On Tue, Sep 18, 2012 at 01:37:54PM -0000, linux-pam wrote: > #11: sign the released tarballs > ---------------------+------------------------------ > Reporter: vbatts | Owner: pam-developers@… > Type: defect | Status: new > Priority: major | Component: library > Version: | Keywords: > Blocked By: | Blocking: > ---------------------+------------------------------ > Previously the tarballs that landed on kernel.org were signed by the > trusted key 0x517D0F0E, but now the tarballs on > https://fedorahosted.org/releases/l/i/linux-pam/ have no signature at all. > We not be using Linux-PAM source that does not have a trusted signature. Well, there is a problem indeed. Tarballs for 1.1.6 release seems to be not yet signed. The last signed tarball at http://www.linux-pam.org/library/ is 1.1.5, and https://fedorahosted.org/releases/l/i/linux-pam/ contains no signatures at all.