Rotating a signing key without breaking self-update
Signing releases is the easy day. Replacing the key you sign with, while every installed copy is still checking against the old one, is a job I went looking for a guide to and couldn't find.
Categories
20 pages
signing
A small, standalone module for creating and verifying signatures on files. I pulled it out of go-tool-base so it stays lightweight and anything can use it, not just go-tool-base projects: it's what signs the CLI binaries and the ffmpeg-wasm bundle I distribute. It works through pluggable backends, so the key can live somewhere like AWS KMS rather than on disk, with Google Cloud, Azure and HashiCorp Vault to follow.
Read the report without ever holding the key
Publish an OpenPGP certificate a researcher can encrypt to, and read what they send, without a private key ever existing in your process.
A good signature in ten minutes
Ten minutes, a throwaway directory and no cloud account, to find out what a release signature actually is before you decide whether you want one in your pipeline.
Publish your key where the platform can't touch it
If the platform hosting your code also hands out the key that verifies it, the signature proves nothing. Where to publish a public key instead.
One key, or two?
Launching sigillum, a standalone artefact signing and verification CLI, and the Rust signing problem that made it necessary.
The framework doesn't know where your signing key lives
Where a signing key lives is the most provider-specific decision in the whole business, so the framework deliberately refuses to have an opinion.
The gpg command that hung (so I built signing into the tool)
A gpg call that hung and never returned, and why release signing ended up built into the Go tool itself rather than shelled out to the gpg binary.
Release trust without the framework
Two new public modules extracting the OpenPGP signing and verification model, so you can use it without adopting the whole framework.
Bought, not stolen
The philosophical end of the signing series: a stolen key and a bought one produce the same signature, and trust has to survive both.
Sign your own binaries with go-tool-base, part 7: rotation and break-glass
Rotate a release signing key and recover from a bad one without locking users out. Why asymmetric KMS keys have no auto-rotate button.
