release: pin the GPG signing key for archive .asc files - #86
Merged
Conversation
gpg --detach-sign used no -u, so it signed with gpg's default secret key. With a second secret key (Saga IT LLC) now in the keyring and no default-key configured, the default resolved to the wrong key — the release archive .asc files would not match the signed git tag or the prior 3.5.x release signatures. Pin -u jesse.dowell@gmail.com (same key as project.clj :signing and user.signingkey) so the tarball/zip signatures are reproducible and consistent regardless of keyring order.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
make releasesigns the distribution archives withgpg --detach-sign --armorwithout-u, so it uses gpg's default secret key. A second secret key (Saga IT LLC <admin@saga-it.com>) is now in the keyring and nodefault-keyis configured, so the default resolves to the wrong key — themirthsync-3.6.0.tar.gz.asc/.zip.ascsignatures would not match the signed git tag (pinned viauser.signingkey) or the.ascfiles on the 3.5.1/3.5.2 releases.Fix
Pin
-u jesse.dowell@gmail.comon the twogpg --detach-signlines — the same key asproject.clj's:signing {:gpg-key ...}and the release git tag. Now the archive signatures are reproducible and consistent regardless of keyring order on the release machine.No functional/code change; build tooling only. Verified
-u jesse.dowell@gmail.comresolves toBAD6…CCB5(the historical release key).