GPG signature for releases

[nextgens]

Hi,

Could you please GPG sign your releases like roundcube does?
https://roundcube.net/download/#pgp

Thanks!

[mstilkerich]

Hi, I could in principle do that, but I don't really see how to establish trust in the key used to sign. Say I publish the public key ID through the README file or release notes on github, if someone is able to manipulate the releases on github wouldn't they also be able to just change the published key ID to something else? Certainly if users stored/remembered the key on their local machines, it might work, I just wonder how many people would do that.

[nextgens]

I am one of the maintainers of Mailu; I can tell you that we do. We build docker images and we store the keyring in our repository
https://github.com/Mailu/Mailu/blob/master/webmails/Dockerfile#L64

[nextgens]

You could potentially sign commits (or just tags) too using the same key. If you did, github would display something if the signature is valid:
https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification