Re: gpg signatures for release tarballs?

[Luiz Henrique de Figueiredo <lhf@...>]

> One thing I do think would be a good idea, though, is to publish a
> non-broken hash (e.g., sha256) instead of just md5 and sha1

We will do this. For the time being, the sha256 checksums are available at
https://www.lua.org/ftp/sha256sum.txt