Re: Checksums in release announcements and website

On Wed 3 Jun 2026, at 07:07, Jörg Sommer wrote:
> it would be helpful to harden the chain of trust, if the release
> announcement mails and the website https://zsh.sourceforge.io/releases.html
> would contain checksums of the tar.xz.

oliver mentioned in w/54389 that the check sums are meant for integrity
verification, not security. but i'd be ok with this personally

On Wed 3 Jun 2026, at 07:07, Jörg Sommer wrote:
> And because the PGP key exists, would it be possible to sign the
> announcement mail?

i don't have any experience pgp-signing e-mails myself, so not sure how
much friction it would add, but maybe

On Wed 3 Jun 2026, at 07:07, Jörg Sommer wrote:
> BTW: Having the key next to the tar is helpful, but if an attacker can
> change the tar, it can also change the zsh-keyring. Having this file also at
> https://zsh.sourceforge.io/ would be good.

as part of the release process the artefacts are uploaded to these two
locations:

  https://sourceforge.net/projects/zsh/files/
  https://zsh.org/pub/

these are completely independent services, so if you're worried you
could cross-reference them. i guess a compromise of both is possible via
a dev's ssh key/agent though

sf also independently calculates its own check sums (click the little
'info' icon). but it doesn't seem to do sha-256

dana