Signed releases and checksums about treesheets HOT 3 OPEN

I understand the advantages of signing, though currently I have no automatic build system, I infrequently (and not even at the same time) make builds for whatever platform I happen to be on. If and when I have automatic builds or CI, signing can also be considered if that too can be automated.

Until then, the code here on github, not the binaries, are the best version :) I recommend anyone to build from source if they're worried about the binaries.

from treesheets.

As an intermediate solution, would you consider releasing binaries from github itself? You just need to create a release from their web interface and attach the binaries.

Github downloads are over https. So those of us who can trust github and Amazon S3 (and you) can just download the binaries, without a MITM getting a chance to peek or tamper the binary.

Ofcourse, checksumming / signing the binaries would be even better.

from treesheets.

I wouldn't be against releasing on github, though one factor that complicates that is that I tend to make produce binaries independently whenever I am working on any of the 3 platforms. They don't have versions, they are are just whatever commit this happens to be at.

I agree this is all unsatisfactory, but I want to keep things simple while I still make builds manually. The solution would be to of course make builds automatically thru some CI system, but I haven't made time to set that up.

For the moment though, I'd say if you have big security concerns from running TreeSheets, building from source from github is always your best bet.

from treesheets.