René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"4.0.8 sdist tarball signature on pypi is bad","articleBody":"Hi! When trying to package 4.0.8 for Arch Linux I ran into a bad signature for the sdist tarball on pypi.org:\r\n\r\n```\r\ngpg --verify gitdb-4.0.8.tar.gz.asc\r\ngpg: assuming signed data in 'gitdb-4.0.8.tar.gz'\r\ngpg: Signature made 2021-10-23T02:39:33 CEST\r\ngpg:                using RSA key EAF9CCFCD0876408F297C60A9CB5EE7895E8268B\r\ngpg: BAD signature from \"Sebastian Thiel (YubiKey USB-C) \u003cbyronimo@gmail.com\u003e\" [unknown]\r\n```\r\n\r\nTo reproduce:\r\n\r\n```\r\ncurl -L -O https://files.pythonhosted.org/packages/source/g/gitdb/gitdb-4.0.8.tar.gz -O https://files.pythonhosted.org/packages/source/g/gitdb/gitdb-4.0.8.tar.gz.asc \u0026\u0026 gpg --verify gitdb-4.0.8.tar.gz.asc\r\n```","author":{"url":"https://github.com/dvzrv","@type":"Person","name":"dvzrv"},"datePublished":"2021-10-23T19:55:14.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":17},"url":"https://github.com/77/gitdb/issues/77"}