-
Notifications
You must be signed in to change notification settings - Fork 723
Closed
Labels
Description
It seems that releases are signed with a different key depending on who the release manager is. Is there a central place where I can go to see which key should be used to check a release's signature?
I'm asking in the context of https://github.com/haskell/docker-haskell/pull/159/files, where I don't know how to validate the choice of signing keys.
(I could also ask that Cabal use a single signing key for all releases, which is common practice in some places. But I know it would take some infrastructure work to figure out how to share access to release managers in a trusted, time-bound way.)