Git has been using my Long format fingerprint in the tagging messages,
this has been causing the release script to fail on my keys.
It would also be wise to be using the long format on keys based on some
attacks that hack been found in the wild around short keys.
PR-URL: https://github.com/nodejs/node/pull/9258
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
Previously, we were relying on the output of gpg from git tag -v to
verify that the key selected by the releaser is the key that was used
to sign the tag. This output can change depending on the version of git
being used. Now, we just check that the output of git tag -v contains
the key selected.
Fixes: https://github.com/nodejs/node/issues/8822
PR-URL: https://github.com/nodejs/node/pull/8824
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
Myles Borins