Ian Jackson <ijack...@chiark.greenend.org.uk> writes:
> Ian Jackson writes ("Re: Bug#932753: tag2upload should record git tag signer
> info in .dsc [and 1 more messages]"):
>> Russ Allbery writes ("Bug#932753: tag2upload should record git tag signer
>> info in .dsc [and 1 more messages]"):
>> > Git-Tag-Info: fingerprint=FINGERPRINT
>> > Git-Tag-Tagger: Firstname Surname <email@address>
>>
>> This LGTM if other people like the look.
> It occurs to me based on another conversation I had: should this be in
> .dsc or .changes ?
I personally think it should be in the *.dsc file because that makes it
more visible directly in the archive if we need to track down how a
package was uploaded for some reason. (This is the security engineer in
me talking, probably.) We probably *could* track down the same
information via *.changes and other systems, but I don't see a reason to
not put it in the *.dsc file and conceptually think of it as "replacing"
the current uploader signature on the *.dsc file.
That said, I could be missing some subtlety of why the *.changes file
would be better.
--
Russ Allbery (r...@debian.org) <http://www.eyrie.org/~eagle/>
