https://bugzilla.wikimedia.org/show_bug.cgi?id=62391
--- Comment #1 from Chris Steipp <[email protected]> --- Since we've had a number of conversations around this, let me enumerate the options we've talked about. We probably need to just pick a strategy and try it: 1) The "Jenkins" who does the signing is a private/secured version where we feel comfortable keeping a private key. 2) We put the signing key in an hsm in the datacenter, and make sure someone audits/watches what is being signed. 3) Jenkins signs with a key only to say, "This is what Jenkins built". It's up to someone in the release process to verify and sign the tarballs to assert that someone is pretty sure the tarballs were built correctly. -- You are receiving this mail because: You are on the CC list for the bug. _______________________________________________ Wikibugs-l mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
