> with a name.
We will discuss this topic within the maintainers team in January and will announce decisions made.
This is not ideal but what you can check right now:
(1) if you click on a green "check" near the "2.6.2" tag label in release at GitHub, you can see:
- "This tag was signed with the committer’s verified signature."
- GPG key ID: 8D7326351A726211 -- this is the same key ID as you see
in (updated) sssd-2.6.2.tar.gz.asc (compare last 16 chars)
So,
if I understand correctly, at least you can be sure tarball is signed
with the same key as uploaded to
github.com/alexey-tikhonov profile -
member of SSSD org.
(2) Not a real argument, of course, but you can check that this tarball was used for a Fedora rebase:
(3) you can compare sources with the 2.6.2 tag upstream. There is also `scripts/release.sh` that is used to generate tarballs, but the result might differ a bit depending on the autotools version.
Sorry for the confusion I created - this was the first time I published an upstream release.