signing

A small, standalone module for creating and verifying signatures on files. I pulled it out of go-tool-base so it stays lightweight and anything can use it, not just go-tool-base projects: it's what signs the CLI binaries and the ffmpeg-wasm bundle I distribute. It works through pluggable backends, so the key can live somewhere like AWS KMS rather than on disk, with Google Cloud, Azure and HashiCorp Vault to follow.

Make a tagged release sign itself: record the KMS key and regenerate GoReleaser config with a signs block that calls gtb sign directly.

Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.

Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.

Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.

Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.

The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.

Whoever controls your release page can swap a binary, and a checksum hosted beside it proves nothing. A seven-part guide to signing releases.

Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.

A checksum proves the bytes match the manifest, but says nothing about who wrote the manifest. Why self-update needs a signature instead.

Signed but poisoned packages show a signature proves who sent something, not what is in it. Nobody is coming to clean this up for you.