Vít Ondruch wrote:
Dne 25. 07. 19 v 8:46 Petr Pisar napsal(a):
> (1) I don't agree this feature is helpful. If we don't trust ./sources
> file content in dist-git, we cannot trust keyring stored in the the same
> dist-git repository. In other words it only brings another code into
> spec files and build process that consumes resources and can fail.
I had the same objections:
https://pagure.io/packaging-committee/issue/610#comment-144451
https://pagure.io/packaging-committee/issue/610#comment-535982
And in response to that I added the paragraph that explains that a
signature by the upstream developers certifies that the source is
identical to what they released, not just that the file is the one that
the packager uploaded. Policies should come with justification, so
thank you for pointing out that the initial draft didn't explain this.
Björn Persson