Re: [PATCH] scripts: GPG Sign overall tarball in release

[Petr Lautrbach <lautrbach@redhat.com>]

Jason Zaman <jason@perfinion.com> writes:

> In the release script, there was a GPG sig for each component tarball.
> There is also the overall script with all subdirectories at once, but it
> was missing the gpg sig.
>
> Reported-by: Petr Lautrbach <lautrbach@redhat.com>
> Signed-off-by: Jason Zaman <jason@perfinion.com>

Acked-by: Petr Lautrbach <lautrbach@redhat.com>

> ---
>
> 3.10-rc1 and -rc2 had the signature missing on the upload to github.
> I've signed and uploaded to those releases. The files I signed were the
> local ones on my machines, ie did not download from github and sign, so
> there is no risk of any changes/mitm.
>
>  scripts/release | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/scripts/release b/scripts/release
> index dddbdf22..94125a7a 100755
> --- a/scripts/release
> +++ b/scripts/release
> @@ -53,6 +53,7 @@ for COMPONENT in "${DIRS[@]}"; do
>  done
>  
>  git archive -o "$DEST/selinux-${RELEASE_TAG}.tar.gz" --prefix="selinux-${RELEASE_TAG}/" "${RELEASE_TAG}"
> +gpg -b -a "$DEST/selinux-${RELEASE_TAG}.tar.gz"
>  
>  echo "Add the following to the $WIKIDIR/Releases.md wiki page:"
>  
> -- 
> 2.52.0