{"action":"created","issue":{"url":"https://api.github.com/repos/codership/galera/issues/341","labels_url":"https://api.github.com/repos/codership/galera/issues/341/labels{/name}","comments_url":"https://api.github.com/repos/codership/galera/issues/341/comments","events_url":"https://api.github.com/repos/codership/galera/issues/341/events","html_url":"https://github.com/codership/galera/issues/341","id":105107086,"number":341,"title":"Sign Galera releases with OpenPGP","user":{"login":"ottok","id":668724,"avatar_url":"https://avatars.githubusercontent.com/u/668724?v=3","gravatar_id":"","url":"https://api.github.com/users/ottok","html_url":"https://github.com/ottok","followers_url":"https://api.github.com/users/ottok/followers","following_url":"https://api.github.com/users/ottok/following{/other_user}","gists_url":"https://api.github.com/users/ottok/gists{/gist_id}","starred_url":"https://api.github.com/users/ottok/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ottok/subscriptions","organizations_url":"https://api.github.com/users/ottok/orgs","repos_url":"https://api.github.com/users/ottok/repos","events_url":"https://api.github.com/users/ottok/events{/privacy}","received_events_url":"https://api.github.com/users/ottok/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/codership/galera/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":{"login":"philip-galera","id":8738032,"avatar_url":"https://avatars.githubusercontent.com/u/8738032?v=3","gravatar_id":"","url":"https://api.github.com/users/philip-galera","html_url":"https://github.com/philip-galera","followers_url":"https://api.github.com/users/philip-galera/followers","following_url":"https://api.github.com/users/philip-galera/following{/other_user}","gists_url":"https://api.github.com/users/philip-galera/gists{/gist_id}","starred_url":"https://api.github.com/users/philip-galera/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philip-galera/subscriptions","organizations_url":"https://api.github.com/users/philip-galera/orgs","repos_url":"https://api.github.com/users/philip-galera/repos","events_url":"https://api.github.com/users/philip-galera/events{/privacy}","received_events_url":"https://api.github.com/users/philip-galera/received_events","type":"User","site_admin":false},"milestone":null,"comments":4,"created_at":"2015-09-06T17:59:30Z","updated_at":"2015-09-07T05:59:06Z","closed_at":"2015-09-07T05:59:06Z","body":"Offcial Galera releases should be signed to ensure authenticity. At minimum at least the source file should be signed and a .asc file found at http://releases.galeracluster.com/source/\r\n\r\nFor comparison see how ftp://ftp.osuosl.org/pub/mariadb/mariadb-10.0.21/source/ contains both mariadb-10.0.21.tar.gz and mariadb-10.0.21.tar.gz.asc\r\n\r\nFor example Debian employs automated signature checking: https://wiki.debian.org/debian/watch#Cryptographic_signature_verification\r\n\r\nIt would be nice if the source release signature is made with the same key already advertised at http://releases.galeracluster.com/GPG-KEY-galeracluster.com"},"comment":{"url":"https://api.github.com/repos/codership/galera/issues/comments/138196738","html_url":"https://github.com/codership/galera/issues/341#issuecomment-138196738","issue_url":"https://api.github.com/repos/codership/galera/issues/341","id":138196738,"user":{"login":"philip-galera","id":8738032,"avatar_url":"https://avatars.githubusercontent.com/u/8738032?v=3","gravatar_id":"","url":"https://api.github.com/users/philip-galera","html_url":"https://github.com/philip-galera","followers_url":"https://api.github.com/users/philip-galera/followers","following_url":"https://api.github.com/users/philip-galera/following{/other_user}","gists_url":"https://api.github.com/users/philip-galera/gists{/gist_id}","starred_url":"https://api.github.com/users/philip-galera/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philip-galera/subscriptions","organizations_url":"https://api.github.com/users/philip-galera/orgs","repos_url":"https://api.github.com/users/philip-galera/repos","events_url":"https://api.github.com/users/philip-galera/events{/privacy}","received_events_url":"https://api.github.com/users/philip-galera/received_events","type":"User","site_admin":false},"created_at":"2015-09-07T05:59:06Z","updated_at":"2015-09-07T05:59:06Z","body":"gpg --verify works for me . If there is nothing else that needs to be done on our side, I will close this ticket."}}