Signed releases

[innir]

Hi,

it would be really nice if you could provide gpg signatures of the releases. This way I could check if the releases in Debian really match the ones you released. The workflow is described here:

https://wiki.debian.org/Creating%20signed%20GitHub%20releases

Best,
Philip

[annejan]

I have done this for 1.1.3 now 👍 and will keep this in my "release flow".
https://github.com/IJHack/qtpass/releases/latest
gpg --verify v1.1.3.tar.gz.asc qtpass-1.1.3.tar.gz shouldn't it be qtpass-1.1.3.tar.gz.asc ?
I'm currently signing tags and commits with my "public" key, might change to a IJhack (sub) key after the summer, but I will let you know if/when that happens.
git verify-tag v1.1.3
The public key can be downloaded from https://annejan.com/key amongst other locations.
wget https://annejan.com/key -q -O - | gpg --list-packets

Hope that helps, and if I change the release signing key, I will let you know . .
If there is anything you'd like to see differently @innir (for example using filename qtpass-1.1.3.tar.gz.asc instead of v1.1.3.tar.gz.asc) just let me know . .

[innir]

It seems, you forgot to sign release 1.1.4. Could you add the gpg signature?

Thanks,
Philip

[annejan]

Aw, yes . . forgot to add the qtpass-1.1.4.tar.gz.asc

[annejan]

Should be fixed now . . and noted for the next time, thanks @innir

v1.1.4.tar.gz.asc

[innir]

Thanks!