On 10/1/26 11:21 AM, [email protected] wrote:
Sorry that I misunderstood. But... if /you/ want your builds to be
reproducible, then /you/ should store all the things that are needed
for that, and not depend on another party.
If you don't want to pollute your git with dozens of PO files, maybe
tar them up into a single binary file, commit to git, and extract the
PO files at build time.
This is essentially what I suggested, but if I were to do this myself and
code-sign with my own key, it would turn me as "some rando on the internet" into
the defacto authority over GNU translation files, according to people needing
both Git inputs and reproducible binaries.
This is why I suggested the GNU project should probably be the owner of this
signing key.
cheers,
kpcyrd
(sending this again because I was accidentally missing some receivers)
