Improving Geographical Resilience For Distributed Open Source Teams with FREON
12 points by orib
12 points by orib
If I understand correctly, this is useful for hard-to-compile (or non-reproducible) binary releases. The release team can sign the release, without any single member being able to sign alone.
If the build is easy to compile and reproducible, then it might be better for many individuals to sign their own release (which should be bit-for-bit identical). Or did I miss something?