Repository navigation
docs(release): document the release signing key and publish it - #23
Merged
Merged
Conversation
Blocker 1 of #6 was that no signing identity existed. Record the dedicated release key, its fingerprint and expiry, the custody rules for the private material, the three repository secrets the release workflow reads, and the verification a consumer can run against the published public key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a Signing key section to
docs/guides/releases.mdand publishes the release key's public half asdocs/guides/signing-key.asc.Why
Blocker 1 of #6: no signing identity existed, so the first release could never be produced. This records the dedicated key, its fingerprint and expiry, the custody rules for the private material, the three repository secrets the release workflow already reads, and the verification a consumer can run. Only the public key enters the repository.
Refs #6
How tested
make docs: no generated drift; the guide tree is hand-written.git diff --check: clean.--pinentry-mode loopback --passphrase-file --local-user <fingerprint>, then verified in a keyring holding only the public key. Result:Good signature, binary detached signature, primary key3610 065D B825 0D31 A49E C0D5 2845 88A6 1CDA 90B9.gh secret listconfirmsGPG_PRIVATE_KEY,GPG_PASSPHRASEandGPG_FINGERPRINTare set.Remaining work
v0.1.0-rc.1and verify installation (blockers 3-6 of Publish the first signed prerelease and register the provider #6).