Release manager change doesn't have provenance

[thesamesam]

Hi,

3.5.1 was tagged and has a signature from someone other than tridge, but there isn't sufficient documentation for this.

a584c13 from @steadytao changes NEWS to say:

Zen Dodd (@steadytao) now has release authority as an rsync maintainer.

Now, the same statement appears at https://download.samba.org/pub/rsync/NEWS#3.5.1 below:

Zen Dodd (@steadytao) now has release authority as an rsync maintainer.

But for all I know, it's updated on a cron job. The 3.5.1 release is only signed by @steadytao too.

The website still says Tridge signs releases:

From 3.4.0 and later releases will be signed by Andrew Tridgell. Please fetch the key for andrew@tridgell.net from https://keys.openpgp.org/

I'd really prefer to see a PGP-signed artifact from @tridge saying this so we have some cryptographic provenance saying the handover is okay.

My suggestion is that tridge publish a PGP-signed statement on the mailing list authorising it and perhaps a signed commit modifying the repo saying the same.

Thanks.

[tridge]

@thesamesam thanks for noticing! I've co-signed the asc files on https://rsync.samba.org/

[thesamesam]

Thank you! When you get a chance, could you update https://rsync.samba.org/download.html as well? Not as pressing though.