Sign git tags & commits

[rugk]

You should consider signing git commits & releases.

• onionshare#221 (comment)
• It is also displayed on GitHub: https://github.com/blog/2144-gpg-signature-verification
• Here is GitHub's help for this: https://help.github.com/articles/generating-a-gpg-key/
• And here is how you can properly sign releases: https://wiki.debian.org/Creating%20signed%20GitHub%20releases

As you already have a PGP key, this should not be difficult for you. At least tags should be signed, so one can also use the verified(!) source to built the application by themselves.

[kherge]

I'm doing this for other repositories, but I'll start with this one.

I just enabled commit.gpgsign on my copy of the repos. Next commits will be signed.

Thanks!

[rugk]

Do not forget to enable tag singing.

Tip:

[alias]
   tag = tag -s

[kherge]

The update to the read me was signed using git config commit.gpgsign true.

😃

[rugk]

Yeah, I know. 😃 (In case this is a reply to my previous comment: There is a difference between tag and commit signing)

[kherge]

Woops, my mistake!