3 ms·
That seems fundamentally backwards. The CI system should do the tagging. Allowing manual tagging introduces intentional or unintentional malfeasance in shared p
by WoahNoun 7y ago
That seems fundamentally backwards. The CI system should do the tagging. Allowing manual tagging introduces intentional or unintentional malfeasance in shared projects.
- javagram 7y agoManual tagging is the best way for most projects to do stuff like sign the package using an offline hardware key. Putting your keys on CI makes you vulnerable to your CI being hacked, which anecdotally seems to have happened to several projects.