hetznercloud
Can't find release gpg key
I see checksums.txt has a detached signature in the release artifacts, which is great. However, I can't find the key anywhere to verify it. Is it published somewhere?
> gpg --verify checksums.txt.sig
gpg: assuming signed data in 'checksums.txt'
gpg: Signature made Wed 07 Dec 2022 01:40:32 PM GMT
gpg: using RSA key 81DF3546AA43EB287D276C87D1F231005DCF1180
gpg: issuer "[email protected]"
gpg: Can't check signature: No public key
> gpg --recv-key 81DF3546AA43EB287D276C87D1F231005DCF1180
gpg: keyserver receive failed: No data
Possibly related to https://github.com/hetznercloud/cli/issues/120 and https://github.com/hetznercloud/cli/issues/209.
Could the key be posted somewhere obvious? Apologies if it is and I've just missed it!
Hey @mdbooth,
you can find the key on keys.openpgp.org:
- https://keys.openpgp.org/search?q=81DF3546AA43EB287D276C87D1F231005DCF1180
- https://keys.openpgp.org/[email protected]
Thanks! It would be good to see it posted somewhere canonical. Not 100% sure what the best practise is, but maybe:
- Checked into the repo itself with a docs link ("releases will be signed by docs/hetzner-release-key.asc")
- Served via https with a valid hetzner cert
This issue has been marked as stale because it has not had recent activity. The bot will close the issue if no further action occurs.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
This issue has been marked as stale because it has not had recent activity. The bot will close the issue if no further action occurs.
Quick info: GPG can't verify the checksum file anymore. Tested with release 1.38.2:
gpg: BAD signature from "[email protected] <[email protected]>" [unknown]
Quick info: GPG can't verify the checksum file anymore. Tested with release
1.38.2:gpg: BAD signature from "[email protected] <[email protected]>" [unknown]
Should be fixed in 1.38.3
@apricote would you and the team be open to a patch that allows signing our artifacts using cosign? I think this way we will avoid having problems with importing GPG keys. We can extend our existing goreleaser config to enable that. Ref: https://goreleaser.com/customization/sign/#signing-with-cosign
