Signing tagged code-points

[miroR]

It may be my lack of understanding, so pls. correct me if I'm wrong, but...
But, looking at:
https://github.com/MoonchildProductions/Pale-Moon/tags
I don't see that any tags are PGP signed.

A feature that I for one, and I'm sure other users who are aware of the protection that PGP-signing gives against MiTM attacks, sorely miss.
I see, from among the 76 contributors, the one whose brainchild the project of Pale Moon is (or if I'm allowed to call it in one word: Palemoon), has a few keys (and I'm glad it likely reveals the man of the Palemoon fame )...

that the main developer [as likely this is him] has his keys listed:
https://sks-keyservers.net/pks/lookup?o ... =wolfbeast

If I'm correct that the tags are not signed, will you please consider starting to sign them in the future?

If I am not right, and Palemoon tagged releases are PGP-signed, how come I don't see the tags, such as here it says that they should show:
https://help.github.com/articles/checki ... on-status/
(
If they should show, but also other users who read here can't see them, I can open an issue at:
https://github.com/MoonchildProductions ... oon/issues
)

Sincere regards!

Note: The only other topic related to PGP-signing I found at:
GPG/PGP Key for trava90
viewtopic.php?f=37&t=10161
but neither could I see any tags, or commits, verifiable at:
https://github.com/MoonchildProductions ... -installer
(
which I do not directly use, I use Gentoo Overlay unofficial:
https://github.com/deuiore/palemoon-overlay
which uses
https://github.com/MoonchildProductions/Pale-Moon/ repo and git packs from it for installation, but neither is the palemoon-overlay PGP-signed --TBH, nothing in Gentoo git is signed for users' verification...
)

[Moonchild]

Tags are tags. Tags aren't signed because they are simply tagged commits in the repo. You can't sign that.

EDIT:
If you're looking for PGP signatures on binaries and source tree snapshots, you have only to actually look at the product website.
As an aside, none of the keys you searched for are used for Pale Moon. More info about the keys: viewtopic.php?f=1&t=7176
Linux binaries are signed by our Linux maintainer, see linux.palemoon.org.

Even so, that doesn't take away the fact that the archives GitHub creates for any tag in the git repo on-the-fly will not, ever, be signed that way.

I have to wonder though.. why on earth are you concerned about an MitM attack on tagged-source archives? What would be the practical use of that? For the few people who grab the source code from tagged releases to build on their own machine? XD There are honestly much easier ways to try and attack someone.

Also, splitting this discussion off into its own thread. It doesn't really belong with this announcement.

[miroR]

Tags are tags. Tags aren't signed because they are simply tagged commits in the repo. You can't sign that.

EDIT:
If you're looking for PGP signatures on binaries and source tree snapshots, you have only to actually look at the product website.
As an aside, none of the keys you searched for are used for Pale Moon. More info about the keys: viewtopic.php?f=1&t=7176
Linux binaries are signed by our Linux maintainer, see linux.palemoon.org.

Even so, that doesn't take away the fact that the archives GitHub creates for any tag in the git repo on-the-fly will not, ever, be signed that way.

I have to wonder though.. why on earth are you concerned about an MitM attack on tagged-source archives? What would be the practical use of that? For the few people who grab the source code from tagged releases to build on their own machine? XD There are honestly much easier ways to try and attack someone.

Also, splitting this discussion off into its own thread. It doesn't really belong with this announcement.

Thank you for your kind, and exhaustive, reply!

I'm actually not very advanced, and I will need a little time (also: once I find it, I'm busy with other matters right now), to fully understand it.

But I'm sure it's very usuful, as is your brainchild such a fine browser !