From 16-07-2022 releases and commits will be signed.

[Aterfax]

Going forward to add a a bit more security I will be signing both my commits to this repo and releases with my GPG keys.

This means you will be able to validate the releases and confirm my commits look verified like so:

Email address: Aterfax@users.noreply.github.com
Key ID: 51E7ED3290C121FE

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEYtGtWRYJKwYBBAHaRw8BAQdAXAPKZy48X54gZ9MVl+8V9Ni3PwgdevSWgi8u
lAHkXeq0KkF0ZXJmYXggPEF0ZXJmYXhAdXNlcnMubm9yZXBseS5naXRodWIuY29t
PoiZBBMWCgBBFiEEHdfTKikBMDJDdStrUeftMpDBIf4FAmLRrVkCGwMFCQPDU9cF
CwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQUeftMpDBIf6oNwEAlVFLkVp/
EYnTim4WdMXzXwhdmVsPynzbYc3aRMvGXa0BAM1N4z+tIXPUUgTcmnFkbIPQki2C
1OjhZ7dPepD3ZjYIuDgEYtGtWRIKKwYBBAGXVQEFAQEHQOVElI1q6d9h6EPUzcPZ
zX0cas7rdzOrZR0v1GsZ1sc9AwEIB4h+BBgWCgAmFiEEHdfTKikBMDJDdStrUeft
MpDBIf4FAmLRrVkCGwwFCQPDU9cACgkQUeftMpDBIf7q6AEA+oJmTUc2UdTp79iG
fxLGEqcdLH4KAzOC7efmghqjeDgBAPUVy13bM1ZB05xwXTurqLV3SMD59+RVnLoK
o3+gEuwE
=neVQ
-----END PGP PUBLIC KEY BLOCK-----

Aterfax_51E7ED3290C121FE_public.asc.zip

[Aterfax]

General notes for verifying a release.zip signature

Unzip the public key

unzip Aterfax_51E7ED3290C121FE_public.asc.zip

  Archive:  Aterfax_51E7ED3290C121FE_public.asc.zip
  inflating: Aterfax_51E7ED3290C121FE_public.asc

Import the public key to your keyring

gpg --import Aterfax_51E7ED3290C121FE_public.asc

 gpg: key 51E7ED3290C121FE: public key "Aterfax <Aterfax@users.noreply.github.com>" imported
 gpg: Total number processed: 1
 gpg:               imported: 1

Verify the signature

gpg --verify release.zip.sig release.zip

gpg: Signature made Sat 16 Jul 2022 01:54:24 PM BST
gpg:                using EDDSA key 1DD7D32A2901303243752B6B51E7ED3290C121FE
gpg: Good signature from "Aterfax <Aterfax@users.noreply.github.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 1DD7 D32A 2901 3032 4375  2B6B 51E7 ED32 90C1 21FE

Note:

• Good signature from "$KEY_INFO" indicates the file is signed correctly.
• This key is not certified with a trusted signature! means you have not trusted my public key yet.
• There is no indication that the signature belongs to the owner. is a warning as GPG has no way of knowing that my public key really came from me. Given you got it from my Github repo you can be fairly sure this is legit but you could DM me to check.

[accessiblepixel]

For any of those having an issue unzipping the signature on Debian with an error message like
skipping: Aterfax_51E7ED3290C121FE_public.asc need PK compat. v6.3 (can do v4.6)

I found I had to extract it by installing p7zip-full and then running 7za x Aterfax_51E7ED3290C121FE_public.asc.zip

For some reason the zip file as attached has extra stuff (from the PK format) that the open source unzip doesn't seem to have.

[Aterfax]

Likely as I use 7zip I bet.

[accessiblepixel]

Excellent idea, great thinking :)

An easy add, but definitely better for security and integrity.