# Tarball signatures
**URL:** https://discuss.tryton.org/t/tarball-signatures/7204
**Category:** System Administrator
**Created:** [April 18, 2024, 8:03am UTC](https://discuss.tryton.org/t/tarball-signatures/7204 "2024-04-18T08:03:55Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@yangoon](https://discuss.tryton.org/u/yangoon)
#### Post date: [April 18, 2024, 8:03am UTC](https://discuss.tryton.org/t/tarball-signatures/7204/1 "2024-04-18T08:03:55Z")
Since 2024-Feb-15 the [released tarballs](https://downloads.tryton.org/6.0/?C=M&O=A) are no more signed. Is it by accident or on purpose?
---
### Author:  [@coogor](https://discuss.tryton.org/u/coogor)
#### Post date: [April 18, 2024, 8:14am UTC](https://discuss.tryton.org/t/tarball-signatures/7204/2 "2024-04-18T08:14:23Z")
Looks like the cdn is not up-to-date yet?
docb@X1E:~/buildservice/Application:ERP:Tryton:6.0/trytond\>wget [http://downloads.tryton.org/6.0/trytond-6.0.45.tar.gz.asc](http://downloads.tryton.org/6.0/trytond-6.0.45.tar.gz.asc)
URL transformed to HTTPS due to an HSTS policy
–2024-04-18 10:12:38-- [https://downloads.tryton.org/6.0/trytond-6.0.45.tar.gz.asc](https://downloads.tryton.org/6.0/trytond-6.0.45.tar.gz.asc)
Resolving [downloads.tryton.org](http://downloads.tryton.org) ([downloads.tryton.org](http://downloads.tryton.org))… 37.59.44.187, 2001:41d0:8:67bb::1
Connecting to [downloads.tryton.org](http://downloads.tryton.org) ([downloads.tryton.org](http://downloads.tryton.org))|37.59.44.187|:443… connected.
HTTP request sent, awaiting response… 307 Temporary Redirect
Location: [https://downloads-cdn.tryton.org/6.0/trytond-6.0.45.tar.gz.asc](https://downloads-cdn.tryton.org/6.0/trytond-6.0.45.tar.gz.asc) [following]
–2024-04-18 10:12:38-- [https://downloads-cdn.tryton.org/6.0/trytond-6.0.45.tar.gz.asc](https://downloads-cdn.tryton.org/6.0/trytond-6.0.45.tar.gz.asc)
Resolving [downloads-cdn.tryton.org](http://downloads-cdn.tryton.org) ([downloads-cdn.tryton.org](http://downloads-cdn.tryton.org))… 185.172.149.103, 2a0b:4d07:102::1
Connecting to [downloads-cdn.tryton.org](http://downloads-cdn.tryton.org) ([downloads-cdn.tryton.org](http://downloads-cdn.tryton.org))|185.172.149.103|:443… connected.
HTTP request sent, awaiting response… 404 Not Found
2024-04-18 10:12:38 ERROR 404: Not Found.
---
### Author:  [@coogor](https://discuss.tryton.org/u/coogor)
#### Post date: [April 18, 2024, 8:35am UTC](https://discuss.tryton.org/t/tarball-signatures/7204/3 "2024-04-18T08:35:36Z")
OK, that explains, but does not answer WHY signatures are removed
---
### Author:  [@yangoon](https://discuss.tryton.org/u/yangoon)
#### Post date: [April 19, 2024, 7:22am UTC](https://discuss.tryton.org/t/tarball-signatures/7204/4 "2024-04-19T07:22:55Z")
Friendly ping.
What is the stance of the project/maintainer on this topic?
Especially in the light of the recent [xz backdoor](https://www.openwall.com/lists/oss-security/2024/03/29/4) signed tarballs or commits are at least one item in the chain of trust. Without signed tarballs anyone in control of [downloads.tryton.org](https://downloads.tryton.org/) could submit malicious content, while with signed tarballs additionally the key of the release manager would have to be compromised.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [April 20, 2024, 12:59pm UTC](https://discuss.tryton.org/t/tarball-signatures/7204/5 "2024-04-20T12:59:58Z")
See [Remove GPG signature of released package (b5480ec0bbc8) · Commits · Tryton / Tools / Maintenance · GitLab](https://foss.heptapod.net/tryton/tools/maintenance/-/commit/b5480ec0bbc8f9df64076a4f8dc77605ec642d4b) and [Cryptographically sign source releases](https://discuss.tryton.org/t/cryptographically-sign-source-releases/7220)