René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"GPG signatures for source validation","articleBody":"As we all know, today more than ever before, it is crucial to be able to trust\r\nour computing environments. One of the main difficulties that package\r\nmaintainers of Linux distributions face, is the difficulty to verify the\r\nauthenticity and the integrity of the source code.\r\n\r\nThe Arch Linux team would appreciate it if you would provide us GPG signatures\r\nin order to verify easily and quickly your source code releases.\r\n\r\n**Overview of the required tasks:**\r\n* Create and/or use a 4096-bit RSA keypair for the file signing.\r\n* Keep your key secret, use a strong unique passphrase for the key.\r\n* Upload the public key to a key server and publish the full fingerprint.\r\n* Sign every new git commit and tag.\r\n* Create signed compressed (xz --best) release archives\r\n* Upload a strong message digest (sha512) of the archive\r\n* Configure https for your download server\r\n\r\n[GPGit](https://github.com/NicoHood/gpgit) is meant to bring GPG to the masses.\r\nIt is not only a shell script that automates the process of creating new signed\r\ngit releases with GPG but also comes with this step-by-step readme guide for\r\nlearning how to use GPG.\r\n\r\n**Additional Information:**\r\n* https://github.com/NicoHood/gpgit\r\n* https://help.github.com/categories/gpg/\r\n* https://wiki.archlinux.org/index.php/GnuPG\r\n* https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work\r\n* https://www.qubes-os.org/doc/verifying-signatures/\r\n* https://lkml.org/lkml/2016/8/15/445\r\n* https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https\r\n* https://www.enigmail.net/index.php/en/\r\n\r\nThanks in advance.\r\n\r\nPS: I plan to use this module in gpgit soon. However this and #611 is a blocking issue for this to happen. Would be really nice to see gpg signatures as well as this project part of gpgit.","author":{"url":"https://github.com/NicoHood","@type":"Person","name":"NicoHood"},"datePublished":"2017-03-16T20:12:18.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":17},"url":"https://github.com/612/GitPython/issues/612"}