{"action":"created","issue":{"url":"https://api.github.com/repos/zevv/duc/issues/155","repository_url":"https://api.github.com/repos/zevv/duc","labels_url":"https://api.github.com/repos/zevv/duc/issues/155/labels{/name}","comments_url":"https://api.github.com/repos/zevv/duc/issues/155/comments","events_url":"https://api.github.com/repos/zevv/duc/issues/155/events","html_url":"https://github.com/zevv/duc/issues/155","id":191063223,"number":155,"title":"GPG signatures for source validation","user":{"login":"NicoHood","id":6888294,"avatar_url":"https://avatars.githubusercontent.com/u/6888294?v=3","gravatar_id":"","url":"https://api.github.com/users/NicoHood","html_url":"https://github.com/NicoHood","followers_url":"https://api.github.com/users/NicoHood/followers","following_url":"https://api.github.com/users/NicoHood/following{/other_user}","gists_url":"https://api.github.com/users/NicoHood/gists{/gist_id}","starred_url":"https://api.github.com/users/NicoHood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NicoHood/subscriptions","organizations_url":"https://api.github.com/users/NicoHood/orgs","repos_url":"https://api.github.com/users/NicoHood/repos","events_url":"https://api.github.com/users/NicoHood/events{/privacy}","received_events_url":"https://api.github.com/users/NicoHood/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-11-22T16:55:10Z","updated_at":"2016-12-25T14:59:18Z","closed_at":"2016-12-22T18:34:18Z","body":"As we all know, today more than ever before, it is crucial to be able to trust our computing environments. One of the main difficulties that package maintainers of Linux distributions face, is the difficulty to verify the authenticity and the integrity of the source code.\r\n\r\nThe Arch Linux team would appreciate it if you would provide us GPG signatures in order to verify easily and quickly of your source code releases.\r\n\r\n**Overview of the required tasks:**\r\n* [x] Please [create and/or use a 4096-bit RSA keypair](https://wiki.archlinux.org/index.php/GnuPG#Create_key_pair) for the file signing\r\n* The key may be used for [email encryption](https://www.enigmail.net/index.php/en/) too\r\n* Keep your key secret, use a strong unique passphrase for the key\r\n* [x] Upload the public key to a key server\r\n* [x] [Sign every new commit by default](https://help.github.com/articles/signing-commits-using-gpg/)\r\n* [ ] [Sign new tags](https://help.github.com/articles/signing-tags-using-gpg/)\r\n* Verify the Github Release tarball download against your local source\r\n* [x] [Sign Github Release tarballs](https://wiki.debian.org/Creating%20signed%20GitHub%20releases)\r\n\r\n**Additional Information:**\r\n* https://help.github.com/categories/gpg/\r\n* https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work\r\n* https://www.qubes-os.org/doc/verifying-signatures/\r\n* https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https\r\n\r\nThanks."},"comment":{"url":"https://api.github.com/repos/zevv/duc/issues/comments/269125977","html_url":"https://github.com/zevv/duc/issues/155#issuecomment-269125977","issue_url":"https://api.github.com/repos/zevv/duc/issues/155","id":269125977,"user":{"login":"NicoHood","id":6888294,"avatar_url":"https://avatars.githubusercontent.com/u/6888294?v=3","gravatar_id":"","url":"https://api.github.com/users/NicoHood","html_url":"https://github.com/NicoHood","followers_url":"https://api.github.com/users/NicoHood/followers","following_url":"https://api.github.com/users/NicoHood/following{/other_user}","gists_url":"https://api.github.com/users/NicoHood/gists{/gist_id}","starred_url":"https://api.github.com/users/NicoHood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NicoHood/subscriptions","organizations_url":"https://api.github.com/users/NicoHood/orgs","repos_url":"https://api.github.com/users/NicoHood/repos","events_url":"https://api.github.com/users/NicoHood/events{/privacy}","received_events_url":"https://api.github.com/users/NicoHood/received_events","type":"User","site_admin":false},"created_at":"2016-12-25T14:59:18Z","updated_at":"2016-12-25T14:59:18Z","body":"Thanks a lot <3\r\n\r\nYou still need to add the public gpg key to your github account so it can show \"verified\" on github. It would also be a good idea to sign the tag itself too. For ArchLinux packaging this is enough though :)"}}
{"actor":{"display_login":"NicoHood"}}