Let's have that discussion about signing artifacts on a different thread, including pros and cons. For instance: Is this important to our users? What does it help or protect against? Thanks!
On Fri, Mar 30, 2018, 11:54 PM Sean Busbey <bus...@apache.org> wrote: > On Sat, Mar 31, 2018 at 1:05 AM, Andrew Purtell > <andrew.purt...@gmail.com> wrote: > > It is not my practice to sign commits or tags. Is this mandatory? It > could be. Was there an announcement or discussion? I didn’t see it. > > > > > Not required by any policy I know of. Enis did it during the 0.99 > release line and it's largely continued in 1.0, 1.1, 1.2, 1.3, and > upcoming 2.0 AFAIK. > > easiest to see how well it's been kept up if you look through the tags > in the github interface: > > https://github.com/apache/hbase/tags > > I couldn't find any discussion; seems mostly just like folks copying > the habit from the prior time. >
