Why Do Developers Continue to Sign with GNUPG
[email protected] Sun, 10 Aug 2025 14:35:20 +0000
| Newsgroups | gmane.linux.debian.devel.security |
|---|---|
| Message-ID | <[email protected]> |
Hello Debian Security Team, Since Debian is a major Linux distribution I want to ask why software developers continue to digitally sign their code an software packages with GNUPG when there are simpler alternatives such as minisign (https://jedisct1.github.io/minisign/), signify, or age (https://github.com/FiloSottile/age). PGP has been criticized for its being difficult to use by other cryptographers: https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ I thank all responses in advance! Best, Tanveer Salim