New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Repository signing #11

Open

discordier opened this issue Sep 18, 2020 · 0 comments

Labels

question

Member

discordier commented Sep 18, 2020

We might want to utilize automatic signing for the repository (and maybe for our tools).
Some read up is available at phar-io/phive#221

I am currently thinking about the following aspects:

We want automatic signing (we are not at the computer 24/7)
We do not want to trust Github on signing for the matters of account hijacking
We should leave the "dirty work" to github actions
We should sign on a separate (trusted, self owned) server by providing:
- The key passphrase automatically for repository builds (as they happen on daily basis).
- The key passphrase manually for tool builds for each build run after tests succeeded.

discordier added the question label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment