Newsgroups: php.internals,php.webmaster
Path: news.php.net
Xref: news.php.net php.internals:86706 php.webmaster:21376
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.177 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <557F54BB.4010600@gmail.com>
References: <CADNQb0VcfzJ7U+_2t99vxpdXRSEAeHG98eAdMDB+9EOF0=rAXg@mail.gmail.com>
	<00c501d0a773$f84fee90$e8efcbb0$@belski.net>
	<CADNQb0WOx8mcrmBdofrZ4CqMJHJrdmb6oQnJTQqxmrHYLq5Xqw@mail.gmail.com>
	<557F54BB.4010600@gmail.com>
Date: Tue, 16 Jun 2015 11:29:44 +0200
Message-ID: <CAH-PCH7pjmEmHdbv0BPZ-Gp+CPORApMJ7YvVAgLYQH2bSJSuoA@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Hannes Magnusson <hannes.magnusson@gmail.com>, Anatol Belski <anatol.php@belski.net>, 
	Anatol Belski <ab@php.net>, PHP Development <internals@lists.php.net>, 
	PHP Webmaster ML <php-webmaster@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c34eb4f8481805189f3680
Subject: Re: [PHP-DEV] PHP7 releases vs Windows Sources?
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a11c34eb4f8481805189f3680
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Tue, Jun 16, 2015 at 12:42 AM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> Hi!
>
> > Then this fix doesn't make any sense -- you are saying if I download
> > the .tar.gz and .zip and extract those two, I will have precisely the
> > same sources?
>
> Should be the same sources. We shouldn't distribute anything that isn't
> under the respective tag as official sources, so I assume they are.
> Making them part of the distro may not be a bad idea too, this way they
> can be signed. Of course, signing one more file is 33 to 50% more work,
> but I think RMs can deal with it.
>
>
about signing, recently I got a question that somebody couldn't verify the
tarball signature, because he was trying to verify the extracted contents
instead of the compressed file.
he was trying to do that, because that is how the kernel.org releases are
signed:
https://www.kernel.org/signature.html#using-gnupg-to-verify-kernel-signatur=
es
and they do that because that way you only need one signature for a given
release regardless of the number of compression formats you provide.
maybe this is something what we should consider also.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a11c34eb4f8481805189f3680--