signing

A small, standalone module for creating and verifying signatures on files. I pulled it out of go-tool-base so it stays lightweight and anything can use it, not just go-tool-base projects: it's what signs the CLI binaries and the ffmpeg-wasm bundle I distribute. It works through pluggable backends, so the key can live somewhere like AWS KMS rather than on disk, with Google Cloud, Azure and HashiCorp Vault to follow.

If the platform hosting your code also hands out the key that verifies it, the signature proves nothing. Where to publish a public key instead.

Launching sigillum, a standalone artefact signing and verification CLI, and the Rust signing problem that made it necessary.

Where a signing key lives is the most provider-specific decision in the whole business, so the framework deliberately refuses to have an opinion.

A gpg call that hung and never returned, and why release signing ended up built into the Go tool itself rather than shelled out to the gpg binary.

Two new public modules extracting the OpenPGP signing and verification model, so you can use it without adopting the whole framework.

The philosophical end of the signing series: a stolen key and a bought one produce the same signature, and trust has to survive both.

Rotate a release signing key and recover from a bad one without locking users out. Why asymmetric KMS keys have no auto-rotate button.

Make a tagged release sign itself: record the KMS key and regenerate GoReleaser config with a signs block that calls gtb sign directly.

Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.

Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.