Skip to content

How to verify which signing key to use #11245

@chreekat

Description

@chreekat

It seems that releases are signed with a different key depending on who the release manager is. Is there a central place where I can go to see which key should be used to check a release's signature?

I'm asking in the context of https://github.com/haskell/docker-haskell/pull/159/files, where I don't know how to validate the choice of signing keys.

(I could also ask that Cabal use a single signing key for all releases, which is common practice in some places. But I know it would take some infrastructure work to figure out how to share access to release managers in a trusted, time-bound way.)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions