Re:Creating signed GitHub releases
by ownagefool on Thursday April 14, 2016 @08:34AM
(#11496087)
Sort of.
I mean if github wants to modify the contents of the tarball, they'll also modify the signature. So unless you're also confirming that it's the right signature, and not just that it's signed, what exactly are you doing?
Re:Creating signed GitHub releases
by ashitlerferad on Thursday April 14, 2016 @09:51AM
(#11496629)
That is where signing other people's OpenPGP keys comes in, and the web of trust for those who haven't met their upstreams.
github can also modify signed tags.
Both can be part of the process.
However, signing the tag doesn't really help someone who isn't cloning the repository. For those people that are just downloading the source tarball directly, having a GPG signature for the release can ensure that github(or other attacker) hasn't modified the contents of the tarball.