# The signature covers the EXACT BYTES of v1/index.json, and Gitea's raw # endpoint serves the blob verbatim. Any line-ending rewrite -- a Windows # checkout with core.autocrlf, an editor that "helpfully" normalises -- would # change those bytes and invalidate a signature that is otherwise perfectly # good, producing a failure that looks like tampering and is not. # # Force LF everywhere, and pin the two published files explicitly. * text=auto eol=lf v1/index.json text eol=lf v1/index.json.sig text eol=lf