Hi, it would be helpful to harden the chain of trust, if the release announcement mails and the website https://zsh.sourceforge.io/releases.html would contain checksums of the tar.xz. And because the PGP key exists, would it be possible to sign the announcement mail? BTW: Having the key next to the tar is helpful, but if an attacker can change the tar, it can also change the zsh-keyring. Having this file also at https://zsh.sourceforge.io/ would be good. Best regards, Jörg -- Ich halte ihn zwar für einen Schurken und das was er sagt für falsch – aber ich bin bereit mein Leben dafür einzusetzen, daß er seine Meinung sagen kann. (Voltaire)
Attachment:
signature.asc
Description: PGP signature