GPG signatures for source validation

[NicoHood]

As we all know, today more than ever before, it is crucial to be able to trust our computing environments. One of the main difficulties that package maintainers of Linux distributions face, is the difficulty to verify the authenticity and the integrity of the source code.

The Arch Linux team would appreciate it if you would provide us GPG signatures in order to verify easily and quickly your source code releases.

Overview of the required tasks:

• Create and/or use a 4096-bit RSA keypair for the file signing.
• Keep your key secret, use a strong unique passphrase for the key.
• Upload the public key to a key server and publish the full fingerprint.
• Sign every new git commit and tag.
• Create signed compressed (xz --best) release archives
• Upload a strong message digest (sha512) of the archive
• Configure https for your download server

GPGit is meant to bring GPG to the masses. It is not only a shell script that automates the process of creating new signed git releases with GPG but also comes with this step-by-step readme guide for learning how to use GPG.

Additional Information:

• https://github.com/NicoHood/gpgit
• https://help.github.com/categories/gpg/
• https://wiki.archlinux.org/index.php/GnuPG
• https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
• https://www.qubes-os.org/doc/verifying-signatures/
• https://lkml.org/lkml/2016/8/15/445
• https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https
• https://www.enigmail.net/index.php/en/

Thanks in advance.

[Byron]

@NicoHood Can you please check to what extend these files match your requirements? I have just used twine upload -s -i <me> dist/* to do produce the signature, and on top of that all my commits are now signed with the same key.

[NicoHood]

As stated in the other comment, it all works perfectly. Thanks

[NicoHood]

The gpg key got revoked. See https://github.com/gitpython-developers/smmap/issues/36#issuecomment-401588237

[Byron]

Sorry for the late reply! I have uploaded version 2.0.4 just for the purpose of signing it with a valid key of mine.

[NicoHood]

Thanks. And please do not always switch your gpg keys. You can update the key expire date when its near expiring. Otherwise there is no real security in GPG.