{"action":"opened","issue":{"url":"https://api.github.com/repos/elixir-lang/elixir/issues/4323","repository_url":"https://api.github.com/repos/elixir-lang/elixir","labels_url":"https://api.github.com/repos/elixir-lang/elixir/issues/4323/labels{/name}","comments_url":"https://api.github.com/repos/elixir-lang/elixir/issues/4323/comments","events_url":"https://api.github.com/repos/elixir-lang/elixir/issues/4323/events","html_url":"https://github.com/elixir-lang/elixir/issues/4323","id":135736923,"number":4323,"title":"Sign Elixir release SHAs with known keys?","user":{"login":"garyposter","id":44391,"avatar_url":"https://avatars.githubusercontent.com/u/44391?v=3","gravatar_id":"","url":"https://api.github.com/users/garyposter","html_url":"https://github.com/garyposter","followers_url":"https://api.github.com/users/garyposter/followers","following_url":"https://api.github.com/users/garyposter/following{/other_user}","gists_url":"https://api.github.com/users/garyposter/gists{/gist_id}","starred_url":"https://api.github.com/users/garyposter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garyposter/subscriptions","organizations_url":"https://api.github.com/users/garyposter/orgs","repos_url":"https://api.github.com/users/garyposter/repos","events_url":"https://api.github.com/users/garyposter/events{/privacy}","received_events_url":"https://api.github.com/users/garyposter/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-23T13:27:22Z","updated_at":"2016-02-23T13:27:22Z","closed_at":null,"body":"Hi! Would you maintainers be open to signing the release SHAs with known GPG keys, a la node?  See their release process for examples, specifically [\"Who can make a release? : 3. A Publicly Listed GPG Key\"](https://github.com/nodejs/node/blob/master/doc/releases.md#3-a-publicly-listed-gpg-key) and [\"How  to create a release : 12. Promote and Sign the Release Builds\"](https://github.com/nodejs/node/blob/master/doc/releases.md#12-promote-and-sign-the-release-builds).\r\n\r\nThese are useful for packaging automation, such as [Node's official Dockerfile](https://github.com/nodejs/docker-node/blob/master/5.6/Dockerfile). People who want to do this kind of check in Elixir are doing things like [specifying the SHA in the Dockerfile](https://github.com/voidlock/docker-elixir/blob/master/1.1/Dockerfile), which requires more frequent updates to build automation scripts.\r\n\r\nThanks for considering!"}}