Blog
Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.
Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.
Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.
Hundreds of malicious package versions across three ecosystems, and the uncomfortable fact that installing one runs arbitrary code.
Ten years on from taking the name: the Boy Scout Rule scales from a function to a team, because it is about intention rather than size.
Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.
The junior developer pipeline is collapsing, and the cause is not the thing everyone is blaming. Who is left when the greybeards retire.
A generated nested command would not compile, and the cause was a scaffolder handing every call the same key regardless of depth.
The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.
Refereeing the memory-safety retrofit argument from someone who ships framework code in both Rust and Go, and likes them for different reasons.
go-tool-base
signing
Orienteering
Soapbox
Campfire
Pioneering
