[Mailman-Developers] Signing commits with gpg

[Barry Warsaw]

On Oct 25, 2017, at 12:14, Simon Hanna <simon at hannaweb.eu> wrote:
> 
> I guess more important would be to sign the releases. At least archlinux likes to have signatures for source archives and often requests upstream projects to add this.

Definitely.  I (try to remember to) sign both tags and releases for Core.

> Another thing that just came to mind: how does commit squashing work? You'll probably have to do that offline and not use gitlabs autosmashing…

I would think that squash merges would destroy the record of any intermediate signed commits.  Core doesn’t have a firm policy either way; sometimes I squash merge sometimes not.  I’m philosophical	opposed to squash merging, but git often really makes me want to do it anyway.

-Barry

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL: <http://mail.python.org/pipermail/mailman-developers/attachments/20171025/f6c537c9/attachment.sig>