Upload release tarball to Github about libssh2 HOT 3 CLOSED

I don't see how I can upload anything there, but you can download the repo as a tarball from there already.

The problem for you to rely on my uploaded tarball via HTTPS on github is that you then haven't verified that the package comes from me. The only way to verify that is to verify the GPG key for the tarball (as I signed the packages immediately after I made them on my local machine). I already provide the signatures on the libssh2.org site. You can probably get a fair certainty level by seeing that it is signed by the same key like the previous releases (that you might trust already).

And no, it is actually not that easy to just transfer the site to github. Or rather, it would require someone to generate the site and then copy it over so that it will continue to adapt to git repo contents - if it were to keep the current setup. Not that bandwidth costs is a particular concern for this little-visited web site.

In fact anyone can verify the package and put it on a HTTPS site. Or make their own. All the code I made the package from is in the git repo. I'm already waaaay behind on work for libssh2, I cannot take on any more.

from libssh2.

You need to be logged in, then click on "edit repository", and then you can add files near the bottom of the form. Only members of the libssh2 organisation can upload files. This ensures that attackers can't intercept and manipulate the binary.

And I believe you misunderstood my other comment; I just meant to say that you could link to the release tarball on Github rather than host it on your server; or even in additition to hosting it on your server. However, since the tarball is only 700kB this probably doesn't pay off. It does pay off if you host larger downloads (for example, since hosting the Postgres.app binary on Github, we save around $100 bandwidth costs for S3 per month).

from libssh2.

1.6.0 is now (also) available here: https://github.com/libssh2/libssh2/releases

from libssh2.