Sign your own binaries with go-tool-base, part 7: rotation and break-glass
Rotate a release signing key and recover from a bad one without locking users out. Why asymmetric KMS keys have no auto-rotate button.
Tags
8 pages
Gtb-Signing-Tutorial
Sign your own binaries with go-tool-base, part 6: sign every release with GoReleaser
Make a tagged release sign itself: record the KMS key and regenerate GoReleaser config with a signs block that calls gtb sign directly.
Sign your own binaries with go-tool-base, part 5: embed the key and require verification
Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.
Sign your own binaries with go-tool-base, part 4: mint and publish your public key
Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.
Sign your own binaries with go-tool-base, part 3: keyless CI signing with OIDC
Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.
Sign your own binaries with go-tool-base, part 2: a signing key in AWS KMS
Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.
Sign your own binaries with go-tool-base, part 1: sign and verify on your laptop
The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.
Sign your own binaries with go-tool-base
Whoever controls your release page can swap a binary, and a checksum hosted beside it proves nothing. A seven-part guide to signing releases.
