GPG signatures for source validation

[NicoHood]

As we all know, today more than ever before, it is crucial to be able to trust
our computing environments. One of the main difficulties that package
maintainers of Linux distributions face, is the difficulty to verify the
authenticity and the integrity of the source code.

The Arch Linux team would appreciate it if you would provide us GPG signatures
in order to verify easily and quickly your source code releases.

Overview of the required tasks:

• Create and/or use a 4096-bit RSA keypair for the file signing.
• Keep your key secret, use a strong unique passphrase for the key.
• Upload the public key to a key server and publish the full fingerprint.
• Sign every new git commit and tag.
• Create signed compressed (xz --best) release archives
• Upload a strong message digest (sha512) of the archive
• Configure https for your download server

GPGit is meant to bring GPG to the masses.
It is not only a shell script that automates the process of creating new signed
git releases with GPG but also comes with this step-by-step readme guide for
learning how to use GPG.

Additional Information:

• https://github.com/NicoHood/gpgit
• https://help.github.com/categories/gpg/
• https://wiki.archlinux.org/index.php/GnuPG
• https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
• https://www.qubes-os.org/doc/verifying-signatures/
• https://lkml.org/lkml/2016/8/15/445
• https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https
• https://www.enigmail.net/index.php/en/

Thanks in advance.

[NicoHood]

Where can we find the digital signatures? I could still not find any, do you upload this package somewhere else too?

[gkdr]

I will not sign code I cannot vouch for. I'll reconsider this once OWS starts signing their code, which I have to include in my source archives.

[NicoHood]

What? You are the publisher. Signing only helps to verify that the code does not get modified between your, github and the end consumer. It does not give the user any warrenty, unless your license does, which is not the case. So why not help improving the security of the packaging of your security? You are a wise man, you implemented omemo for pidgin, please rethink your decision. Thanks.

[gkdr]

This plugin is just glue code, the main work is done in the submodules, which include libsignal-protocol-c that does most of the crypto. As long as not all the parts are signed, especially the most critical part, I think this is worthless and I'm not willing to deal with PGP for that.
Even if I just sign the resulting tarball (which as I said has to include libsignal-protocol-c), because OWS doesn't employ signatures I have no guarantee that it wasn't modified on the way to my computer (as you said yourself), so I don't want to mislead the users of this plugin.

[NicoHood]

Imagine someone else wants to include this project in another project. But he will refuse to sign his project, because your project was also not signed. Then nobody would sign any code. Your choice.

And beside this it is also a shame that the signal guys dont sign their code. Even more important than this pidgin addon.