{"action":"created","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/2926","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/2926/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/2926/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/2926/events","html_url":"https://github.com/systemd/systemd/issues/2926","id":144923794,"number":2926,"title":"systemd tarballs should be signed","user":{"login":"keszybz","id":349618,"avatar_url":"https://avatars.githubusercontent.com/u/349618?v=3","gravatar_id":"","url":"https://api.github.com/users/keszybz","html_url":"https://github.com/keszybz","followers_url":"https://api.github.com/users/keszybz/followers","following_url":"https://api.github.com/users/keszybz/following{/other_user}","gists_url":"https://api.github.com/users/keszybz/gists{/gist_id}","starred_url":"https://api.github.com/users/keszybz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keszybz/subscriptions","organizations_url":"https://api.github.com/users/keszybz/orgs","repos_url":"https://api.github.com/users/keszybz/repos","events_url":"https://api.github.com/users/keszybz/events{/privacy}","received_events_url":"https://api.github.com/users/keszybz/received_events","type":"User","site_admin":false},"labels":[{"id":221989823,"url":"https://api.github.com/repos/systemd/systemd/labels/build-system","name":"build-system","color":"c7def8","default":false},{"id":191919608,"url":"https://api.github.com/repos/systemd/systemd/labels/RFE","name":"RFE","color":"009800","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-03-31T14:50:01Z","updated_at":"2016-11-05T18:35:33Z","closed_at":null,"body":"For some background discussion, see e.g. https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/2TBK4LLNRH73QJQSXWFPCQYHGTSJ3C7P/.\n\nWe currently use autogenerated github tarballs. I think this is convenient, and we can keep that. But we should provide a signature for this tarball, so that downstream maintainers can easily check that the downloaded code is legitimate. The signatures would be generated for tagged versions only.\n\nProposal:\n- when making a release, also generate the tarball locally and create a detached signature for the github tarball\n- upload the signature file to github\n\nSomething like this:\n\n```\nv=229; git archive --prefix=systemd-$v/ v$v | gzip --no-name > systemd-$v.tar.gz\ngpg2 --detach-sign systemd-$v.tar.gz \ncurl -X POST -H 'Content-Type: text/plain' https://github.com/repos/:systemd/:systemd/releases/:v$v/assets?name=systemd-$v.tar.gz.gpg --data-binary systemd-$v.tar.gz.gpg\n```\n\n(Last part untested)\n\nOr we could generate proper .xz compressed tarballs and sign that, since we're already mucking around with uploads.\n"},"comment":{"url":"https://api.github.com/repos/systemd/systemd/issues/comments/258632103","html_url":"https://github.com/systemd/systemd/issues/2926#issuecomment-258632103","issue_url":"https://api.github.com/repos/systemd/systemd/issues/2926","id":258632103,"user":{"login":"poettering","id":2130732,"avatar_url":"https://avatars.githubusercontent.com/u/2130732?v=3","gravatar_id":"","url":"https://api.github.com/users/poettering","html_url":"https://github.com/poettering","followers_url":"https://api.github.com/users/poettering/followers","following_url":"https://api.github.com/users/poettering/following{/other_user}","gists_url":"https://api.github.com/users/poettering/gists{/gist_id}","starred_url":"https://api.github.com/users/poettering/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poettering/subscriptions","organizations_url":"https://api.github.com/users/poettering/orgs","repos_url":"https://api.github.com/users/poettering/repos","events_url":"https://api.github.com/users/poettering/events{/privacy}","received_events_url":"https://api.github.com/users/poettering/received_events","type":"User","site_admin":false},"created_at":"2016-11-05T18:35:33Z","updated_at":"2016-11-05T18:35:33Z","body":"Sure. Go ahead. But are you sure that the git archive output is stable? I.e. that you always get the excact bytewise identical tarball?"}}
{"actor":{"display_login":"poettering"}}