(
Jump to the original submission)
Sun 21 Oct 2012 07:40:17 AM UTC, comment #6:
Hi,
I have setup a key and signed the current stable release with it (0.3.9).
Please look at download page for more info, I added :
- SHA1 sum for all (stable) packages
- gpg signature for version 0.3.9
- instructions to get/check key and verify signature.
If something is wrong, please let me know.
For HTTPS on weechat.org, it's planned for the next weeks.
|
Fri 19 Oct 2012 12:19:13 PM UTC, comment #5:
Alright, no problem. I'll poke you in a month or two to see how it's coming along.
By the way, check out irssi's download page for an example of how to display/use the sigs:
http://irssi.org/download
|
Wed 17 Oct 2012 03:23:07 PM UTC, comment #4:
OK, will be done later (not a high priority, and a few things on my side are needed to do that).
|
Fri 12 Oct 2012 04:16:28 PM UTC, comment #3:
I discussed this with flashcode on IRC.
The main issue is that flashcode does weechat builds on a server, so signing those packages with a GPG key is of only questionable value.
He said he'd look into changing his build process to build - at least stable releases - offline sometime in the future.
Also, getting an SSL cert for HTTPS on the download page can be done for free [0][1]. Flashcode is running something else on 443 that would need to be moved.
[0]: https://www.startssl.com/?app=12
[1]: http://arstechnica.com/security/2009/12/how-to-get-set-with-a-secure-sertificate-for-free/
|
Tue 02 Oct 2012 10:43:20 AM UTC, comment #2:
I think that Abel means that there is no downloadable signature on http://weechat.org/download/ . The gpg signing is just
gpg --detach-sign source.tar.gz
and it generates file called
source.tar.gz.sig or source.tar.gz.gpg or if -a was given to gpg or gpg.conf had "armor" in it source.tar.gz.asc.
-a or "armor" makes the signature to be ASCII armored (plain text) instead of binary.
(I hope that I understood "Need Info" status correctly)
|
Tue 02 Oct 2012 06:59:10 AM UTC, comment #1:
If you have some time to discuss that on irc, I have some questions. Thanks.
|
Sun 23 Sep 2012 04:38:21 PM UTC, original submission:
Hi there, I can't seem to find any signatures to download and verify along side the binary packages or source tarballs.
Most users probably get weechat from their distro's packages, but as far as I can tell, the packagers have no way to verify the authenticity of the source tarballs they download.
It would be great if the download page could link to the signature, moreover, if the downloads were available for TLS, that would be useful as well.
If you have any questions about how to implement GPG signing/verification into the release process, let me know, I'd be more than happy to help.
|
(Note: upload size limit is set to 16384 kB, after insertion of the required
escape characters.)
Attach File(s):
Comment:
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Follow 7 latest changes.