Release artifacts

[maximbaz]

Hello 👋

Thanks for the new release! I'd like to suggest a few things related to release artifacts.

1. Could you please upload your PGP key to https://keys.openpgp.org/ and perhaps also https://keyserver.ubuntu.com/ ? The SKS pool is no longer in use, and your key can now only be manually imported from Github, but it hinders a bit distro packaging. The former link requires email validation if you want your UID info to be uploaded, and not just the key (it's optional).

2. The .xz artifact that you uploaded for 2.4.1 release actually contains 2.3.1 in meson.build - minor, but users would get a wrong playerctl --version info...

3. You upload PGP signature for .xz archive, and it's highly appreciated, but did you know that you can generate signature for the archive that Github creates automatically for each release? That way you can avoid creating .xz archive completely, and so not have situations where it doesn't match the real tag 🙂

You can create bit-by-bit identical tar.gz archive that Github generates using the command below, sign it, and then upload to the release only the signature. The .zip archive cannot be reproduced in the same way, so ignore it.

$ git archive --prefix="playerctl-2.4.1/" -o "playerctl-2.4.1.tar.gz" "v2.4.1"

Notice that v should only be in the last argument, or you'll not get bit-by-bit identical archive 🙂

If you can, maybe you can upload such signature to 2.4.1 release and I'll test it right away?

[acrisci]

Ok, release is updated. Let me know if that works or you need anything else.

[acrisci]

PGP key uploaded here: https://keys.openpgp.org/vks/v1/by-fingerprint/8CDFCC2D6611ACDE63D2C348564F0717F9D84E49

[maximbaz]

It's perfect, thank you!