5 ms·
I'm much more comfortable to sign my local repository copy than signing an archive generated by github Both can be part of the process. However, signing the t
by dsp1234 11y ago
I'm much more comfortable to sign my local repository copy than signing an archive generated by github
Both can be part of the process.
However, signing the tag doesn't really help someone who isn't cloning the repository. For those people that are just downloading the source tarball directly, having a GPG signature for the release can ensure that github(or other attacker) hasn't modified the contents of the tarball.
- ownagefool 11y agoSort of. I mean if github wants to modify the contents of the tarball, they'll also modify the signature. So unless you're also confirming that it's the right signature, and not just that it's signed, what exactly are you doing?
- ashitlerferad 11y agoThat is where signing other people's OpenPGP keys comes in, and the web of trust for those who haven't met their upstreams. github can also modify signed tags.