline;white-space:pre-wrap">Senior Lead Software Engineer</=
span></p><p dir=3D"ltr" style=3D"line-height:1.8;margin-top:0pt;margin-bott=
om:0pt"><span style=3D"font-size:9.5pt;font-family:Arial;color:rgb(0,0,0);b=
ackground-color:transparent;vertical-align:baseline;white-space:pre-wrap">G=
radle</span></p><span style=3D"font-size:9pt;font-family:Arial;color:rgb(29=
,162,189);background-color:transparent;vertical-align:baseline;white-space:=
pre-wrap">W.</span><a href=3D"https://gradle.com/" target=3D"_blank"><span =
style=3D"font-size:9pt;font-family:Arial;color:rgb(29,162,189);background-c=
olor:transparent;vertical-align:baseline;white-space:pre-wrap"> </span><spa=
n style=3D"font-size:10pt;font-family:Arial;color:rgb(29,162,189);backgroun=
d-color:transparent;vertical-align:baseline;white-space:pre-wrap">gradle.co=
m</span></a></span><br></div><div dir=3D"ltr"><span><span style=3D"font-siz=
e:11pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;vert=
ical-align:baseline;white-space:pre-wrap"><br></span></span></div><div dir=
=3D"ltr"><span><span style=3D"font-size:11pt;font-family:Arial;color:rgb(0,=
0,0);background-color:transparent;vertical-align:baseline;white-space:pre-w=
rap"><img src=3D"https://lh4.googleusercontent.com/4ES0Nz2stz5vF1grmaeKGKSI=
7wfJmsH0DPSDDB_REuCtwrTviRgpGXynombLF8pDCw7BF-rnj8nv7g9YN5uGD4VpLwEOgSMSgfm=
ESLPU2teurpeCVGSraoQxBgcq9Dm2sXXNPNdM" style=3D"border: medium;" width=3D"1=
17" height=3D"33"></span></span><br></div></div></div></div></div></div><br=
></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail=
_attr">On Wed, Dec 6, 2023 at 1:05=E2=80=AFAM Mukul Gandhi &lt;<a href=3D"m=
ailto:[email protected]" target=3D"_blank">[email protected]</a>&gt; wrote:=
<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8=
ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr=
"><div>Hi Louis,</div><div>=C2=A0 =C2=A0It seems to me that, for your needs=
 you may download XercesJ 2.12.2 distributable from=C2=A0<a href=3D"https:/=
/xerces.apache.org/mirrors.cgi" target=3D"_blank">https://xerces.apache.org=
/mirrors.cgi</a> [1].</div><div><br></div><div>The XercesJ release package =
downloaded from [1], should have a signature conforming to one of the signi=
ng key available at=C2=A0<a href=3D"https://downloads.apache.org/xerces/j/b=
inaries/KEYS" target=3D"_blank">https://downloads.apache.org/xerces/j/binar=
ies/KEYS</a>.</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D=
"gmail_attr">On Tue, Dec 5, 2023 at 3:21=E2=80=AFPM Louis Jacomet &lt;<a hr=
ef=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>&gt; w=
rote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0p=
x 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=
=3D"ltr"><div>Hey folks,</div><div><br></div><div>While upgrading the xerce=
s version to 2.12.2 inside <a href=3D"https://github.com/gradle/gradle/" ta=
rget=3D"_blank">Gradle</a>, we cannot validate that the new key used to sig=
n the release is legitimate.</div><div><br></div><div>The following key has=
 been used:</div><div>6CB87B18A453990EAC9453F87D713008CC07E9AD (Aur=C3=A9li=
en Pupier &lt;<a href=3D"mailto:[email protected]" target=3D"_blank">apupi=
[email protected]</a>&gt;)</div><div><br></div><div>But this key is not listed =
in the KEYS file found at <a href=3D"https://downloads.apache.org/xerces/j/=
binaries/KEYS" target=3D"_blank">https://downloads.apache.org/xerces/j/bina=
ries/KEYS</a></div><div><br></div><div>Can a developer confirm this signatu=
re is legitimate?</div><div>Or point us to the right location for performin=
g this validation?<br></div><div><br></div><div>Regards,<br></div><div><div=
><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=
=3D"ltr"><div dir=3D"ltr"><span><p dir=3D"ltr" style=3D"line-height:1.56;ma=
