Re: Ghostscript and GhostPDL 9.19 release

On 24/03/16 17:27, Jonas Smedegaard wrote:
> Quoting Chris Liddell (2016-03-23 15:37:25)
>> I've added the files, but I was contemplating doing away with them,
>> since we moved to github as the download server.....
>>
>> Anyone any thoughts on that?
>
> I wonder why you don't use github's mechanism to tag releases as such,
> instead of (seemingly) rolling your own tarballs pushed as git blobs
> completely independent from the development git.

Well, if you note, our git for the source isn't hosted on github, and 
the consensus when we discussed it (which I agree with) is that, given 
we have a dual license setup (so there is a commercial "arm" involved), 
it is better to retain our own server as the canonical git server.

> And while at it: No matter how you roll your tarballs, I dearly
> recommend you to GPG-sign the release tarball, released anASCII-armoured
> .asc file either next to the tarball or (e.g. if switching to
> github-style tagged releases and that does not permit you to provide
> them aside) separately e.g. at your own website..

I've been reluctant to do that because, frankly, it just means more work 
for me for, I reckoned, not much benefit. Plus, I was bothered about 
adding another "dependency" for those wanting to build Ghostscript. But 
now we're using github, where we have less control of the downloads, 
it's possibly something to reconsider.

Chris