This repository was archived by the owner on Jul 26, 2026. It is now read-only.
Repository navigation
This repository was archived by the owner on Jul 26, 2026. It is now read-only.
GPG signatures for source validation #36
Description
As we all know, today more than ever before, it is crucial to be able to trust
our computing environments. One of the main difficulties that package
maintainers of Linux distributions face, is the difficulty to verify the
authenticity and the integrity of the source code.
The Arch Linux team would appreciate it if you would provide us GPG signatures
in order to verify easily and quickly your source code releases.
Overview of the required tasks:
- Create and/or use a 4096-bit RSA keypair for the file signing.
- Keep your key secret, use a strong unique passphrase for the key.
- Upload the public key to a key server and publish the full fingerprint.
- Sign every new git commit and tag.
- Create signed compressed (xz --best) release archives
- Upload a strong message digest (sha512) of the archive
- Configure https for your download server
GPGit is meant to bring GPG to the masses.
It is not only a shell script that automates the process of creating new signed
git releases with GPG but also comes with this step-by-step readme guide for
learning how to use GPG.
Additional Information:
- https://github.com/NicoHood/gpgit
- https://help.github.com/categories/gpg/
- https://wiki.archlinux.org/index.php/GnuPG
- https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
- https://www.qubes-os.org/doc/verifying-signatures/
- https://lkml.org/lkml/2016/8/15/445
- https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https
- https://www.enigmail.net/index.php/en/
Thanks in advance.
Activity
Byron commentedon May 28, 2017
@NicoHood Can you please check to what extend these files match your requirements? I have just used
twine upload -s -i <me> dist/*to do produce the signature, and on top of that all my commits are now signed with the same key.NicoHood commentedon Jun 14, 2017
@Byron Thanks for signing the files! You even used SHA512 signatures. Did you set this manually or did GPGit help you? As I remember this is not the default option (default is sha256). But its great, very secure!
Byron commentedon Jun 14, 2017
@NicoHood The signatures are actually created by twine, it deals with all the details. You can see the actual invocation in the makefile, it's '-i ' I think.
Great it works for you, thanks for making the effort to make public sources trustworthy and less exploitable.
NicoHood commentedon Jul 1, 2018
The rebuild of python-smmap failed, as the gpg key was revoked. Can you give me any details about that?
Here is the log: https://rebuilds.foutrelis.com/log/python-smmap.log
NicoHood commentedon Jul 8, 2018
@Byron The issue is important, could you please provide sources with a valid GPG key?
Byron commentedon Jul 15, 2018
Sorry for the late reply. I have published version 2.0.4 to pypi, signed with my most recent key. The previous one was revoked due to a yubikey vulnerability which would have allowed attackers to deduce my private key from the public one.