From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason at zx2c4.com (Jason A. Donenfeld) Date: Tue, 23 Feb 2016 15:03:00 +0100 Subject: [pass] Killing plaintext git:// in favor of https:// cloning In-Reply-To: References: <20160223011957.GA788@dcvr.yhbt.net> Message-ID: On Tue, Feb 23, 2016 at 2:53 PM, Brian Minton wrote: > Certainly got can sign individual tags with an OpenPGP key. Each commit is > also hashed and the hashes are known. If you sign every commit, or at least > every release, the code can't be tampered with. This is the workflow of, for > instance, the Linux kernel. False. Commits in Linux development are not routinely signed.