Repository signing - Githubissues

phpcq / repository

The base repository containing tool specifications

0 stars 1 forks source link

Repository signing #11

Open discordier opened 4 years ago

discordier commented 4 years ago

We might want to utilize automatic signing for the repository (and maybe for our tools). Some read up is available at https://github.com/phar-io/phive/issues/221

I am currently thinking about the following aspects:

We want automatic signing (we are not at the computer 24/7)
We do not want to trust Github on signing for the matters of account hijacking
We should leave the "dirty work" to github actions
We should sign on a separate (trusted, self owned) server by providing:
- The key passphrase automatically for repository builds (as they happen on daily basis).
- The key passphrase manually for tool builds for each build run after tests succeeded.