How does one source pinned translations for reproducible release tarballs?

[kpcyrd]

On 10/1/26 11:21 AM, coordinator at translationproject.org wrote:
> Sorry that I misunderstood.  But... if /you/ want your builds to be
> reproducible, then /you/ should store all the things that are needed
> for that, and not depend on another party.
> 
> If you don't want to pollute your git with dozens of PO files, maybe
> tar them up into a single binary file, commit to git, and extract the
> PO files at build time.

This is essentially what I suggested, but if I were to do this myself and 
code-sign with my own key, it would turn me as "some rando on the internet" into 
the defacto authority over GNU translation files, according to people needing 
both Git inputs and reproducible binaries.

This is why I suggested the GNU project should probably be the owner of this 
signing key.

cheers,
kpcyrd

(sending this again because I was accidentally missing some receivers)