To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.

BatConf releases are signed with GPG. Verify downloaded artifacts against the detached .asc signatures attached to each GitHub Release, and verify the vX.Y.Z git tag with git tag -v vX.Y.Z.

Each maintainer who cuts releases signs with their own key. The canonical list of authorized signing keys is the KEYS file at the repository root. Import it once, then verify:

gpg --import KEYS
git tag -v vX.Y.Z
gpg --verify batconf-X.Y.Z.tar.gz.asc batconf-X.Y.Z.tar.gz

Authorized signers (see KEYS for the full public keys):

The keys are also mirrored to a keyserver for convenience:

gpg --keyserver keys.openpgp.org --recv-keys {FINGERPRINT}