search

grant-olson / rubygems-openpgp

This allows you to cryptographically sign ruby gems, so that a user can later verify that they've downloaded a copy that hasn't been tampered with or hacked.
http://www.rubygems-openpgp-ca.org
Other
32 stars 4 forks source link

Provide gem commands to automate generating and uploading developer keys #16

Open postmodern opened 11 years ago

postmodern commented 11 years ago

Provide a gem command for setting up a developer key:

gpg --gen-key
gpg --keyserver pool.sks-keyservers.net --send-keys 0xDEADBEEF
grant-olson commented 11 years ago

I've been thinking about this some.

I would like some more gpg level commands built into the plug-in. But I'm not sure if I like the idea of auto-publishing someone's contact info to the keyservers, when they might not realize the implications. I also feel like you shouldn't publish to keyservers until you've made backup and revocation certs, so it's always going to be a manual process.

Maybe there could be a more interactive solution, or maybe a detailed help message when you run a sign command and clearly don't have a private key, or maybe a gpg-help command that spits out a bunch of useful information.

Will continue to background process though. Any input or suggestions are welcome.