Subject: bug#27437: Source downloader accepts X.509 certificate for incorrect domain

From: Ricardo Wurmus <[email-masked]>
Date: Thu, 22 Jun 2017 23:45:26 +0200

Mark H Weaver <[email-masked]> writes:

> FWIW, I always check digital signatures when they're available, and I
> hope that others will as well, but in practice we are putting our faith
> in a large number of contributors, some of whom might not be so careful.

I do the same when signatures are available.  I couldn’t find this
recommendation in “contributing.texi” — should we add it there?

-- 
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net