[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [bug-gsrc] Checking signatures on source tarballs

From: Ludovic Courtès
Subject: Re: [bug-gsrc] Checking signatures on source tarballs
Date: Mon, 12 Oct 2015 18:38:11 +0200
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)

Brandon Invergo <address@hidden> skribis:

> On Mon, 2015-10-12 at 09:37 +0100, Brandon Invergo wrote:
>> I could swear that previously a keyring of the GNU maintainers was
>> made available by the FSF somewhere but I cannot find it.

The main issue is that this file is not signed (that would have to be
done by the person responsible for FTP uploads, presumably an FSF

A second issue, as Mark wrote, is that it is coarse-grain: it does not
tell exactly which package a given key corresponds to.

However, this package → keys mapping necessarily exists somewhere.  I
think we should ask the FSF to publish it and provide a way to
authenticate it.



reply via email to

[Prev in Thread] Current Thread [Next in Thread]