[TOMEE-2975] Download page must provide sigs for all release artifacts

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 8.0.7, 8.0.8
• Environment: http://tomee.apache.org/download-ng.html
• Assignee: Richard Zowalla
• Reporter: Sebb
• Created: 06/Mar/21 00:11
• Updated: 12/May/21 14:32
• Resolved: 25/Mar/21 14:59

Description

None of the releases on the download page have signature files (.asc).

These are required:

https://infra.apache.org/release-distribution#sigs-and-sums

The asc files are present on the download site, they just need to be linked from the page.

Also there must be a link to the KEYS file, as well as download verification instructions.