# Signed tags and git repository

3 messages from 2015-11-25 to 2015-11-26. Participants: Stephen & Linda Smith, Johannes Löthberg.
Thread: https://gitlist.dev/t/40894

## Stephen & Linda Smith, 2015-11-25 23:19

Subject: Signed tags and git repository
Message-ID: <3816223.3lD8Al3iuQ@thunderbird>
URL: https://gitlist.dev/e/3816223.3lD8Al3iuQ%40thunderbird

```
I've been following commits to the linux and git repostitories for some time.   I used signed tags for
projects that I'm working on.   

I know that the linux and git repositories have signed tags, but I'm not able to verify 
them because my key isn't signed by anyone that leads back to one of the git or linux 
maintainers. Of course I live in a technical desert since there seems to be no one that I
can find who lives in Phoenix, AZ that has a relationship to one of those two 
git repositories.

What have others done when they want their keys signed so they can be part of the 
web of trust? Does either of those two projects have a formal way of establishing these
relationships?

sps

```

## Johannes Löthberg, 2015-11-26 03:56

Subject: Re: Signed tags and git repository
Message-ID: <20151126035600.GA11556@zorg.kyriasis.com>
URL: https://gitlist.dev/e/20151126035600.GA11556%40zorg.kyriasis.com
In-Reply-To: <3816223.3lD8Al3iuQ@thunderbird>

```
On 25/11, Stephen & Linda Smith wrote:
>I know that the linux and git repositories have signed tags, but I'm not able to verify
>them because my key isn't signed by anyone that leads back to one of the git or linux
>maintainers.

Your key would only have to be signed for others to be able to verify 
/your/ signatures through the Web of Trust.

You don't even need the Web of Trust though, you can just verify the 
signature and then check that the key used to make the signature is the 
correct one, then you could either sign the key if you know that the key 
belongs to the right person and want to make the signature public, or 
make a local signature which is local to your keyring and won't be sent 
to eg keyservers. Or just mark the key as trusted overall.

-- 
Sincerely,
  Johannes Löthberg
  PGP Key ID: 0x50FB9B273A9D0BB5
  https://theos.kyriasis.com/~kyrias/

```

## Stephen & Linda Smith, 2015-11-26 05:07

Subject: Re: Signed tags and git repository
Message-ID: <3912454.5IyPOB72Zu@thunderbird>
URL: https://gitlist.dev/e/3912454.5IyPOB72Zu%40thunderbird
In-Reply-To: <3816223.3lD8Al3iuQ@thunderbird>

```
On Thursday, November 26, 2015 04:56:00 AM Johannes Löthberg wrote:

> You don't even need the Web of Trust though, you can just verify the 
> signature and then check that the key used to make the signature is the 
> correct one, 

Ok, but if I don't have a link to the Web or Trust, how do I know that "the
key used to make sure the signature is the correct one" (i.e. trusted).

sps

```