Re: [GMG-Devel] please use signed git tags

[Christopher Allan Webber]

You might be happy to hear that I just tagged v0.3.3 and signed it
(well, I think... it's my first time doing this with git... forgive me
and let me know if I did something wrong!).  I should be signing under
the following key from now on:

  pub   4096R/5FF8F4D3 2013-03-01
        Key fingerprint = 510A 8628 E2A7 7678 8F8C  709C 4BC0 2592 5FF8 F4D3
  uid                  Christopher Allan Webber <address@hidden>
  sub   4096R/633E913B 2013-03-01

Also, yes, the code is tagged, but the "release" is not till tomorrow
morning.  So cya then! :)

 - Chris

Thomas Koch writes:

> Hi,
>
> as long as mediagoblin is not packaged in Debian and I need to install it 
> from 
> Git you could really improve the situation by using signed git tags, via
>
> git tag -s
>
> Thus I could be sure, that I cloned the correct code and not a modified 
> version. If you wonder whether signing code and artefacts is necessary, 
> please 
> have look here:
>
> http://www.koch.ro/blog/index.php?/archives/153-On-distributing-binaries.html
>
> It might also be good to use signed commits (since Git 1.7.?), but I don't 
> have experience with those myself.
>
> Regards,
>
> Thomas Koch, http://www.koch.ro
> _______________________________________________
> devel mailing list
> address@hidden
> http://lists.mediagoblin.org/listinfo/devel