[libvirt] ANNOUNCE: libvirt 1.0.5.6 maintenance release

Christophe Fergeau cfergeau at redhat.com
Thu Oct 3 07:43:00 UTC 2013


Hey,

On Wed, Oct 02, 2013 at 08:12:24PM +0200, Guido Günther wrote:
> > It would be very nice if the announce mail included either a sha256
> > checksum for the tarball (thanks Guido for doing that in your recent
> > release!), or a GPG key used to sign the release, see
> > http://lwn.net/Articles/548857/ for more details about this.
> 
> I sign the tag as well as the email so together with the checksums this
> builds the "chain of trust" (given you trust my gpg signature). A
> further improvement would be to build the tarballs first and then add
> the checksums as the commit message of the tag - I'll try to do that
> with the next 0.9.12.x release.

Having the checksum of the tarball in a signed email archived in a totally
different place than the server hosting the actual tarballs is already
very good imo, I'm not sure it's worth complicating the process even
further (but it wouldn't hurt if you do that I guess!)

Christophe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20131003/3e0b7d2c/attachment-0001.sig>


More information about the libvir-list mailing list