Not currently out of box.
Verifying gpg signatures of source tarballs would be useful. That could be done manually in unpack or prepare hook. But supporting it directly would be useful.
The built packages are signed with rsa signatures. We are looking to support ecdsa / eddsa signatures also. Since the package signatures are essential part of the package manager, having them gpg signed does not make much sense imho.
Next message: Jose-Luis Rivas: "Re: [alpine-devel] abuild signing using GnuPG"
Previous message: Sander Maijers: "[alpine-devel] abuild signing using GnuPG"
Maybe in reply to: Sander Maijers: "[alpine-devel] abuild signing using GnuPG"
Next in thread: Jose-Luis Rivas: "Re: [alpine-devel] abuild signing using GnuPG"
Reply: Jose-Luis Rivas: "Re: [alpine-devel] abuild signing using GnuPG"