Brion Vibber wrote:
Looks like Tim forgot to update the GPG signature files when he re-issued the release; we'll make sure they get re-done. The file checksums match, so we're good for now. :)
It takes about 10 minutes to upload all the files for a release. I didn't want to wait that long, so I generated them on zwinger instead, where I don't have a GPG key.
Maybe we could just serve the uploads via HTTPS and quit this mucking around with hashes and GPG. Hardly anyone checks them anyway.
-- Tim Starling