Rotating a signing key without breaking self-update
Signing releases is the easy day. Replacing the key you sign with, while every installed copy is still checking against the old one, is a job I went looking for a guide to and couldn't find.
Tags
5 pages
Signing
My reason for hand-rolling it was wrong
I wrote my own OpenPGP packet code, then deleted the lot to prove I needed it. The reason I'd given turned out to be nonsense, and there was a better one waiting for me.
A good signature in ten minutes
Ten minutes, a throwaway directory and no cloud account, to find out what a release signature actually is before you decide whether you want one in your pipeline.
Two encrypted emails in twenty years
One of them was from me, testing it. I'd still publish the key, and the reason isn't cryptographic.
One key, or two?
Launching sigillum, a standalone artefact signing and verification CLI, and the Rust signing problem that made it necessary.
