Closed rieschl closed 4 years ago
Tag signing is recommended but not required by GitHub. Since this tool is mainly for people producing publicly available packages for others to use, I've opted to require signing, as it allows consumers to verify the source (author) of the tag.
If you would like to have a way to NOT sign the tag, but only create an annotated tag, open a separate issue. In the meantime, I'm addressing the error messages and documentation for the case where the git operation(s) fail.
If you would like to have a way to NOT sign the tag, but only create an annotated tag, open a separate issue.
You're right, signing tags is better of course. I myself don't need unsigned tags. Thank you!
Feature Request
Summary
It wasn't immediately clear for me why the
version:tag
command failed because I didn't know the error from git. It would be helpful to point out that the error is from the git command itself and not from keep-a-changelog. I'd suggest something like "The commandgit tag -s ...
failed".The problem was the signing part. I'm familiar with GPG but didn't realize that keep-a-changelog forces signing tags. For some reason I had to execute
export GPG_TTY=$(tty)
for KAC to work. Maybe that should be mentioned in the config. Also, perhaps it's easier for some setups to be able to disable tag signing altogether? Or is that required by GitHub?