3 Commits

Author	SHA1	Message	Date
Vladimir Dubrovin	21346cb2ce	Use latest tag in verification example on master	2026-08-21 11:08:11 +03:00
Vladimir Dubrovin	fa43cafd58	Sign packages, publish checksums, attest before upload, narrow permissions ... GPG signing of rpm packages and detached signatures for deb packages and for the SHA256SUMS files, using GPG_PRIVATE_KEY / GPG_PASSPHRASE secrets. Checksums are published as release assets. Build provenance is attested before the assets are uploaded, so a failed attestation does not leave unattested files published. Workflow permissions are read-only, write permissions are requested per job only where they are used.	2026-08-21 11:07:54 +03:00
Vladimir Dubrovin	7eba73fc8f	Create SECURITY.md	2026-08-08 17:29:57 +03:00