--- Comment #1 from Chris Steipp <cste...@wikimedia.org> ---
Since we've had a number of conversations around this, let me enumerate the
options we've talked about. We probably need to just pick a strategy and try
1) The "Jenkins" who does the signing is a private/secured version where we
feel comfortable keeping a private key.
2) We put the signing key in an hsm in the datacenter, and make sure someone
audits/watches what is being signed.
3) Jenkins signs with a key only to say, "This is what Jenkins built". It's up
to someone in the release process to verify and sign the tarballs to assert
that someone is pretty sure the tarballs were built correctly.
You are receiving this mail because:
You are on the CC list for the bug.
Wikibugs-l mailing list