-
Notifications
You must be signed in to change notification settings - Fork 21.4k
Closed
Description
From Thomas Ptacek (https://latacora.singles/2019/07/16/the-pgp-problem.html ) :
Signing Packages
Use Signify/Minisign. Ted Unangst will tell you all about it. It’s what OpenBSD uses to sign packages. It’s extremely simple and uses modern signing. Minisign, from Frank Denis, the libsodium guy, brings the same design to Windows and macOS; it has bindings for Go, Rust, Python, Javascript, and .NET; it’s even compatible with Signify.
About minisign: https://jedisct1.github.io/minisign/
Minisign is compatible with signify
used by OpenBSD
The todo's would be:
- Make some dummy key and make available to builders
- Make the builders generate the signature file, based off the dummy key
- Swap to a real key, publish pub sig on download page