sign SHA256SUM files.

[graingert]

gpg --detach-sign SHA256SUMS

[graingert]

If it were not for the fact that

SHA256 file is still downloadable from https://downloads.wkhtmltopdf.org/0.12/0.12.3/

It would have been impossible to share files found from the web as a temporary solution for those needing the file in #3518

However with signed SHA256SUM files everyone would know the provenance of the files, even if wkhtmltopdf.org were totally down.

[ashkulz]

Is that still a concern now that it's on github? Most projects releasing on Github don't even publish checksums...

[graingert]

@ashkulz I think it's different for browsers.

[ashkulz]

I'd still have to publish the gpg key, deal with key rotation, etc. Makes sense for a bigger project, just not this one I feel...

[ashkulz]

0.12.5 was signed with a GPG key, and I'll sign the sha256sums file as well once the binaries are uploaded.

not sure how to share the key, is there a recommended practice for that?

[ashkulz]

Packages for 0.12.5 are available using signed checksums.