Publish your key where the platform can't touch it
If the platform hosting your code also hands out the key that verifies it, the signature proves nothing. Where to publish a public key instead.
Tags
6 pages
Openpgp
The gpg command that hung (so I built signing into the tool)
A gpg call that hung and never returned, and why release signing ended up built into the Go tool itself rather than shelled out to the gpg binary.
Sign your own binaries with go-tool-base, part 4: mint and publish your public key
Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.
Sign your own binaries with go-tool-base, part 1: sign and verify on your laptop
The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.
A signing key that never leaves KMS
Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.
A signature the platform can't forge
A checksum proves the bytes match the manifest, but says nothing about who wrote the manifest. Why self-update needs a signature instead.
