Bug#982562: general: Storing upstream signatures next to upstream tarballs is problematic
On Thu, Feb 11, 2021 at 09:59:42PM +0100, Raphaël Hertzog wrote:
> Those files are not really meant to be immutable:
> - signing keys can expire and be revoked, upstream might want to update
> signatures of already released tarballs
> - the set of "upstream release managers" might evolve over time and the
> official signature to use might change...
>
As far as we're concerned they are immutable, they are the signature of
the tarball at the time that tarball was uploaded to debian. There's no
reason for that to change without the tarball itself changing, at which
point both filenames change.
Cheers,
Julien
Reply to: