9 ms·

Signatures by what participants, and at what stage(s) of the software development lifecycle?

• Juliate 4y ago
  By the person acting the release of a new version on the public repository (like any maintainer would do).
  • jka 4y ago
    Thanks - agreed, release manager signatures are nice to have. The reason I ask is that I think it'd be nice if third parties could also voluntarily sign releases. For example: the author of a library -- or one of their users -- could fund a security audit of a specific version, and then the auditors could sign to attest their findings (issue and severity count, perhaps) in a way that's visible to package users via the command-line and web. It'd add useful information for people trying to select appropriately-secure code, and also help foster a marketplace for open source security code review.