GPG sign single-file .js releases #2728
Assignees
Labels
Comments
Daniel15
added a commit
to Daniel15/yarn-release-infra
that referenced
this issue
Feb 21, 2017
References yarnpkg/yarn#2728 References nodejs/docker-node#243
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Do you want to request a feature or report a bug?
Feature
What is the current behavior?
Out of all the files in the releases (eg. https://github.com/yarnpkg/yarn/releases/tag/v0.20.3), only the tarball and the MSI are signed. The tarball is signed using GPG, and the MSI is signed using an Authenticode certificate. Additionally, the .deb is signed as part of the Debian repo, but the individual file on Github is not signed.
What is the expected behavior?
We should also sign the standalone .js files (
yarn-0.20.3.jsandyarn-legacy-0.20.3.js).The text was updated successfully, but these errors were encountered: