threads / discuss / 40894

Signed tags and git repository

Subject: Signed tags and git repository

## tl;dr

3 messages between Nov 25, 2015 and Nov 26, 2015.

replies: 2people: 2as markdown or json

Stephen & Linda Smith· Nov 25, 2015, 23:19 UTC · lore

I've been following commits to the linux and git repostitories for some time. I used signed tags for projects that I'm working on.

I know that the linux and git repositories have signed tags, but I'm not able to verify them because my key isn't signed by anyone that leads back to one of the git or linux maintainers. Of course I live in a technical desert since there seems to be no one that I can find who lives in Phoenix, AZ that has a relationship to one of those two git repositories.

What have others done when they want their keys signed so they can be part of the web of trust? Does either of those two projects have a formal way of establishing these relationships?

sps

Johannes Löthberg· Nov 26, 2015, 03:56 UTC · re: Stephen & Linda Smith · lore

Re: Signed tags and git repository

On 25/11, Stephen & Linda Smith wrote:

>I know that the linux and git repositories have signed tags, but I'm not able to verify
>them because my key isn't signed by anyone that leads back to one of the git or linux
>maintainers.

Your key would only have to be signed for others to be able to verify /your/ signatures through the Web of Trust.

You don't even need the Web of Trust though, you can just verify the signature and then check that the key used to make the signature is the correct one, then you could either sign the key if you know that the key belongs to the right person and want to make the signature public, or make a local signature which is local to your keyring and won't be sent to eg keyservers. Or just mark the key as trusted overall.

-- 
Sincerely,
  Johannes Löthberg
  PGP Key ID: 0x50FB9B273A9D0BB5
  https://theos.kyriasis.com/~kyrias/

Stephen & Linda Smith· Nov 26, 2015, 05:07 UTC · re: Stephen & Linda Smith · lore

Re: Signed tags and git repository

On Thursday, November 26, 2015 04:56:00 AM Johannes Löthberg wrote:

> You don't even need the Web of Trust though, you can just verify the 
> signature and then check that the key used to make the signature is the 
> correct one,

Ok, but if I don't have a link to the Web or Trust, how do I know that "the key used to make sure the signature is the correct one" (i.e. trusted).

sps