Oct. 25, 2017
4:55 p.m.
On Oct 25, 2017, at 12:14, Simon Hanna <simon@hannaweb.eu> wrote:
I guess more important would be to sign the releases. At least archlinux likes to have signatures for source archives and often requests upstream projects to add this.
Definitely. I (try to remember to) sign both tags and releases for Core.
Another thing that just came to mind: how does commit squashing work? You'll probably have to do that offline and not use gitlabs autosmashing…
I would think that squash merges would destroy the record of any intermediate signed commits. Core doesn’t have a firm policy either way; sometimes I squash merge sometimes not. I’m philosophical opposed to squash merging, but git often really makes me want to do it anyway.
-Barry