{"action":"created","issue":{"url":"https://api.github.com/repos/libssh2/libssh2/issues/14","labels_url":"https://api.github.com/repos/libssh2/libssh2/issues/14/labels{/name}","comments_url":"https://api.github.com/repos/libssh2/libssh2/issues/14/comments","events_url":"https://api.github.com/repos/libssh2/libssh2/issues/14/events","html_url":"https://github.com/libssh2/libssh2/issues/14","id":70633191,"number":14,"title":"Upload release tarball to Github","user":{"login":"jakob","id":198305,"avatar_url":"https://avatars.githubusercontent.com/u/198305?v=3","gravatar_id":"","url":"https://api.github.com/users/jakob","html_url":"https://github.com/jakob","followers_url":"https://api.github.com/users/jakob/followers","following_url":"https://api.github.com/users/jakob/following{/other_user}","gists_url":"https://api.github.com/users/jakob/gists{/gist_id}","starred_url":"https://api.github.com/users/jakob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jakob/subscriptions","organizations_url":"https://api.github.com/users/jakob/orgs","repos_url":"https://api.github.com/users/jakob/repos","events_url":"https://api.github.com/users/jakob/events{/privacy}","received_events_url":"https://api.github.com/users/jakob/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-24T09:06:26Z","updated_at":"2015-04-24T09:22:01Z","closed_at":null,"body":"I'm still on a quest to find a way to download libssh2 sources over HTTPS.\r\n\r\nIs it possible to upload the release tarball to Github? Github allows adding binaries to release pages. You could upload the tarball on this page: https://github.com/libssh2/libssh2/releases/tag/libssh2-1.5.0\r\n\r\nThis would allow me to download libbsh2 via HTTPS from Github.\r\n\r\nWhy is this important? I use a build script that can automatically download sources of dependencies. If that download is via HTTP, I have no automatic way to verify the sources have not been tampered with.\r\n\r\n(Side effect: If bandwidth costs are a concern, you could point the download link on libssh2.org to Github and have them pay for bandwidth...)"},"comment":{"url":"https://api.github.com/repos/libssh2/libssh2/issues/comments/95867003","html_url":"https://github.com/libssh2/libssh2/issues/14#issuecomment-95867003","issue_url":"https://api.github.com/repos/libssh2/libssh2/issues/14","id":95867003,"user":{"login":"bagder","id":177011,"avatar_url":"https://avatars.githubusercontent.com/u/177011?v=3","gravatar_id":"","url":"https://api.github.com/users/bagder","html_url":"https://github.com/bagder","followers_url":"https://api.github.com/users/bagder/followers","following_url":"https://api.github.com/users/bagder/following{/other_user}","gists_url":"https://api.github.com/users/bagder/gists{/gist_id}","starred_url":"https://api.github.com/users/bagder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bagder/subscriptions","organizations_url":"https://api.github.com/users/bagder/orgs","repos_url":"https://api.github.com/users/bagder/repos","events_url":"https://api.github.com/users/bagder/events{/privacy}","received_events_url":"https://api.github.com/users/bagder/received_events","type":"User","site_admin":false},"created_at":"2015-04-24T09:22:01Z","updated_at":"2015-04-24T09:22:01Z","body":"I don't see how I can upload anything there, but you can download the repo as a tarball from there already.\r\n\r\nThe problem for you to rely on my uploaded tarball via HTTPS on github is that you then haven't verified that the package comes from me. The only way to verify that is to verify the GPG key for the tarball (as I signed the packages immediately after I made them on my local machine). I already provide the signatures on the libssh2.org site. You can probably get a fair certainty level by seeing that it is signed by the same key like the previous releases (that you may have trust already).\r\n\r\nAnd no, it is actually _not_ that easy to just transfer the site to github. Or rather, it would require someone to generate the site and then copy it over so that it will continue to adapt to git repo contents - if it were to keep the current setup. Not that bandwidth costs is a particular concern for this little-visited web site.\r\n\r\nIn fact anyone can verify the package and put it on a HTTPS site. Or make their own. All the code I made the package from is in the git repo. I'm already waaaay behind on work for libssh2, I cannot take on any more."}}