Re: backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils)

[Attila Lendvai]

> > I think we should gradually move to building everything from
> > source—i.e., fetching code from VCS and adding Autoconf & co. as inputs.
> 
> 
> the big drawback of this approach is that we would lose maintainers'
> signatures, right?


it's possible to sign git commits and (annotated) tags, too.

it's good practice to enable signing by default.

admittedly though, few people sign all their commits, and even fewer sign their 
tags.

-- 
• attila lendvai
• PGP: 963F 5D5F 45C7 DFCD 0A39
--
“Never appeal to a man's "better nature". He may not have one. Invoking his 
self-interest gives you more leverage.”
        — Robert Heinlein (1907–1988), 'Time Enough For Love' (1973)