Skip to content

v2.0.0

Choose a tag to compare

View all tags
@404SecNotFound 404SecNotFound released this 16 Aug 05:22
· 288 commits to main since this release
v2.0.0
3251b1b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Keymaker v2.0.0, writing KEYM v2 containers. Those are two
different version numbers and they move independently — see the bottom of these
notes if a file will not open.

Verifying this release

Two checks, and they answer different questions. Neither of them asks you to
trust this project's own tooling.

1. The files are the ones this tag produced.

tar -xzf keymaker-v2.0.0.tar.gz && cd keymaker-v2.0.0
sha256sum -c SHA256SUMS

sha256sum is on every Unix machine and has nothing to do with this project,
which is the point.

2. This repository's release workflow is what signed that manifest.

cosign verify-blob \
  --bundle SHA256SUMS.sigstore \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity 'https://github.com/404SecNotFound/Keymaker-v2/.github/workflows/release.yml@refs/tags/v2.0.0' \
  SHA256SUMS

Keyless signing: there is no published key to obtain and therefore no key
distribution to get wrong. The check is not "signed by a key we told you about"
— it is "signed by this workflow, in this repository", and
--certificate-identity is the flag that makes it so. Without it,
cosign verify-blob accepts a signature from anybody and says "Verified OK".

Note that the identity above ends in release.yml@refs/tags/v2.0.0, while
docs/VERIFYING.md gives deploy.yml@refs/heads/main for
the live site. Different workflows sign the two things, so they are different
identities and neither will verify the other. That document is where these
commands come from — they are generated from it, not maintained beside it.

What this artifact is

The same bytes served at the live site, so you can compare the two and
satisfy yourself that the deployment matches a tag whose source you can read.

It is built with the Pages base path, so it expects to be served from
/Keymaker-v2/. That makes it a verification artifact rather than a drop-in
for hosting elsewhere; to host it at another path, build from source, which
docs/VERIFYING.md also covers.

Container format

This release writes KEYM v2 containers. The format is specified in
docs/FORMAT-V2-DESIGN.md and implemented
independently in reference/keym2.py, which decrypts your
files without this application, this website, or a browser. If this project
disappears, that file and the printed procedure in
docs/RECOVERY.md are enough.

v2.0.0 is the application version. KEYM v2 is the format version. They are
separate numbers on purpose, because they answer different questions: which app
you are running, and which file you are holding. A file that will not open is
almost always a question about the second.

Assets 5
Loading