From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Rob Browning Newsgroups: gmane.emacs.bugs Subject: bug#24461: Signing Emacs git release tags Date: Sun, 29 Sep 2019 12:24:16 -0500 Message-ID: <87h84vkocf.fsf@trouble.defaultvalue.org> References: <87y2y7krzf.fsf@trouble.defaultvalue.org> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="104376"; mail-complaints-to="usenet@blaine.gmane.org" Cc: John Wiegley , Nicolas Petton , 24461@debbugs.gnu.org To: Stefan Kangas Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sun Sep 29 19:25:24 2019 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([209.51.188.17]) by blaine.gmane.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1iEcwl-000R0g-OE for geb-bug-gnu-emacs@m.gmane.org; Sun, 29 Sep 2019 19:25:23 +0200 Original-Received: from localhost ([::1]:41336 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iEcwi-0002Co-Pu for geb-bug-gnu-emacs@m.gmane.org; Sun, 29 Sep 2019 13:25:22 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:34316) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iEcwU-0002CQ-4r for bug-gnu-emacs@gnu.org; Sun, 29 Sep 2019 13:25:07 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iEcwQ-0007Xj-4f for bug-gnu-emacs@gnu.org; Sun, 29 Sep 2019 13:25:06 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:46967) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1iEcwQ-0007WI-0P for bug-gnu-emacs@gnu.org; Sun, 29 Sep 2019 13:25:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1iEcwP-0004fl-OM for bug-gnu-emacs@gnu.org; Sun, 29 Sep 2019 13:25:01 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Rob Browning Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sun, 29 Sep 2019 17:25:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 24461 X-GNU-PR-Package: emacs Original-Received: via spool by 24461-submit@debbugs.gnu.org id=B24461.156977785817897 (code B ref 24461); Sun, 29 Sep 2019 17:25:01 +0000 Original-Received: (at 24461) by debbugs.gnu.org; 29 Sep 2019 17:24:18 +0000 Original-Received: from localhost ([127.0.0.1]:55788 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1iEcvh-0004eb-ON for submit@debbugs.gnu.org; Sun, 29 Sep 2019 13:24:17 -0400 Original-Received: from defaultvalue.org ([45.33.119.55]:46782 ident=postfix) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1iEcvf-0004eS-Hn for 24461@debbugs.gnu.org; Sun, 29 Sep 2019 13:24:16 -0400 Original-Received: from trouble.defaultvalue.org (localhost [127.0.0.1]) (Authenticated sender: rlb@defaultvalue.org) by defaultvalue.org (Postfix) with ESMTPSA id 9BC0F200AC; Sun, 29 Sep 2019 12:24:14 -0500 (CDT) Original-Received: by trouble.defaultvalue.org (Postfix, from userid 1000) id 0F8C014E068; Sun, 29 Sep 2019 12:24:17 -0500 (CDT) In-Reply-To: X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.51.188.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:167734 Archived-At: Stefan Kangas writes: > I think signing tags is different than signing commits. A signed tag > means you can have more trust that you are using the code with the > latest fix to security problem X, announced to have been released in > tagged Emacs version Y, and not code missing that fix. Fair enough -- I suppose without the signed tag, there's no way to be completely sure that you have the right signed commit. -- Rob Browning rlb @defaultvalue.org and @debian.org GPG as of 2011-07-10 E6A9 DA3C C9FD 1FF8 C676 D2C4 C0F0 39E9 ED1B 597A GPG as of 2002-11-03 14DD 432F AE39 534D B592 F9A0 25C8 D377 8C7E 73A4