Once copied, you can type gpg -export > -repo.gpg. Remember that picture up above with the two arrows? This time, you need to copy what the yellow arrow is pointing to (all of the numbers and letters to the right of rsa4096/. This allows your users to download and trust your repo is really yours. Now, the final step is to export the public key. (example: gpg -abs -u 0EA1CD919AF64DDE44F2AF3EAEE9BA5226A6631B -o Release.gpg Release)Įxport your public key. This signs your Release and creates Release.gpg, which marks the first part of signing properly complete. With this signature copied, you can now run the next command: gpg -abs -u -o Release.gpg Release. What you're after is the sec of the key, which is expanded in full on the second line (what the blue arrow is pointing to).Ĭreate Release.gpg.
gpg -list-secret-keys -keyid-format=long will list the keys you've created on your system. Once you've done this, hit O and enter to save your settings, enter a password (you can leave it blank if you desire) and there you go! You now have a new key to sign with.įind the key's signature.
Then enter your real name, email address, and an optional comment to fill out the signature details.
Pick (9) ECC (sign and encrypt) as the type, pick (1) Curve 25519 *default* for your curve, and 0 to keep the key from expiring (if you don't have the option to use ECC, choose (1) RSA and RSA, then select 4096 as your key length). Open a terminal and run gpg -full-generate-key. This is most likely included on your distro of Linux and can be installed with sudo apt install gnupg or brew install gnupg on macOS. I provide instructions for Linux and macOS because these are the two operating systems I use-this should be doable in WSL or Cygwin. To get started, we'll need you to have a GPG key to sign with and export the public key (it's easier than you might think). To prevent your users from possibly facing man-in-the-middle attacks and secure your repository, you should follow these steps.
0 kommentar(er)
