signing

A small, standalone module for creating and verifying signatures on files. I pulled it out of go-tool-base so it stays lightweight and anything can use it, not just go-tool-base projects: it's what signs the CLI binaries and the ffmpeg-wasm bundle I distribute. It works through pluggable backends, so the key can live somewhere like AWS KMS rather than on disk, with Google Cloud, Azure and HashiCorp Vault to follow.

Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.

Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.

The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.

Whoever controls your release page can swap a binary, and a checksum hosted beside it proves nothing. A seven-part guide to signing releases.

Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.

A checksum proves the bytes match the manifest, but says nothing about who wrote the manifest. Why self-update needs a signature instead.

Signed but poisoned packages show a signature proves who sent something, not what is in it. Nobody is coming to clean this up for you.