{"action":"created","issue":{"url":"https://api.github.com/repos/Bitmessage/PyBitmessage/issues/720","labels_url":"https://api.github.com/repos/Bitmessage/PyBitmessage/issues/720/labels{/name}","comments_url":"https://api.github.com/repos/Bitmessage/PyBitmessage/issues/720/comments","events_url":"https://api.github.com/repos/Bitmessage/PyBitmessage/issues/720/events","html_url":"https://github.com/Bitmessage/PyBitmessage/issues/720","id":43356628,"number":720,"title":"Sourcecode isn't PGP signed","user":{"login":"petertodd","id":7042,"avatar_url":"https://avatars.githubusercontent.com/u/7042?v=3","gravatar_id":"","url":"https://api.github.com/users/petertodd","html_url":"https://github.com/petertodd","followers_url":"https://api.github.com/users/petertodd/followers","following_url":"https://api.github.com/users/petertodd/following{/other_user}","gists_url":"https://api.github.com/users/petertodd/gists{/gist_id}","starred_url":"https://api.github.com/users/petertodd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petertodd/subscriptions","organizations_url":"https://api.github.com/users/petertodd/orgs","repos_url":"https://api.github.com/users/petertodd/repos","events_url":"https://api.github.com/users/petertodd/events{/privacy}","received_events_url":"https://api.github.com/users/petertodd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"PeterSurda","id":3815204,"avatar_url":"https://avatars.githubusercontent.com/u/3815204?v=3","gravatar_id":"","url":"https://api.github.com/users/PeterSurda","html_url":"https://github.com/PeterSurda","followers_url":"https://api.github.com/users/PeterSurda/followers","following_url":"https://api.github.com/users/PeterSurda/following{/other_user}","gists_url":"https://api.github.com/users/PeterSurda/gists{/gist_id}","starred_url":"https://api.github.com/users/PeterSurda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PeterSurda/subscriptions","organizations_url":"https://api.github.com/users/PeterSurda/orgs","repos_url":"https://api.github.com/users/PeterSurda/repos","events_url":"https://api.github.com/users/PeterSurda/events{/privacy}","received_events_url":"https://api.github.com/users/PeterSurda/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/Bitmessage/PyBitmessage/milestones/1","html_url":"https://github.com/Bitmessage/PyBitmessage/milestones/v0.6.0","labels_url":"https://api.github.com/repos/Bitmessage/PyBitmessage/milestones/1/labels","id":1362166,"number":1,"title":"v0.6.0","description":"Next stable release","creator":{"login":"PeterSurda","id":3815204,"avatar_url":"https://avatars.githubusercontent.com/u/3815204?v=3","gravatar_id":"","url":"https://api.github.com/users/PeterSurda","html_url":"https://github.com/PeterSurda","followers_url":"https://api.github.com/users/PeterSurda/followers","following_url":"https://api.github.com/users/PeterSurda/following{/other_user}","gists_url":"https://api.github.com/users/PeterSurda/gists{/gist_id}","starred_url":"https://api.github.com/users/PeterSurda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PeterSurda/subscriptions","organizations_url":"https://api.github.com/users/PeterSurda/orgs","repos_url":"https://api.github.com/users/PeterSurda/repos","events_url":"https://api.github.com/users/PeterSurda/events{/privacy}","received_events_url":"https://api.github.com/users/PeterSurda/received_events","type":"User","site_admin":false},"open_issues":25,"closed_issues":0,"state":"open","created_at":"2015-10-18T09:05:30Z","updated_at":"2015-10-18T11:10:46Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2014-09-22T03:01:26Z","updated_at":"2015-10-18T13:04:26Z","closed_at":null,"body":"I noticed that neither tags nor commits are PGP signed. This really needs to be fixed - right now bitmessage users are trusting github. Bitcoin Core now signs both tags and individual git commits; Signing tags is pretty simple, just use the -s flag with git tag. As for git commits, Wladimir wrote up a good description of how to do this here: https://www.mail-archive.com/bitcoin-development%40lists.sourceforge.net/msg05467.html"},"comment":{"url":"https://api.github.com/repos/Bitmessage/PyBitmessage/issues/comments/149011881","html_url":"https://github.com/Bitmessage/PyBitmessage/issues/720#issuecomment-149011881","issue_url":"https://api.github.com/repos/Bitmessage/PyBitmessage/issues/720","id":149011881,"user":{"login":"PeterSurda","id":3815204,"avatar_url":"https://avatars.githubusercontent.com/u/3815204?v=3","gravatar_id":"","url":"https://api.github.com/users/PeterSurda","html_url":"https://github.com/PeterSurda","followers_url":"https://api.github.com/users/PeterSurda/followers","following_url":"https://api.github.com/users/PeterSurda/following{/other_user}","gists_url":"https://api.github.com/users/PeterSurda/gists{/gist_id}","starred_url":"https://api.github.com/users/PeterSurda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PeterSurda/subscriptions","organizations_url":"https://api.github.com/users/PeterSurda/orgs","repos_url":"https://api.github.com/users/PeterSurda/repos","events_url":"https://api.github.com/users/PeterSurda/events{/privacy}","received_events_url":"https://api.github.com/users/PeterSurda/received_events","type":"User","site_admin":false},"created_at":"2015-10-18T13:04:26Z","updated_at":"2015-10-18T13:04:26Z","body":"Just to make clear, I'm far from opposed to signing PGP commits. I already looked at it a couple of days ago but couldn't figure out how to do with on Github Desktop. Now I looked at it again, and I found that it still has the ability to create a git shell (and I already have gpg installed on the machine). I created a new key for the address associated with the github account, signed the latest (unpushed) commit with --amend, and then checked it it out from another machine. It looks ok. Can you perhaps check it out too? I posted the link to the development repository above. This is what it looks like for me:\r\n\r\n    commit dad14b0cb8dc61537db69de17257775d7830c70e\r\n    gpg: Signature made Son 18 Okt 2015 14:52:09 CEST using RSA key ID 53FBF089\r\n    gpg: Good signature from \"Peter Surda (mailchuck) <dev@mailchuck.com>\"\r\n    gpg: WARNING: This key is not certified with a trusted signature!\r\n    gpg:          There is no indication that the signature belongs to the owner.\r\n    Primary key fingerprint: BFEA 5E1F 78D9 8CA7 9C2C  B185 B631 1FA7 53FB F089\r\n    Author: mailchuck <dev@mailchuck.com>\r\n    Date:   Sat Oct 17 17:11:40 2015 +0200\r\n\r\n        Bump up version\r\n\r\nMaybe you need to wait for the key to propagate."}}