“Where the upstream project publishes OpenPGP signatures of their releases, Fedora packages SHOULD verify that signature as part of the RPM build process.” Most upstreams don’t sign their releases this way, so most Fedora packages don’t need to worry about it. If upstream did provide signatures, they would be published alongside the source archives. > On Feb 26, 2023, at 11:02 AM, Globe Trotter via devel <devel@xxxxxxxxxxxxxxxxxxxxxxx> wrote: > > Hello, > > I have been trying to package slim again. The package does not come with a signature or a gpg key. > > From https://docs.fedoraproject.org/en-US/packaging-guidelines/#_source_file_verification I don't see an option of what to do if there is no signature provided. > > Any suggestions or pointers to where I can get guidance on this? > > Thanks! > _______________________________________________ > devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx > To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
