From mboxrd@z Thu Jan  1 00:00:00 1970
From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=)
Subject: Re: Packaging packages with GPG signed source archives
Date: Thu, 01 Sep 2016 10:29:16 +0200
Message-ID: <87d1kouioz.fsf@gnu.org>
References: <cu7d1kpv6qc.fsf@systemreboot.net> <87oa49crz1.fsf@gmail.com>
	<cu7shtlz8eq.fsf@systemreboot.net> <20160831172204.GB28096@jasmine>
	<cu7k2ewpywr.fsf@systemreboot.net> <87wpiwlmea.fsf@gnu.org>
	<147267612379.23966.11891288083486079812@what>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Return-path: <help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([2001:4830:134:3::10]:42500)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <ludo@gnu.org>) id 1bfNNE-0005b8-Fn
	for help-guix@gnu.org; Thu, 01 Sep 2016 04:29:25 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <ludo@gnu.org>) id 1bfNNA-0000yi-AY
	for help-guix@gnu.org; Thu, 01 Sep 2016 04:29:23 -0400
In-Reply-To: <147267612379.23966.11891288083486079812@what> (Troy Sankey's
	message of "Wed, 31 Aug 2016 16:42:03 -0400")
List-Id: <help-guix.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/help-guix>,
	<mailto:help-guix-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/help-guix/>
List-Post: <mailto:help-guix@gnu.org>
List-Help: <mailto:help-guix-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/help-guix>,
	<mailto:help-guix-request@gnu.org?subject=subscribe>
Errors-To: help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org
Sender: "Help-Guix" <help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org>
To: Troy Sankey <sankeytms@gmail.com>
Cc: help-guix <help-guix@gnu.org>

Troy Sankey <sankeytms@gmail.com> skribis:

> Quoting Ludovic Court=C3=A8s (2016-08-31 16:21:49)
>> (That said, more and more software is distributed via Git rather than as
>> tarballs, and most repos are unsigned; even if they were, there are
>> basically no tools to meaningfully authenticate a Git checkout=E2=80=A6)
>
> In that case, not all hope is lost---I've seen many projects sign git tag=
s.

Indeed, but signing is the easy part.  :-)

  http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D22883#73

Ludo=E2=80=99.