search

Caiyeon / goldfish

A HashiCorp Vault UI written with VueJS and Vault native Go API
https://vault-ui.io
Mozilla Public License 2.0
2.15k stars 166 forks source link

Feature request: Signed releases #244

Open avanier opened 6 years ago

avanier commented 6 years ago

Would it be possible to have signed binary releases? Right now, if I want to get binaries that I know represent the code available at a given version, I have to pull from GitHub and compile the code myself.

GPG FTW.

Typositoire commented 6 years ago

That'd be nice indeed. You don't want fake packages to go leak all your secrets xD

Caiyeon commented 6 years ago

Yes, I have thought about signed releases and will likely do this in the future. Although, I'm not sure how far in the future. It probably won't be in the next release.

A signed package does not guarantee the source code from which it is compiled.

But the concern is valid. I, too, am paranoid, and would expect signed releases in the future.