Re:Creating signed GitHub releases
by lmm on Thursday April 14, 2016 @09:28AM
(#11496458)
> GitHub changing the binary being downloaded? They could serve a different signature.
> Another committer changing the tag? They could equally change the signature....
No they couldn't, not unless they have your private key.
(Debian does actually require all keys used to sign debian packages to have a trust path back to them - if you want to become Debian maintainer for a project you have to meet up with a Debian developer and have them sign your GPG key - so GitHub or another committer couldn't just use a different key to sign with).
No they couldn't, not unless they have your private key.
(Debian does actually require all keys used to sign debian packages to have a trust path back to them - if you want to become Debian maintainer for a project you have to meet up with a Debian developer and have them sign your GPG key - so GitHub or another committer couldn't just use a different key to sign with).