[jetty-dev] Announcements of releases / signatures / location

["Cantor, Scott" <cantor.2@xxxxxxx>]

I have a downstream project that packages Jetty and had some questions related to the fact that it appears the last two 9.3.x releases (13 and 14) have not been announced anywhere officially, the download site has apparently been supplanted by Maven Central, and the absence of any explicit list of PGP signing keys known to be authoritative for the artifacts.

Could somebody from the project speak to this? At minimum, a published KEYS file would really go a long way to providing some confidence. If one exists, my apologies for being unaware of it.

The lack of announcements of the latest patches is particularly strange, certainly.

Consider this just a constructive request to formalize things a bit, as it's a big deal for downstream projects that have security requirements because of their nature.

-- Scott