GPG public key used to sign release artifacts

[tenthirtyam]

Code of Conduct

• I have read and agree to the Code of Conduct.
• Vote on this issue by adding a 👍 reaction to the original issue description to help the maintainers prioritize.
• Do not leave "+1" or other comments that do not add relevant information or questions.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

Detail

Note

Cloning https://github.com/vmware/packer-plugin-vsphere/issues/747 by @HorlogeSkynet.

Dear maintainers,

Since transfer of ownership from Hashicorp -> Broadcom and the release of v2.0.0+, the GPG key used to sign artifacts has changed. We couldn't find a way to retrieve the new one across project documentation.

Would it be possible to publish somewhere the public key (or at least its fingerprint) to allow proper* assets signature verification?

Thanks for your time and your work,
Bye 👋

Suggestion

No response

[tenthirtyam]

Whilst we wait to publish this in the documentation, users can obtain the public key used to sign releases v2.0.0 and later (post-transfer from HashiCorp to Broadcom) at https://keys.openpgp.org under oss-packer-plugins.pdl@broadcom.com.

Ryan Johnson, Broadcom