2013/9/4 Adrian Knoth <a...@drcomp.erfurt.thur.de> > On 08/24/2013 10:48 AM, mira-gu...@users.alioth.debian.org wrote: > > Hi! > > > > commit 9a0cdc0c43b2174759f6e342d811ad801a70d24a > > Author: Jaromír Mikeš <mira.mi...@seznam.cz> > > Date: Sat Aug 24 10:50:18 2013 +0200 > > > > Don't sign tags. > > > > diff --git a/debian/gbp.conf b/debian/gbp.conf > > index 2c53314..8dd9bb3 100644 > > --- a/debian/gbp.conf > > +++ b/debian/gbp.conf > > @@ -1,8 +1,5 @@ > > -# Configuration file for git-buildpackage and friends > > - > > [DEFAULT] > > pristine-tar = True > > -sign-tags = True > > Why? I thought signing the import and release tags helps us establishing > a trust chain from the source to the final package. > > If I sign the import, I'm saying "It was really me, it's not fake, and I > think it's the correct source code. Blame me if it isn't." > > Same for the release tag: "I've reviewed the changes and feel > comfortable with all of them. I'm the maintainer, I've double-checked > everything." > > > > Just wondering..
It has been discussed here http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/2013-June/032853.html regards mira
_______________________________________________ pkg-multimedia-maintainers mailing list pkg-multimedia-maintainers@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-multimedia-maintainers
