genodelabs/genode — Issue #138: Repository tags are not signed
Author: chelmuth
Created: 2012-03-06 07:34:24+00:00
State: open

_Nobody_ brought up this issue in the [sourceforge forum](https://sourceforge.net/projects/genode/forums/forum/825067/topic/5088301):

> I see git tags aren't signed. Code signing should be done from day 1 or it will become harder and harder to retrofit - see how all other OSs still struggle with it. There needs to be a chain of trust from git to binaries, to isos and everything that is released.

He or she clarified on my request:

> The signature would guarantee that when I checkout the code I get exactly what you intendet to publish. It protects against MITM (on my end, at the host and between you and the host) and neither of us has to rely on github's TSL and their internal security.
>
> Once there is a binary distribution and binary updates I'd want to verify that binaries are indeed compiled by somone trusted who is using trusted source code. If gpg is already being used now this will be easier to implement.

As I'm still not certain what we would get _currently_ from signed tags and who (resp. which key) should sign them, I open this issue to continue the discussion. I want to emphasize that I (like _Nobody_) believe into tag signing and verification, but think the process how to do it in Genode is not clear: We do not have _the_ signing key or key ring currently, which renders the signatures somewhat useless, right?