{"action":"created","issue":{"url":"https://api.github.com/repos/apache/incubator-beam/issues/732","repository_url":"https://api.github.com/repos/apache/incubator-beam","labels_url":"https://api.github.com/repos/apache/incubator-beam/issues/732/labels{/name}","comments_url":"https://api.github.com/repos/apache/incubator-beam/issues/732/comments","events_url":"https://api.github.com/repos/apache/incubator-beam/issues/732/events","html_url":"https://github.com/apache/incubator-beam/pull/732","id":167530138,"number":732,"title":"[BEAM-488] Remove KEYS file","user":{"login":"dhalperi","id":526415,"avatar_url":"https://avatars.githubusercontent.com/u/526415?v=3","gravatar_id":"","url":"https://api.github.com/users/dhalperi","html_url":"https://github.com/dhalperi","followers_url":"https://api.github.com/users/dhalperi/followers","following_url":"https://api.github.com/users/dhalperi/following{/other_user}","gists_url":"https://api.github.com/users/dhalperi/gists{/gist_id}","starred_url":"https://api.github.com/users/dhalperi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dhalperi/subscriptions","organizations_url":"https://api.github.com/users/dhalperi/orgs","repos_url":"https://api.github.com/users/dhalperi/repos","events_url":"https://api.github.com/users/dhalperi/events{/privacy}","received_events_url":"https://api.github.com/users/dhalperi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-07-26T06:25:11Z","updated_at":"2016-07-27T19:03:02Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/apache/incubator-beam/pulls/732","html_url":"https://github.com/apache/incubator-beam/pull/732","diff_url":"https://github.com/apache/incubator-beam/pull/732.diff","patch_url":"https://github.com/apache/incubator-beam/pull/732.patch"},"body":"Per discussion, linked in JIRA:\r\n\r\n> Bundling PGP keys inside a package is worse than worthless – an\r\n> attacker can just bundle spoofed keys with a bogus distro! Keys need\r\n> to be made available from a highly reliable, separate server: Download\r\n> the main package from a mirror, get PGP keys from apache.org,\r\n> pgp.mit.edu, etc. and verify.\r\n>\r\n> The KEYS file within the Beam source tree should be deleted."},"comment":{"url":"https://api.github.com/repos/apache/incubator-beam/issues/comments/235686556","html_url":"https://github.com/apache/incubator-beam/pull/732#issuecomment-235686556","issue_url":"https://api.github.com/repos/apache/incubator-beam/issues/732","id":235686556,"user":{"login":"jbonofre","id":158903,"avatar_url":"https://avatars.githubusercontent.com/u/158903?v=3","gravatar_id":"","url":"https://api.github.com/users/jbonofre","html_url":"https://github.com/jbonofre","followers_url":"https://api.github.com/users/jbonofre/followers","following_url":"https://api.github.com/users/jbonofre/following{/other_user}","gists_url":"https://api.github.com/users/jbonofre/gists{/gist_id}","starred_url":"https://api.github.com/users/jbonofre/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbonofre/subscriptions","organizations_url":"https://api.github.com/users/jbonofre/orgs","repos_url":"https://api.github.com/users/jbonofre/repos","events_url":"https://api.github.com/users/jbonofre/events{/privacy}","received_events_url":"https://api.github.com/users/jbonofre/received_events","type":"User","site_admin":false},"created_at":"2016-07-27T19:03:02Z","updated_at":"2016-07-27T19:03:02Z","body":"So, what I'm proposing:\r\n\r\n1. I can move the KEYS on dist.apache.org\r\n2. Then we can remove the KEYS from git\r\n\r\nWDYT ?"}}
{"actor":{"display_login":"jbonofre"}}