# Beta testing rustup.rs **URL:** \ **Category:** Uncategorized\ **Created:** [March 28, 2016, 8:35pm UTC](https://internals.rust-lang.org/t/beta-testing-rustup-rs/3316 "2016-03-28T20:35:42Z")\ **Posts on this page:** 1\ **Showing post:** 206
**Author:** ![brson](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/brson/32/5197_2.png) [@brson](https://internals.rust-lang.org/u/brson)\ **Post date:** [December 16, 2016, 9:31pm UTC](https://internals.rust-lang.org/t/beta-testing-rustup-rs/3316/206 "2016-12-16T21:31:55Z")
Well, no, gpg signing cannot be done for rustup 1.0. It is literally impossible since 1.0 is released. The reason I don’t consider signing a blocker for rustup 1.0 is because the current installers today are not properly verified either, so it is not a degradation in service (although [rustup.sh](http://rustup.sh) will do verification, it does not guarantee it). For those who were manually verifying the signatures of the old installers, that option remains available. I do believe that having proper end to end signing of all Rust artifacts is important, and I wish it was done by now, but it is not simply a matter of applying gpg to the problem. There are some details about the plan in [this thread](https://internals.rust-lang.org/t/future-updates-to-the-rustup-distribution-format/4196). Edit: from re-reading your message @Manish I gather that you would like me to just retroactively publish sigs for these specific files, not generally solve signing for Rust installation. That’s technically possible, but I don’t think it achieves much security-wise. Since rustup itself downloads and installs executables, without verifying those signatures there’s still a bunch of unverified code running on your system. I’m not inclined to make such changes to the release process on the spot. --- _[View the full topic](https://internals.rust-lang.org/t/beta-testing-rustup-rs/3316)._