We need the ability to sign tarballs automatically. Using this ticket to track what needs to be done and by whome. Assigning to Antoine for now since he is the Jenkins guy.
Version: unspecified
Severity: normal
We need the ability to sign tarballs automatically. Using this ticket to track what needs to be done and by whome. Assigning to Antoine for now since he is the Jenkins guy.
Version: unspecified
Severity: normal
Since we've had a number of conversations around this, let me enumerate the options we've talked about. We probably need to just pick a strategy and try it:
I do not have any free time in March to handle release tarballs / securing Jenkins. If someone else can take the lead there that would be much appreciated. We can most probably use a private Jenkins server for ops/analytics/mw tarball usage. They all have the same need apparently.
This has been going for 2+ years now. The context was to automatically build the tarballs from Jenkins. If we wanted to achieve this we would most probably need a dedicated Jenkins instance to handle it.
The MediaWiki releases are now handled by Release-Engineering-Team and we produce / sign them manually.
Hence this task is essentially moot: we will not bother making the signing automatic.
Yeah, and just for more context: to do this right we'd need support from Chris S and the Security team, which we won't get for a while anyways. It's just not a priority right now (with my personal FLOSS project health hat on, I wish it were).