On Fri, Aug 9, 2019 at 10:49 AM François Kooman <fkooman(a)tuxed.net> wrote:
The only thing relevant at this moment is, I think, whether or not to
include Minisign in the Fedora packaging guidelines next to PGP as an
option to verify source tarballs for use by packagers when upstream
signs their software using signify/Minisign. That's all that needs to be
discussed. As stated before, I am willing to work on this.
I would agree with that. For that matter, the guideline is a "SHOULD",
it's not a must - and it relies on the decision that upstream makes.
If upstream decides to use minisign, we should accommodate that decision.
I believe the goal of the guideline is to verify where possible - and
shouldn't mean that if upstream doesn't use PGP, then forget about it.
That, IMO would defeat the intent of the guideline.
What you should do François is simply create a DRAFT guideline using the
current published as a template and then open a ticket for review with the