From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 7155 invoked by alias); 6 Feb 2014 09:39:26 -0000 Mailing-List: contact gdb-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-owner@sourceware.org Received: (qmail 7143 invoked by uid 89); 6 Feb 2014 09:39:25 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-1.4 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.3.2 X-HELO: rock.gnat.com Received: from rock.gnat.com (HELO rock.gnat.com) (205.232.38.15) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (AES256-SHA encrypted) ESMTPS; Thu, 06 Feb 2014 09:39:24 +0000 Received: from localhost (localhost.localdomain [127.0.0.1]) by filtered-rock.gnat.com (Postfix) with ESMTP id 9D5A011630E; Thu, 6 Feb 2014 04:39:22 -0500 (EST) Received: from rock.gnat.com ([127.0.0.1]) by localhost (rock.gnat.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id Wkps+0m8poqS; Thu, 6 Feb 2014 04:39:22 -0500 (EST) Received: from joel.gnat.com (localhost.localdomain [127.0.0.1]) by rock.gnat.com (Postfix) with ESMTP id 376B3116301; Thu, 6 Feb 2014 04:39:22 -0500 (EST) Received: by joel.gnat.com (Postfix, from userid 1000) id 08498E0BA8; Thu, 6 Feb 2014 13:39:20 +0400 (RET) Date: Thu, 06 Feb 2014 09:39:00 -0000 From: Joel Brobecker To: Andreas Schwab Cc: gdb@sourceware.org Subject: Re: Signed release tags Message-ID: <20140206093919.GO5401@adacore.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-SW-Source: 2014-02/txt/msg00016.txt.bz2 > IMHO it would be nice to have the release tag in git be GPG-signed. > WDYT? I suppose I could do it if has any benefit. I've never really worked in an area where I felt that signing was really worth the trouble, so I'm a little ignorant in that area. I sign the release tarballs just because I have to. I've now added my key to some keyring for people to be able to verify it. I guess signing the tag will only make sure that I was the author of the tag? Anyways, no objection from me. I'll just follow whatever people think is best. -- Joel