GPG sign tags and releases
Open
bug
- Dominant language
- Rust
- Stars
- 32.7k
- Forks
- 4.3k
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 253
Description
Nowhere at https://github.com/block/buzz/tags do I see signed git tags.
Also, https://github.com/block/buzz/releases does not have `SHA256SUMS` with hashes for each binary file that I can verify with `sha256sum -c SHA256SUMS`. Also, there is no `SHA256SUMS.gpg` providing signature(s) for the hashes either.
Please add this to your workflow so that we can have check the authenticity of the files that are downloaded.
Contributor guide
Assessment
This issue has not been assessed yet.