Suggestion: github releases

[Phil Mayers]

On 17/07/2017 15:08, Alan DeKok wrote:

> It works for me from all networks I have access to.

Hmm. Ok, so wget is working for me now, but a colleague had this:

$ wget 
ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.15.tar.bz2
--2017-07-17 14:48:30-- 
ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.15.tar.bz2
            => `freeradius-server-3.0.15.tar.bz2'
Resolving ftp.freeradius.org... 62.210.29.29
Connecting to ftp.freeradius.org|62.210.29.29|:21... connected.
Logging in as anonymous ...
Login incorrect.

...at about 14:49 BST.

I've no idea what's going on with lftp. Sigh, never mind.

> I just pushed that.

Indeed, just spotted it - many thanks.

> The issue is then the distribution isn't signed...

Ah. I think it's possible to generate the GPG sig locally after the 
tarball has been generated (and verified of course...) and then insert 
it into the release, but that is a bit of a faff I guess.

It's a shame there isn't some workflow here where the developer could 
sign a tag, then GH build a tarball of the signed tag, and sign the 
tarball with some kind of per-project key. Oh well.