[BUG] detached signature of salt source tarball missing in recent releases
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
There used to be a signature for the source tarball, for example https://github.com/saltstack/salt/releases/download/v3007.1/salt-3007.1.tar.gz.asc. It's no longer there in recent releases, for example at github.com/saltstack/salt/releases/tag/v3007.6
I guess it's a side effect of new automation after repo migration, but I can't find any info whether it's intentional change (why?) or missed in the process. Please restore those, as the signature is useful for integrity check (especially checking tarball authenticity offline).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare the v3007.1 and v3007.6 GitHub release assets, especially the salt-3007.1.tar.gz.asc signature, then inspect the release automation added after the repository migration. Done means recent source tarballs again have detached signatures that can be used to verify authenticity offline.
Written by the indexing model from the issue text.
Assessment
- Domain
- release, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100