Post #1563116

2026-04-16 07:36 UTC

Does anyone have good input on how to do proper package signing with #gpg ? Here&#39;s what I have so far: https://code.vinyl-cache.org/vinyl-cache/pkg-vinyl-cache/issues/192#issuecomment-61151

Replies (4)

@thomasfricke@23.social 2026-04-16 08:02

@slink@fosstodon.org https://slsa.dev/ #slsa is the standard

Open ##2176663
@delta_vee@cosocial.ca 2026-04-16 11:52

@slink@fosstodon.org My one input would be don't use GPG, use minisign

Open ##2176673
@0xKaishakunin@mastodon.social 2026-04-16 12:13

@slink@fosstodon.org Do you want to go the paranoid route? Reproducible Builds according to #SLSA Level 4 might be the way. I have tried to model the process for another project, it's inspired by the release processes of the #TorBrowser, #NixOS and #Debian. You can find more info on the models at my repository https://codeberg.org/0xKaishakunin/Architecture/src/branch/main/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc

Open ##2176674
@meejah@mastodon.social 2026-04-17 15:54

@slink@fosstodon.org LGTM. On a past project we'd also toyed with putting the "next release" public key (next year for your proposed flow) in the current release.

Open ##2176684