Repository navigation
Detach-sign all release files #588
Description
Related: #586
It'd be incredibly helpful for automated builds and distros that don't have their own packages with files attached (Gentoo/Arch's AUR/NixOS) if all files in a release could be detach-signed with GPG by a key with a common trustee.
Could also make the packaging flow much nicer/less prone to not checking signatures and hashes for other distros and users in general.
Activity
rvagg commentedon Jan 5, 2017
Are you talking about detached signature files here or key trust? Or somehow both?
We've been making detached signatures since nodejs/node#9071, although we haven't updated the docs to demonstrate how to use this as we've been waiting for all release lines to be updated with the new sig style, tracking in nodejs/node#6821. Since it's been in place for a while now we should probably go ahead and update the docs to tell how to verify with the detached signatures instead of the inline signatures.
rvagg commentedon Jan 5, 2017
... catching up on IRC ... are you perhaps talking about detached signatures for each file in the releases? So ~ double the number of files in the release directories than we have now, an .asc for each one?
Trott commentedon Mar 22, 2019
Closing due to long period of inactivity. Feel free to re-open if this is a thing. I'm just trying to close stuff that has been ignored for sufficiently long that it seems likely it's not something we're going to get to.