Huh anyone know about git signing and how I messed up pex re

Question

Huh anyone know about git signing and how I messed up pex release <https github com pantsbuild pex issues 1701> I followed RELEASE rst and used pgp key i use for github amp pants pypi releases

hundreds-father-404 · Answer

Captura de Pantalla 2022 03 31 a la s 1 44 39 p m png

witty-crayon-22786 · Answer

relative to the other releases it looks like maybe the tag isn t signed

witty-crayon-22786 · Answer

can you recreate the tag as signed maybe

hundreds-father-404 · Answer

i ran `git tag sign am Release 2 1 29 v2 1 29` weird

hundreds-father-404 · Answer

why do we use a ``` a annotate Make an unsigned annotated tag object```

witty-crayon-22786 · Answer

hm yea that s sus

hundreds-father-404 · Answer

i gtg but will try to redo this once i figure out how to edit a tag

hundreds-father-404 · Answer

and the implications of that

hundreds-father-404 · Answer

im gonna be out tomorrow if anyone else is able to look into this cc < happy kitchen 89482> < bitter ability 32190> otherwise will look monday

bitter-ability-32190 · Answer

I m out tomorrow and most of the weekend as well

witty-crayon-22786 · Answer

Have good weekends all

hundreds-father-404 · Answer

cc < enough analyst 54434> is the ` a` still correct

hundreds-father-404 · Answer

re your question on TTY env var i had to set that to get the password prompt to sign w my pgp key same prompt i use for pants releases so i dont think thats the culprit

witty-crayon-22786 · Answer

< hundreds father 404> he responded on

hundreds-father-404 · Answer

yay John helped me to figure it out FYI <https github com pantsbuild pex issues 1701 issuecomment 1088053218>

enough-analyst-54434 · Answer

A bit more to do there but this might be something we should require all Pants releasers to set up Working on an Apache project was good for getting you thinking about the OSS ecosystem GitHub not so much Maybe we can even have a key signing party I m still not linked into the web of trust Maybe one of us knows someone

hundreds-father-404 · Answer

That would be great Our pants release docs only mention PGP keys with github And github docs do not mention publishing your key anywhere So I might not be the only one with this issue