Make signed scrypt binary available to Qubes users for emergency backup recovery

[andrewdavidwong]

I've just updated Emergency Backup Recovery without Qubes - format version 4 to strongly recommend that Qubes users store a copy of the scrypt utility with their 4.x backups, since it is required in order to access the data in those backups (see QubesOS/qubes-doc@bb26173 and, for background, #971).

@marmarek and I previously agreed that it would be a good idea to make a signed binary available to Qubes users so that all Qubes users don't have to compile it from source themselves.

One thing to think about is whether the signed binary should also be included in Qubes itself (e.g., in dom0) or just as a web download.

[marmarek]

We already have signed rpm package with the binary. You can easily extract binary (rpmdev-extract tool) from there and treat rpm as a signed container. Alternatively we could put just a binary with a detached signature somewhere. Obviously the first option if far less work, as it is already done: https://yum.qubes-os.org/r4.0/current/vm/fc28/rpm/scrypt-1.2.1-1.fc28.x86_64.rpm (you can also choose older Fedora version, to have it linked with older libraries - useful for usage on non-Fedora systems)

[marmarek]

We already have signed rpm package with the binary. You can easily extract binary (rpmdev-extract tool) from there and treat rpm as a signed container. Alternatively we could put just a binary with a detached signature somewhere. Obviously the first option if far less work, as it is already done: https://yum.qubes-os.org/r4.0/current/vm/fc28/rpm/scrypt-1.2.1-1.fc28.x86_64.rpm (you can also choose older Fedora version, to have it linked with older libraries - useful for usage on non-Fedora systems)

[andrewdavidwong]

Ok, I'll document the procedure.

[andrewdavidwong]

Ok, I'll document the procedure.