{"action":"created","issue":{"url":"https://api.github.com/repos/thoughtbot/gitsh/issues/205","labels_url":"https://api.github.com/repos/thoughtbot/gitsh/issues/205/labels{/name}","comments_url":"https://api.github.com/repos/thoughtbot/gitsh/issues/205/comments","events_url":"https://api.github.com/repos/thoughtbot/gitsh/issues/205/events","html_url":"https://github.com/thoughtbot/gitsh/issues/205","id":51433460,"number":205,"title":"Releases should be signed with PGP","user":{"login":"georgebrock","id":35861,"avatar_url":"https://avatars.githubusercontent.com/u/35861?v=3","gravatar_id":"","url":"https://api.github.com/users/georgebrock","html_url":"https://github.com/georgebrock","followers_url":"https://api.github.com/users/georgebrock/followers","following_url":"https://api.github.com/users/georgebrock/following{/other_user}","gists_url":"https://api.github.com/users/georgebrock/gists{/gist_id}","starred_url":"https://api.github.com/users/georgebrock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/georgebrock/subscriptions","organizations_url":"https://api.github.com/users/georgebrock/orgs","repos_url":"https://api.github.com/users/georgebrock/repos","events_url":"https://api.github.com/users/georgebrock/events{/privacy}","received_events_url":"https://api.github.com/users/georgebrock/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/thoughtbot/gitsh/labels/installation","name":"installation","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2014-12-09T14:30:43Z","updated_at":"2015-01-14T15:11:48Z","closed_at":null,"body":"thoughtbot has a PGP key, available at http://pgp.thoughtbot.com\r\n\r\nThis key should be used to sign releases, so users can verify what they are downloading."},"comment":{"url":"https://api.github.com/repos/thoughtbot/gitsh/issues/comments/69929901","html_url":"https://github.com/thoughtbot/gitsh/issues/205#issuecomment-69929901","issue_url":"https://api.github.com/repos/thoughtbot/gitsh/issues/205","id":69929901,"user":{"login":"mike-burns","id":4550,"avatar_url":"https://avatars.githubusercontent.com/u/4550?v=3","gravatar_id":"","url":"https://api.github.com/users/mike-burns","html_url":"https://github.com/mike-burns","followers_url":"https://api.github.com/users/mike-burns/followers","following_url":"https://api.github.com/users/mike-burns/following{/other_user}","gists_url":"https://api.github.com/users/mike-burns/gists{/gist_id}","starred_url":"https://api.github.com/users/mike-burns/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mike-burns/subscriptions","organizations_url":"https://api.github.com/users/mike-burns/orgs","repos_url":"https://api.github.com/users/mike-burns/repos","events_url":"https://api.github.com/users/mike-burns/events{/privacy}","received_events_url":"https://api.github.com/users/mike-burns/received_events","type":"User","site_admin":false},"created_at":"2015-01-14T15:11:48Z","updated_at":"2015-01-14T15:11:48Z","body":"I expect most people to install from their package manager, which typically has its own verification mechanism. apt uses PGP with a massive Debian web of trust; OpenBSD uses signify; etc.\r\n\r\nThe people building the package need to verify that they are building based on the correct source and generating the correct checksums, etc."}}