Re: tl26 pretest start

Hi Max,

> Well, that would only ever be required to verify the installer itself,
> since after then, the public key would be verified, so we could use it
> to sign everything else.

That is a different discussion - albeit an interesting idea:
- get whatever key from tug.org (could be signify)
- use that to verify the installer
- use that to verify the downloaded tlpdb shasum (that is necessary,
  the installer package alone is not useful to be signed)
- one of the packages provides the key itself, too (I guess we need
  that for updates?
- install as usual

- tlmgr update uses the same key

That would allow switching to something else, agreed.
And would have the advantage that we could embed the actual key into
tlmgr itself, too.

Maybe for TL2027. Sounds like a nice project.

Best regards

Norbert

--
DI Dr Norbert Preining                        https://www.preining.info
arXiv / Cornell University   +   IFMGA Guide   +   TU Wien  +  TeX Live
GPG: 0x860CDC13   fp: F7D8 A928 26E3 16A1 9FA0 ACF0 6CAC A448 860C DC13