Repository navigation
Release 2.0 does not have signed assets #228
Description
Hi,
I'm the packager for terminator on Arch Linux. The release 1.92 has on the assets a signed tar.gz with detached signature. The 2.0 release, while having the tag signed, doesn't have any signed assets. If the release model changed to only have signed annotated tags and no signed assets, let me know, so I can change the package to use signed git tags instead.
If not, please add assets to the 2.0 release. Thanks in advance.
Activity
mattrose commentedon Oct 7, 2020
Sorry, first time releasing. I'll upload the detached sig.
mattrose commentedon Oct 7, 2020
@grazzolini I have the detached tarball signature. Do you know how to generate the signed assets file?
grazzolini commentedon Oct 7, 2020
@mattrose I just need the detached tarball signature. That other file that's present on the 1.92 release, seems to be just the gpg public key that was used to sign the tarball. I don't think you need to include that.
grazzolini commentedon Oct 7, 2020
Hmm, looks like the key used to sign this release differs from the previous one (1.92). I'm going to check if there's a chain of trust that can get me from the old key: 6FBDB41587919A0F4BA96EBA9A358BAB04A4ED27 to D11A7596F61705480C711598F2FAC7C7BAE930A5. Would be nice if you guys could cross sign these keys and upload the signatures to a keysever.
mattrose commentedon Oct 7, 2020
@grazzolini Yeah, the key that signed this release is mine, and the key that signed 1.92 is @lazyfrosch's key. Both keys are the ones in github, so there should be a link through there, but yeah, it's not ideal. We're planning on cross-signing these keys, but Markus is very busy these days, and I didn't want to delay the release any longer for it.
lazyfrosch commentedon Oct 8, 2020
We will certainly cross-sign, for the moment the reference on GitHub should be prove enough.
grazzolini commentedon Oct 8, 2020
Sure, no problem. I saw as well that matt was already pushing stuff even before 1.92. I'm going to create the package on Arch, and I'll add both your keys to the validpgpkeys array.
grazzolini commentedon Oct 8, 2020
@mattrose one last thing, I wasn't able to find your public key on any keyserver. Can you export it and add to the assets, the same way it was done for the 1.92 release?
mattrose commentedon Oct 8, 2020
Just add my pubkey to the assets? Sure. I'll make sure my key is on all the keyservers as well. @lazyfrosch how did you generate the gpg-.asc file for the last release https://github.com/gnome-terminator/terminator/releases/download/v1.92/gpg-6FBDB41587919A0F4BA96EBA9A358BAB04A4ED27.asc and what is it exactly?
grazzolini commentedon Oct 8, 2020
@mattrose
gpg --output gpg-D11A7596F61705480C711598F2FAC7C7BAE930A5.asc --armor --export mattrose@folkwolf.netshould do.mattrose commentedon Oct 8, 2020
@grazzolini Awesome, thank you. The situation with keyservers seems to have gone really downhill over the past couple of years. The only one a fairly in-depth search brings up that's in wide use is https://keys.openpgp.org/. Do you know of any other reliable places I can upload my key to?
grazzolini commentedon Oct 8, 2020
I think one of the last somewhat reliable (as in up most of the time) is keyserver.ubuntu.com. That's the one I've been using as well. But yes, the situation with keyservers suck. I wish github added a way where you could get a users GPG key from their profile. Or you cloud click on a button on the verified commit badge and get it from there as well.
py-terminator: Upgrade to 2.1.0
py-terminator: Upgrade to 2.1.0
py-terminator: Upgrade to 2.1.0
py-terminator: Upgrade to 2.1.0