Hello, On Fri 14 Jun 2024 at 06:06pm GMT, Scott Kitterman wrote:
> > I'm a bit confused by the claim that no infrastructure changes are needed for > this to go forward. > > If I have been following the proposal correctly, source packages will be > signed by tag2upload and not the uploader. Doesn't that mean changes are > going to be needed so that we know in the archive who uploaded the package? > Ah, do you mean how tracker.d.o shows (signed by: f...@bar.org) for a sponsored upload? -- Sean Whitton