4 ms·
Sort of. I mean if github wants to modify the contents of the tarball, they'll also modify the signature. So unless you're also confirming that it's the right
by ownagefool 11y ago
Sort of.
I mean if github wants to modify the contents of the tarball, they'll also modify the signature. So unless you're also confirming that it's the right signature, and not just that it's signed, what exactly are you doing?
- ashitlerferad 11y agoThat is where signing other people's OpenPGP keys comes in, and the web of trust for those who haven't met their upstreams. github can also modify signed tags.