rgin-top:0pt;margin-bottom:0pt"><span style=3D"background-color:transparent=
;color:rgb(0,0,0);font-family:Arial;font-size:9.5pt;font-weight:700;white-s=
pace:pre-wrap">Louis Jacomet</span><br></p><p dir=3D"ltr" style=3D"line-hei=
ght:1.8;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:9pt;font=
-family:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:=
baseline;white-space:pre-wrap">Senior Lead Software Engineer</span></p><p d=
ir=3D"ltr" style=3D"line-height:1.8;margin-top:0pt;margin-bottom:0pt"><span=
 style=3D"font-size:9.5pt;font-family:Arial;color:rgb(0,0,0);background-col=
or:transparent;vertical-align:baseline;white-space:pre-wrap">Gradle</span><=
/p><span style=3D"font-size:9pt;font-family:Arial;color:rgb(29,162,189);bac=
kground-color:transparent;vertical-align:baseline;white-space:pre-wrap">W.<=
/span><a href=3D"https://gradle.com/" target=3D"_blank"><span style=3D"font=
-size:9pt;font-family:Arial;color:rgb(29,162,189);background-color:transpar=
ent;vertical-align:baseline;white-space:pre-wrap"> </span><span style=3D"fo=
nt-size:10pt;font-family:Arial;color:rgb(29,162,189);background-color:trans=
parent;vertical-align:baseline;white-space:pre-wrap">gradle.com</span></a><=
/span><br></div><div dir=3D"ltr"><span><span style=3D"font-size:11pt;font-f=
amily:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:ba=
seline;white-space:pre-wrap"><br></span></span></div><div dir=3D"ltr"><span=
><span style=3D"font-size:11pt;font-family:Arial;color:rgb(0,0,0);backgroun=
d-color:transparent;vertical-align:baseline;white-space:pre-wrap"><img src=
=3D"https://lh4.googleusercontent.com/4ES0Nz2stz5vF1grmaeKGKSI7wfJmsH0DPSDD=
B_REuCtwrTviRgpGXynombLF8pDCw7BF-rnj8nv7g9YN5uGD4VpLwEOgSMSgfmESLPU2teurpeC=
VGSraoQxBgcq9Dm2sXXNPNdM" style=3D"border: medium;" width=3D"117" height=3D=
"33"></span></span></div></div></div></div></div></div></div></div></blockq=
uote></div><br clear=3D"all"><div><br></div><div><br></div><span class=3D"g=
mail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signat=
ure"><div dir=3D"ltr"><div>Regards,<br>Mukul Gandhi<br><br></div></div></di=
v></div>
</blockquote></div>

<br>
<b style=3D"color:rgb(128,128,128);font-size:x-small"><br>CONFIDENTIALITY N=
OTICE</b><span style=3D"color:rgb(128,128,128);font-size:x-small">: The con=
tents of this email message, and any attachments, are intended solely for t=
he addressee(s) and may contain confidential, proprietary and/or privileged=
 information legally protected from disclosure. If you are not the intended=
 recipient of this communication, or if you received this communication by =
mistake, please notify the sender immediately and delete this message and a=
ny attachments. If you are not the intended recipient, you are hereby notif=
ied that any use, retransmission, dissemination, copying or storage of this=
 message or its attachments is strictly prohibited.</span><br></blockquote>=
</div>
</blockquote></div>

<br>
<b style=3D"color:rgb(128,128,128);font-size:x-small"><br>CONFIDENTIALITY N=
OTICE</b><span style=3D"color:rgb(128,128,128);font-size:x-small">: The con=
tents of this email message, and any attachments, are intended solely for t=
he addressee(s) and may contain confidential, proprietary and/or privileged=
 information legally protected from disclosure. If you are not the intended=
 recipient of this communication, or if you received this communication by =
mistake, please notify the sender immediately and delete this message and a=
ny attachments. If you are not the intended recipient, you are hereby notif=
ied that any use, retransmission, dissemination, copying or storage of this=
 message or its attachments is strictly prohibited.</span><br>
--000000000000e2bbe2060bd504e4--