Rotating a signing key without breaking self-update
Signing releases is the easy day. Replacing the key you sign with, while every installed copy is still checking against the old one, is a job I went looking for a guide to and couldn't find.
Tags
19 pages
Supply-Chain
The hero gets the bill
AI found a 22-year-old way to own most of the PHP web, and the fix shipped in a day. The bill for being rescued is still landing, and it isn't addressed to the hero.
A good signature in ten minutes
Ten minutes, a throwaway directory and no cloud account, to find out what a release signature actually is before you decide whether you want one in your pipeline.
The builder had been archived for a year
I went looking for reproducible CI images and found the builder had been archived fourteen months earlier. Swapping it out turned out to be the easy part.
Two encrypted emails in twenty years
One of them was from me, testing it. I'd still publish the key, and the reason isn't cryptographic.
The CVE that bumped my dependency for me
Three HIGH advisories deep in a Rust dependency tree, a one-line fix that changed nothing, and eleven minor bumps that were never mine to make.
Publish your key where the platform can't touch it
If the platform hosting your code also hands out the key that verifies it, the signature proves nothing. Where to publish a public key instead.
The marketplace I had to defend from my own attack surface
Opening a public marketplace for agent workflows meant publishing an attack surface, and then having to defend it from my own convenience.
One key, or two?
Launching sigillum, a standalone artefact signing and verification CLI, and the Rust signing problem that made it necessary.
Release trust without the framework
Two new public modules extracting the OpenPGP signing and verification model, so you can use it without adopting the whole framework.
