Sign commits & releases (tags)

grahamedgecombe / nginx-ct

Certificate Transparency module for nginx.

https://grahamedgecombe.com/projects/nginx-ct

ISC License

175 stars 27 forks source link

Sign commits & releases (tags) #14

Closed rugk closed 7 years ago

rugk commented 8 years ago

You should consider signing git commits & releases.

onionshare#221 (comment)
It is also displayed on GitHub: https://github.com/blog/2144-gpg-signature-verification
Here is GitHub's help for this: https://help.github.com/articles/generating-a-gpg-key/
And here is how you can sign releases: https://wiki.debian.org/Creating%20signed%20GitHub%20releases

grahamedgecombe commented 7 years ago

The v1.3.2 tag, .tar.gz file and .zip file are signed with my personal GPG key (fingerprint D2B4 98F5 C237 5320 1BC7 A020 808A 6AE4 B9B4 4894, available at https://www.grahamedgecombe.com/gpe.asc, https://keybase.io/grahamedgecombe or via pgp.mit.edu). Future releases/tags will also be signed with this key.