Feature request: GPG-signed release tarballs

[yan12125]

Since #42, release tags are signed. Could you consider also sign release tarballs? For example, create a signature expat-2.2.5.tar.bz2.asc for the release tarball expat-2.2.5.tar.bz2. That would help people who use plain HTTP instead of git to fetch libexpat.

[hartwork]

You'd still need a to limit the set of allowed keys to sign, right? Else, someone could do MITM and sign using his own key and it would pass the valid signature test. Do you have that infrastructure in place?

[yan12125]

Yes. I'm building packages on Arch Linux, whose build system - makepkg - provides a feature to specify fingerprints for valid PGP keys for a package. See https://wiki.archlinux.org/index.php/PKGBUILD#validpgpkeys

[hartwork]

Seen in PKGBUILD files before, excellent. I'll see what I can do!

[hartwork]

@yan12125 2.2.6 is the first release to come with a .asc file now. It was created using distribute.sh. If you run into any issues with that file please let me know.