sindresorhus
Sign git tags
Description
Right now, np publishes Git tags unsigned. You have to manually update the tag using --force and then force-push the updated tag to the repository in order to fix it.
Implementation
Signed Git tag could be created like this: git tag -s v1.0.0.
As a workaround Git could be configured to sign all tags automatically: git config --global tag.gpgSign true
Sounds interesting to me. Its an easy fix, and might be useful for multiple people.
@sindresorhus , thoughts on this?
I would prefer if this just worked. I guess we could run npm version internally with the https://docs.npmjs.com/cli/v7/commands/npm-version#sign-git-tag config and then without if it fails. (We don't actually execute git tag directly, but rather npm version)
This also needs https://github.com/sindresorhus/np/pull/618.
True, we need to support GPG passwords for this to work. We'll wait for #618 before picking this up.
