From: David Bremner <david@tethera.net>
Date: Wed, 13 Feb 2019 02:17:03 +0000 (-0400)
Subject: build: sign tarball instead of sha256sum
X-Git-Tag: archive/debian/0.29_rc0-1~129
X-Git-Url: https://git.notmuchmail.org/git?p=notmuch;a=commitdiff_plain;h=b8a8dbed91d16299a8768646fb6f18181f31ec40

build: sign tarball instead of sha256sum

Adam Majer pointed out in [1] the way were signing releases was
unusual. Neither Carl nor I could think of a good reason for
explicitely signing the checksum (internally of course that's what GPG
is going anyway).

[1] mid:b3fd556d-c346-7af9-a7a2-13b0f3235071@suse.de
---

diff --git a/Makefile.global b/Makefile.global
index cae4c7d1..6e17494a 100644
--- a/Makefile.global
+++ b/Makefile.global
@@ -44,7 +44,7 @@ TAR_FILE=$(PACKAGE)-$(VERSION).tar.gz
 ELPA_FILE:=$(PACKAGE)-emacs-$(ELPA_VERSION).tar
 DEB_TAR_FILE=$(PACKAGE)_$(VERSION).orig.tar.gz
 SHA256_FILE=$(TAR_FILE).sha256
-GPG_FILE=$(SHA256_FILE).asc
+GPG_FILE=$(TAR_FILE).asc
 
 PV_FILE=bindings/python/notmuch/version.py
 
diff --git a/Makefile.local b/Makefile.local
index 82145e1b..01ba49cc 100644
--- a/Makefile.local
+++ b/Makefile.local
@@ -42,8 +42,8 @@ $(TAR_FILE):
 $(SHA256_FILE): $(TAR_FILE)
 	sha256sum $^ > $@
 
-$(GPG_FILE): $(SHA256_FILE)
-	gpg --armor --sign $^
+$(GPG_FILE): $(TAR_FILE)
+	gpg --armor --detach-sign $^
 
 .PHONY: dist
 dist: $(TAR_FILE)