Closed hv15 closed 1 year ago
Hey! Thanks, this is something I overlooked to document as these signatures are right now mainly verified in our own package builders.
Thanks a lot for updating your AUR packages (and so quickly!). The keys have just been uploaded here https://github.com/eduvpn/eduvpn-common/tree/main/keys, maybe you can then push the GPG key within the AUR packages (or hardcode it in the pkgbuild?) so that you immediately notice if it has changed.
They are available on external sources too (so that this repo is not a single source of truth), e.g. https://app.eduvpn.org/linux/v4/deb/app+linux@eduvpn.org.asc and https://git.sr.ht/~jwijenbergh/python3-eduvpn-common.rpm/tree/main/item/SOURCES/minisign-CA9409316AC93C07.pub.
Keyservers is possible, but also not the most secure way.
Apologies for replying so late, I did not get a notification for some reason.
I will make sure this is all better documented
Hi @jwijenbergh, no worries! Thank you for uploading the keys and also pointing to alternative urls. Do you know if this key will be used for the other eduvpn packages?
This was the plan indeed, I have just released a tiny hotfix release on the linux client that fixes 2 issues. These tarballs are also signed with the same keys https://github.com/eduvpn/python-eduvpn-client/releases/tag/4.0.1
Thank you! I've updated the archlinux packages!
Thank you! I've updated the archlinux packages!
Thanks a ton for your hard work!
@hv15 Sorry to contact you. Could you add -tags=release
to the python eduvpn-common AUR package in GOFLAGS
. I made a short document describing release building here https://eduvpn.github.io/eduvpn-common/gettingstarted/building/release.html
Maybe I should add a makefile target that adds this flag :)
This ensures the list of servers is also embedded in the shared library in case the discovery server is offline
Thank you! New release pushed!
Thanks!
Hi, I've packaged this for ArchLinux and noticed that the PGP detached signature for the release 1.0.0 uses a public key (0x02BB8048BBFF222C) that isn't published on the major key servers. Is the public key located somewhere public? Thanks!