graydon/rust — pull request #1363 by elly (2011-12-21 01:13:35+00:00)
Title: cargo: support optional signing of packages.json files.

Add extra source fields: "sig" is a url at which a detached signature of a packages.json file can be found, "key" is a url at which a public key block can be found, and "keyfp" is the gpg fingerprint of the key which signs packages.json. If all three fields are present, signatures are checked at sync time and invalid signatures are rejected.

Also, add 'cargo init', which fetches a default sources.json from www.rust-lang.org.

Signed-off-by: Elly Jones