Commits on Mar 20, 2023

1. Remove GPG signature support …

   This is a breaking change: the gpg config settings, variables, and
   related cli commands are all removed.
   
   Fixes: rust-lang#3250 by removing our GPG support.
   
   - the foundation's new security engineer Walter Pearce is working on a
     new system, not based around GPG, for validation of distributions
   - we don't rely on the signatures today - these warnings are not errors
     by default
   - sustained ignored, unfixable signature errors will teach folk to
     ignore them, which is harmful to everyone
   - we could do streaming unpacking (with some changes) if we trust the
     transport rather than the current monolithic signature validation,
     which could improve performance
   
   Downloads still have a checksum which is verified.

   

   rbtcollins committed Mar 20, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 5716902
   • Browse repository at this point

   Copy the full SHA

   5716902 View commit details

   Browse the repository at this point in the history