Comments (4)
based on your edit I presume you understand what I meant, though your language makes me unsure. in any case, here's the explanation.
what Github provides you with is not PGP signing in the proper sense. the private key of that key pair belongs to Github:
$ gpg --keyserver pgp.mit.edu --recv-key 4AEE18F83AFDEB23
...
gpg: key 4AEE18F83AFDEB23: public key "GitHub (web-flow commit signing) [email protected]" imported
you are outsourcing the authenticity proving to the same third party that we download the releases from, so not only is this insufficient, it's also redundant, apart from DNS-hijacking and domain name takeover scenarios.
what you wanna do (short version) is 1) have each of your release managing devs generate a PGP key pair that they use solely for signing releases (can be done with a Trezor too, much safer), 2) upload the public keys to PGP key servers, your website and your Github, 3) publish the key fingerprints on many diverse channels (website, Github, ENS, Twitter, write on your hand and read it out in a video, T-shirts, conference slides), 4) have each of these devs sign each release, and 5) upload the signatures together with the binaries (you can put all signatures in a single file like Electrum devs do).
from safe-wallet-web.
Cool, thanks for breaking it down.
I've already created a GPG key pair and configured git to use it. Still need to do steps 3, 4 and 5.
Looks like uploading the signature and code archives would have to be a manual process.
from safe-wallet-web.
indeed, since a key needs to be in the sole physical ownership of each signing party, it is an additional manual process. (thanks for linking to that Debian Wiki entry, it does a much better job at explaining than my "long version" links.)
from safe-wallet-web.
Doesn't GitHub already sign them?
We'll make sure to also sign direct commits with individual GPG signatures. Thanks for flagging this!
from safe-wallet-web.
Related Issues (20)
- Incomplete tx hash retrieval via WalletConnect with wagmi HOT 2
- Balance change preview shows incorrect decimals when sending USDC; does not match Send HOT 2
- Show full asset amount on hover
- [E2E] Multi-send actions are not visible in tx confirmation modal
- Transaction title is hard to read
- Transaction dialog in mobile view can't be closed
- Copy safe address on mobile view doesn't work HOT 3
- Spending limit removal - Too many 0's when removing a spending limit
- Uneven padding on TWAP order transaction details
- Hide suspicious filter does not work beyond first page of transaction history
- Improve cleanup of pending transactions state HOT 2
- Send amount with floating point number displays incorrectly in confirmation component for several languages (see description) [flaky] HOT 2
- CF safes balances on sidebar never finish loading
- Tx execution and safe creation cannot be done with Ledger Nano S HOT 3
- [UI bug] Wrong subtitle text style in the alert for transaction simulation HOT 1
- WalletConnect no longer tracked as Safe transaction origin HOT 1
- There is no option to re-run simmulation without tx recreation in case of error
- No contract interaction / transaction builder button HOT 7
- [iOS] What's New doesn't work
- Refactor txDetails and remove the optional txDetails argument
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from safe-wallet-web.