From b8160ce18b60cd5dfe04ee369f3a8f80dceee0aa Mon Sep 17 00:00:00 2001 From: Philip Withnall Date: Tue, 7 Sep 2021 11:21:12 +0000 Subject: [PATCH] docs: Add a note about git-evtag to SECURITY.md --- SECURITY.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 3505b2abf..e49460a1f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -17,6 +17,17 @@ Under GLib’s versioning scheme, stable release series have an *even* minor component (for example, 2.66.0, 2.66.1, 2.68.3), and development release series have an *odd* minor component (2.67.1, 2.69.0). +## Signed Releases + +The git tags for all releases ≥2.58.0 are signed by a maintainer using +[git-evtag](https://github.com/cgwalters/git-evtag). The maintainer will use +their personal GPG key; there is currently not necessarily a formal chain of +trust for these keys. Please [create an issue](https://gitlab.gnome.org/GNOME/glib/-/issues/new) +if you would like to work on improving this. + +Unsigned releases ≥2.58.0 should not be trusted. Releases prior to 2.58.0 were +not signed. + ## Reporting a Vulnerability If you think you've identified a security issue in GLib, GObject or GIO, please