Re: Gnome Flatpak build system, descriptions and questions

[Tomasz Torcz <tomek pipebreaker pl>]

On Fri, Aug 26, 2016 at 11:48:58AM -0400, Shaun McCance wrote:
> On Fri, 2016-08-26 at 10:17 -0500, Michael Catanzaro wrote:
> > On Fri, 2016-08-26 at 10:29 -0400, Shaun McCance wrote:
> > > Don't all maintainers already use signed tags for releases?
> > No. I used to do this, but stopped a couple years ago because it was
> > pointless. Nobody should trust my key, so why use it?
>
> IIRC, git.gnome.org won't let you push an unsigned tag. I've been
> tagging releases since the days of CVS, because tags are useful. I
> thought everybody did.
>
> That still leaves the question: If the release team tags with a key we
> can all trust, how does the release team trust that the commit they
> tagged is the one the maintainer intended?

 Aren't you confused? Tagging and signing (presumably signing a tag) are
two separate actions.

-- 
Tomasz Torcz              ,,If you try to upissue this patchset I shall be seeking
xmpp: zdzichubg chrome pl   an IP-routable hand grenade.'' -- Andrew Morton (LKML)