{{ message }}
Repository navigation
Can't find release gpg key #458
Description
I see checksums.txt has a detached signature in the release artifacts, which is great. However, I can't find the key anywhere to verify it. Is it published somewhere?
> gpg --verify checksums.txt.sig
gpg: assuming signed data in 'checksums.txt'
gpg: Signature made Wed 07 Dec 2022 01:40:32 PM GMT
gpg: using RSA key 81DF3546AA43EB287D276C87D1F231005DCF1180
gpg: issuer "github-bot@hetzner-cloud.de"
gpg: Can't check signature: No public key
> gpg --recv-key 81DF3546AA43EB287D276C87D1F231005DCF1180
gpg: keyserver receive failed: No data
Possibly related to #120 and #209.
Could the key be posted somewhere obvious? Apologies if it is and I've just missed it!
Activity
apricote commentedon Mar 6, 2023
Hey @mdbooth,
you can find the key on keys.openpgp.org:
mdbooth commentedon Mar 6, 2023
Thanks! It would be good to see it posted somewhere canonical. Not 100% sure what the best practise is, but maybe:
github-actions commentedon Jun 5, 2023
This issue has been marked as stale because it has not had recent activity. The bot will close the issue if no further action occurs.
github-actions commentedon Oct 8, 2023
This issue has been marked as stale because it has not had recent activity. The bot will close the issue if no further action occurs.
bheisig commentedon Oct 16, 2023
Quick info: GPG can't verify the checksum file anymore. Tested with release
1.38.2:jooola commentedon Oct 16, 2023
Should be fixed in 1.38.3
kranurag7 commentedon Dec 23, 2023
@apricote would you and the team be open to a patch that allows signing our artifacts using cosign? I think this way we will avoid having problems with importing GPG keys.
We can extend our existing goreleaser config to enable that.
Ref: https://goreleaser.com/customization/sign/#signing-with-cosign