Signing release packages and downloads

[cebe]

You might have seen Github showing singed commits: https://github.com/blog/2144-gpg-signature-verification

Imo we should apply this to the releases, i.e. sign the release tag and also the uploaded tar files.
PHP does this already: http://php.net/downloads.php#gpg-7.1
And eventually also composer would check these signatures: composer/composer#4022

Related resources:

• https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work
• https://help.github.com/articles/signing-commits-using-gpg/
• https://github.com/NicoHood/NicoHood.github.io/wiki/Github-GPG-signed-release-script

[resurtm]

Nice find! ;-) @cebe, you guys could also mention in contributing docs/readme that commits can be signed by the users as well. I personally would be happy to see the core developers signing their commits on permanent basis. Looks like a very nice feature!

[SilverFire]

I sign all my commits that have code changes: 88f2348 88f2348 7d494c1 437825b

[andrewhowdencom]

Warning about unsigned commit: https://github.com/andrewhowdencom/git-hooks/blob/master/post-commit

Sign by default: https://github.com/andrewhowdencom/dotfiles/blob/master/.gitincludes#L7

[klimov-paul]

What will happen with PR merge commit created at GitHub side by 'merge' button?

[samdark]

It's not being signed.

[cebe]

Also things you edit on github are not signed.

[samdark]

Closing since releases are now signed.

[cebe]

They kind of are, but we provide no information for people to verify that. Should be added.

[samdark]

Moved to contrib repo.