On 13 Oct 2017, at 10:44, Kambiz Darabi wrote:

Hello,

there are questions from the Debian dev who helps publishing the package about the signing key which is in the debian/ subtree.

Can someone please comment?

Thank you

Kambiz

Hm. Is this because you are grabbing tar balls from there, and Debian would like to see those tar balls signed? I should probably modify the make script for releasing to make a pop signature for the tar balls and upload it.

I don't really have the capability of going back to regenerate and sign the old tar balls I'm afraid. And anyway, I simply won't do it.

I have no idea what key is stored at debian

Cheers, r

----- Forwarded Message ----- From: "Sébastien Villemot" sebastien@debian.org To: "Kambiz Darabi" darabi@m-creations.com Cc: 878167@bugs.debian.org Sent: Friday, 13 October, 2017 5:07:45 PM Subject: Re: Bug#878167: RFS: cl-asdf/3.3.0 - Another System Definition Facility

Also, there is a GPG key under debian/upstream/signing-key.asc, but I see no signature on upstream website (https://common-lisp.net/project/asdf/archives/).

Am I missing something? Or should the key be removed?

Thanks,

-- ⢀⣴⠾⠻⢶⣦⠀ Sébastien Villemot ⣾⠁⢠⠒⠀⣿⡁ Debian Developer ⢿⡄⠘⠷⠚⠋⠀ http://sebastien.villemot.name ⠈⠳⣄⠀⠀⠀⠀ http://www.debian.org