Sign your own binaries with go-tool-base, part 7: rotation and break-glass
Rotate a release signing key and recover from a bad one without locking users out. Why asymmetric KMS keys have no auto-rotate button.
Tags
6 pages
Aws-Kms
Sign your own binaries with go-tool-base, part 6: sign every release with GoReleaser
Make a tagged release sign itself: record the KMS key and regenerate GoReleaser config with a signs block that calls gtb sign directly.
Sign your own binaries with go-tool-base, part 4: mint and publish your public key
Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.
Sign your own binaries with go-tool-base, part 3: keyless CI signing with OIDC
Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.
Sign your own binaries with go-tool-base, part 2: a signing key in AWS KMS
Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.
A signing key that never leaves KMS
Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.
