MantisBT - VCMI
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0001883VCMIOtherpublic2014-08-24 19:062014-08-31 16:28
Reporterjosch 
Assigned To 
PrioritynoneSeverityfeatureReproducibilityN/A
StatusnewResolutionopen 
PlatformOSOS Version
Product Version 
Target VersionFixed in Version 
Summary0001883: could you GPG sign vcmi releases?
DescriptionWould it be possible to sign source releases or release tags in the svn and/or git repository with a GPG key? It would then be possible to verify that the downloaded code is indeed the intended one by the developers and has not been tempered with.
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2014-08-24 19:06joschNew Issue
2014-08-31 16:20IvanNote Added: 0004937
2014-08-31 16:28joschNote Added: 0004940

Notes
(0004937)
Ivan   
2014-08-31 16:20   
Possible although don't see much use from it. Will try to do this starting from next release (assuming that I won't forget about it)
(0004940)
josch   
2014-08-31 16:28   
Thank you for your consideration!

If you do end up signing your releases, then please put the detached signature in an easily discoverable path. For example if the tarball is at:

http://download.vcmi.eu/vcmi-0.97.tar.gz [^]

then the ASCII armored detached signature could be put at:

http://download.vcmi.eu/vcmi-0.97.tar.gz.asc [^]