{"action":"created","issue":{"url":"https://api.github.com/repos/gorhill/uBlock/issues/2027","repository_url":"https://api.github.com/repos/gorhill/uBlock","labels_url":"https://api.github.com/repos/gorhill/uBlock/issues/2027/labels{/name}","comments_url":"https://api.github.com/repos/gorhill/uBlock/issues/2027/comments","events_url":"https://api.github.com/repos/gorhill/uBlock/issues/2027/events","html_url":"https://github.com/gorhill/uBlock/issues/2027","id":179077541,"number":2027,"title":"Adding checksums/signatures to github.com/gorhill/uBlock/releases ?","user":{"login":"acrobat1","id":1692349,"avatar_url":"https://avatars0.githubusercontent.com/u/1692349?v=4","gravatar_id":"","url":"https://api.github.com/users/acrobat1","html_url":"https://github.com/acrobat1","followers_url":"https://api.github.com/users/acrobat1/followers","following_url":"https://api.github.com/users/acrobat1/following{/other_user}","gists_url":"https://api.github.com/users/acrobat1/gists{/gist_id}","starred_url":"https://api.github.com/users/acrobat1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/acrobat1/subscriptions","organizations_url":"https://api.github.com/users/acrobat1/orgs","repos_url":"https://api.github.com/users/acrobat1/repos","events_url":"https://api.github.com/users/acrobat1/events{/privacy}","received_events_url":"https://api.github.com/users/acrobat1/received_events","type":"User","site_admin":false},"labels":[{"id":194717570,"url":"https://api.github.com/repos/gorhill/uBlock/labels/wontfix","name":"wontfix","color":"ffffff","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-09-25T09:38:59Z","updated_at":"2017-09-19T20:32:01Z","closed_at":"2017-09-19T20:32:01Z","author_association":"NONE","body":"Have you considered adding SHA checksums , or (even better) signatures to the downloads page https://github.com/gorhill/uBlock/releases ?\n\nUnless I missed something, I can't find any way to verify the .xpi files on that page : I realize that this may be yet another chore for you, but in light of what recently happened to the official Mozilla server (vulnerabilty to MITM intrusion), people may eventually want to download extensions from somewhere else, if nothing to double-check an extension.\n\nI don't know if this is feasible for you, but having signed hashes of the .xpi files or (alternatively) having detached signatures for them, would IMO increase security (within the limits of the public key scheme, but still better than nothing..).\nThanks.\n"},"comment":{"url":"https://api.github.com/repos/gorhill/uBlock/issues/comments/330664529","html_url":"https://github.com/gorhill/uBlock/issues/2027#issuecomment-330664529","issue_url":"https://api.github.com/repos/gorhill/uBlock/issues/2027","id":330664529,"user":{"login":"gorhill","id":585534,"avatar_url":"https://avatars2.githubusercontent.com/u/585534?v=4","gravatar_id":"","url":"https://api.github.com/users/gorhill","html_url":"https://github.com/gorhill","followers_url":"https://api.github.com/users/gorhill/followers","following_url":"https://api.github.com/users/gorhill/following{/other_user}","gists_url":"https://api.github.com/users/gorhill/gists{/gist_id}","starred_url":"https://api.github.com/users/gorhill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gorhill/subscriptions","organizations_url":"https://api.github.com/users/gorhill/orgs","repos_url":"https://api.github.com/users/gorhill/repos","events_url":"https://api.github.com/users/gorhill/events{/privacy}","received_events_url":"https://api.github.com/users/gorhill/received_events","type":"User","site_admin":false},"created_at":"2017-09-19T20:32:01Z","updated_at":"2017-09-19T20:32:01Z","author_association":"OWNER","body":"@Snapy The request here is for me to provide signatures for the binaries.\r\n\r\nBut I won't go back to manually build and publish the binaries, this is too much time consuming. So I will close this issue instead of letting it linger without ever resolving it. Whoever does not trust the binaries put in there by Travis build process, I suggest you locally simply clone the repo and build your own binaries."}}
{"actor":{"display_login":"gorhill"}}