open-source-parsers / open-source-parsers/jsoncpp
Feature Request: Release package signing
Open
Nobody has claimed this yet.
enhancement
help wanted
- Dominant language
- C++
- Stars
- 8.9k
- Forks
- 2.7k
- Avg merge
- 31m
- Merged PRs (30d)
- 1
Description
Hello,
There is currently no way to verify the complete integrity of releases. Please consider signing your releases so that package maintainers can verify the sources prior to packaging.
See here for how-to and complete details:
https://wiki.debian.org/Creating%20signed%20GitHub%20releases
Thank you
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Debian guide on creating signed GitHub releases, then inspect how this repository currently publishes releases. Done means releases provide verifiable signatures or equivalent integrity metadata so package maintainers can verify their sources before packaging.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, github
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100