{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/owncloud.org/issues/1076","repository_url":"https://api.github.com/repos/owncloud/owncloud.org","labels_url":"https://api.github.com/repos/owncloud/owncloud.org/issues/1076/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/owncloud.org/issues/1076/comments","events_url":"https://api.github.com/repos/owncloud/owncloud.org/issues/1076/events","html_url":"https://github.com/owncloud/owncloud.org/issues/1076","id":182551973,"number":1076,"title":"Provide trustful way to install the client on Debian 8","user":{"login":"Giszmo","id":96378,"avatar_url":"https://avatars.githubusercontent.com/u/96378?v=3","gravatar_id":"","url":"https://api.github.com/users/Giszmo","html_url":"https://github.com/Giszmo","followers_url":"https://api.github.com/users/Giszmo/followers","following_url":"https://api.github.com/users/Giszmo/following{/other_user}","gists_url":"https://api.github.com/users/Giszmo/gists{/gist_id}","starred_url":"https://api.github.com/users/Giszmo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Giszmo/subscriptions","organizations_url":"https://api.github.com/users/Giszmo/orgs","repos_url":"https://api.github.com/users/Giszmo/repos","events_url":"https://api.github.com/users/Giszmo/events{/privacy}","received_events_url":"https://api.github.com/users/Giszmo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-10-12T15:10:27Z","updated_at":"2016-10-12T19:29:16Z","closed_at":null,"body":"Currently, the [https download link](https://owncloud.org/install/#install-clients) sends me to [https opensuse](https://software.opensuse.org/download/package?project=isv:ownCloud:desktop&package=owncloud-client) which then elaborates to download both the deb and the `Release.key` from http with no attribution to who's key it is. The key file last being updated yesterday further hurts my trust.\r\n\r\nIdeally this should work out of the box from the debian repository but with https and a key signed by people I can verify it would at least be possible to make sure it's not being messed with on a per downloader basis.\r\n\r\n#1075 and #845 might be related."},"comment":{"url":"https://api.github.com/repos/owncloud/owncloud.org/issues/comments/253313770","html_url":"https://github.com/owncloud/owncloud.org/issues/1076#issuecomment-253313770","issue_url":"https://api.github.com/repos/owncloud/owncloud.org/issues/1076","id":253313770,"user":{"login":"crrodriguez","id":44466,"avatar_url":"https://avatars.githubusercontent.com/u/44466?v=3","gravatar_id":"","url":"https://api.github.com/users/crrodriguez","html_url":"https://github.com/crrodriguez","followers_url":"https://api.github.com/users/crrodriguez/followers","following_url":"https://api.github.com/users/crrodriguez/following{/other_user}","gists_url":"https://api.github.com/users/crrodriguez/gists{/gist_id}","starred_url":"https://api.github.com/users/crrodriguez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crrodriguez/subscriptions","organizations_url":"https://api.github.com/users/crrodriguez/orgs","repos_url":"https://api.github.com/users/crrodriguez/repos","events_url":"https://api.github.com/users/crrodriguez/events{/privacy}","received_events_url":"https://api.github.com/users/crrodriguez/received_events","type":"User","site_admin":false},"created_at":"2016-10-12T19:29:16Z","updated_at":"2016-10-12T19:29:16Z","body":"@Giszmo The release.key file is generated by the openSUSE buildservice, in an automated fashion, there is no person or organization to which this key belongs to (it belongs to the isv:owncloud subproject only) Under the hood, there is network a isolated/restricted host who creates it and signs packages with this key."}}
{"actor":{"display_login":"crrodriguez"}}