{"action":"created","issue":{"url":"https://api.github.com/repos/KSP-CKAN/CKAN/issues/1354","repository_url":"https://api.github.com/repos/KSP-CKAN/CKAN","labels_url":"https://api.github.com/repos/KSP-CKAN/CKAN/issues/1354/labels{/name}","comments_url":"https://api.github.com/repos/KSP-CKAN/CKAN/issues/1354/comments","events_url":"https://api.github.com/repos/KSP-CKAN/CKAN/issues/1354/events","html_url":"https://github.com/KSP-CKAN/CKAN/issues/1354","id":99848955,"number":1354,"title":"Releases should be signed","user":{"login":"pjf","id":12072,"avatar_url":"https://avatars.githubusercontent.com/u/12072?v=3","gravatar_id":"","url":"https://api.github.com/users/pjf","html_url":"https://github.com/pjf","followers_url":"https://api.github.com/users/pjf/followers","following_url":"https://api.github.com/users/pjf/following{/other_user}","gists_url":"https://api.github.com/users/pjf/gists{/gist_id}","starred_url":"https://api.github.com/users/pjf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pjf/subscriptions","organizations_url":"https://api.github.com/users/pjf/orgs","repos_url":"https://api.github.com/users/pjf/repos","events_url":"https://api.github.com/users/pjf/events{/privacy}","received_events_url":"https://api.github.com/users/pjf/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/KSP-CKAN/CKAN/labels/enhancement","name":"enhancement","color":"eb6420"},{"url":"https://api.github.com/repos/KSP-CKAN/CKAN/labels/%E2%98%85%E2%98%85%E2%98%86","name":"★★☆","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-09T00:56:52Z","updated_at":"2016-02-18T13:31:54Z","closed_at":null,"body":"Right now, releases aren't signed, and users get a \"yo, this is a file you downloaded from the internet\" message on Windows.\n\nMono comes with the `signcode` utility which can do this, and while we'll need to create (and possibly pay a CA to sign) a certificate, that shouldn't be insurmountable.\n\nWe'll still want travis to do the signing and release, but luckily we can encrypt things so that only travis can read them."},"comment":{"url":"https://api.github.com/repos/KSP-CKAN/CKAN/issues/comments/185719550","html_url":"https://github.com/KSP-CKAN/CKAN/issues/1354#issuecomment-185719550","issue_url":"https://api.github.com/repos/KSP-CKAN/CKAN/issues/1354","id":185719550,"user":{"login":"phmayo","id":9535924,"avatar_url":"https://avatars.githubusercontent.com/u/9535924?v=3","gravatar_id":"","url":"https://api.github.com/users/phmayo","html_url":"https://github.com/phmayo","followers_url":"https://api.github.com/users/phmayo/followers","following_url":"https://api.github.com/users/phmayo/following{/other_user}","gists_url":"https://api.github.com/users/phmayo/gists{/gist_id}","starred_url":"https://api.github.com/users/phmayo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phmayo/subscriptions","organizations_url":"https://api.github.com/users/phmayo/orgs","repos_url":"https://api.github.com/users/phmayo/repos","events_url":"https://api.github.com/users/phmayo/events{/privacy}","received_events_url":"https://api.github.com/users/phmayo/received_events","type":"User","site_admin":false},"created_at":"2016-02-18T13:31:54Z","updated_at":"2016-02-18T13:31:54Z","body":"Piggybacking on this:\r\n\r\n[SpaceDock/SpaceDock-Project#2](https://github.com/KSP-SpaceDock/SpaceDock-Project/issues/2) will require some sort of verification infrastructure (see [SpaceDock/SpaceDock-Project#22](https://github.com/KSP-SpaceDock/SpaceDock-Project/issues/22) for a discussion of implementation ideas), and we were hoping to jump on hte CKAN metadata train, but the spec has no provisions for a `\"signed\"` field (to reduce the chances of somebody tempering with packages), or at least a `\"hash\"` to provide download integrity verification."}}