#6267: sign ostree commits -----------------------------+------------------------ Reporter: walters | Owner: rel-eng@… Type: task | Status: new Milestone: Fedora 23 Final | Component: koji Keywords: | Blocked By: Blocking: | -----------------------------+------------------------ This has been discussed several times. AIUI it is blocked on a Fedora policy of not doing detached signatures.
As downstream Red Hat Enterprise Linux and its associated PST are OK with detached signatures, I think Fedora should as well.
The GPG signature would have helped mitigate https://git.fedorahosted.org/cgit/spin- kickstarts.git/commit/?id=1e408e111008f539c89212a9ca9bb955e2c4f823 for example.