{"action":"created","comment":{"url":"https://api.github.com/repos/ipfs/distributions/pulls/comments/71188384","id":71188384,"diff_hunk":"@@ -0,0 +1,56 @@\n+# Signing and Security\n+\n+In order to ensure that downloaded binaries are not compromised we provide\n+two ways of checking the integrity of the downloaded files.\n+\n+In the following the reference to \"tarball\" means either a `zip` or `tar.gz` file\n+depending on the target operating system.\n+If not stated otherwise \"key\" refers to a public/private key pair usable for public\n+key cryptography.\n+\n+## 1. `SHA512` Checksum\n+\n+After the tarball was created, [`gpg`](https://gnupg.org/) is used to generate\n+the `SHA512` checksum of the tarball and put into a file called `$original_file.sha`.\n+The command for doing this is\n+\n+```bash\n+$ gpg --print-md SHA512 $original_file> > $original_file.sha\n+```\n+\n+## 2. OpenPGP Compatible ASCII Armored Detached Signatures\n+\n+After the tarball is generated it is signed using one of the trusted developer keys.\n+From that an OpenPGP compatible ASCII armored detached signature is created and\n+put into a file `$original_file.asc`.\n+The command for doing this is\n+\n+```bash\n+$ gpg --armor --output $original_file.asc --detach-sig $original_file\n+```\n+\n+## Trusted Developer Keys\n+\n+These keys are the ones used to sign tarballs and used to verify their integrity.\n+\n+### Required properties of the keys\n+\n+* The private key MUST be stored on seperate hardware than the computer used to sign\n+  the release. For convenience something like a [YubiKey](https://www.yubico.com/)\n+  is recommended.\n+* The key must have a length of at least `2048` bits and of type RSA.","path":"SIGNING.md","position":41,"original_position":41,"commit_id":"01713d8397604269735793d7af0b39f4bd062f72","original_commit_id":"01713d8397604269735793d7af0b39f4bd062f72","user":{"login":"Kubuxu","id":2259282,"avatar_url":"https://avatars.githubusercontent.com/u/2259282?v=3","gravatar_id":"","url":"https://api.github.com/users/Kubuxu","html_url":"https://github.com/Kubuxu","followers_url":"https://api.github.com/users/Kubuxu/followers","following_url":"https://api.github.com/users/Kubuxu/following{/other_user}","gists_url":"https://api.github.com/users/Kubuxu/gists{/gist_id}","starred_url":"https://api.github.com/users/Kubuxu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kubuxu/subscriptions","organizations_url":"https://api.github.com/users/Kubuxu/orgs","repos_url":"https://api.github.com/users/Kubuxu/repos","events_url":"https://api.github.com/users/Kubuxu/events{/privacy}","received_events_url":"https://api.github.com/users/Kubuxu/received_events","type":"User","site_admin":false},"body":"We use Neo which supports only 2048.","created_at":"2016-07-18T17:14:07Z","updated_at":"2016-07-18T17:14:07Z","html_url":"https://github.com/ipfs/distributions/pull/51#discussion_r71188384","pull_request_url":"https://api.github.com/repos/ipfs/distributions/pulls/51","_links":{"self":{"href":"https://api.github.com/repos/ipfs/distributions/pulls/comments/71188384"},"html":{"href":"https://github.com/ipfs/distributions/pull/51#discussion_r71188384"},"pull_request":{"href":"https://api.github.com/repos/ipfs/distributions/pulls/51"}}},"pull_request":{"url":"https://api.github.com/repos/ipfs/distributions/pulls/51","id":58600116,"html_url":"https://github.com/ipfs/distributions/pull/51","diff_url":"https://github.com/ipfs/distributions/pull/51.diff","patch_url":"https://github.com/ipfs/distributions/pull/51.patch","issue_url":"https://api.github.com/repos/ipfs/distributions/issues/51","number":51,"state":"open","locked":false,"title":"feat: Setup code signing for all packages using opgenpgp","user":{"login":"dignifiedquire","id":790842,"avatar_url":"https://avatars.githubusercontent.com/u/790842?v=3","gravatar_id":"","url":"https://api.github.com/users/dignifiedquire","html_url":"https://github.com/dignifiedquire","followers_url":"https://api.github.com/users/dignifiedquire/followers","following_url":"https://api.github.com/users/dignifiedquire/following{/other_user}","gists_url":"https://api.github.com/users/dignifiedquire/gists{/gist_id}","starred_url":"https://api.github.com/users/dignifiedquire/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dignifiedquire/subscriptions","organizations_url":"https://api.github.com/users/dignifiedquire/orgs","repos_url":"https://api.github.com/users/dignifiedquire/repos","events_url":"https://api.github.com/users/dignifiedquire/events{/privacy}","received_events_url":"https://api.github.com/users/dignifiedquire/received_events","type":"User","site_admin":false},"body":"**Update**: Added process references\r\n**Update**: Added sha512 checksums\r\n\r\nI've setup a pgp on my yubikey that is used for the code signing process. This process generates pgp signatures for every single tar/zip file and adds them to directory. As in the description explained they can be verified by running \r\n\r\n```bash\r\n$ gpg --verify file.tar.gz.asc file.tar.gz\r\n```\r\n\r\nif the key is present. \r\n\r\nRef https://github.com/ipfs/go-ipfs/issues/957\r\n\r\n## References\r\n\r\n* The distribution of keys is modeled after https://developers.yubico.com/Software_Projects/Software_Signing.html \r\n* The signature generation is modeled after the release signing process of the apache foundation: https://www.apache.org/dev/release-signing.html\r\n\r\n## Key Management\r\n\r\n### Setup\r\n* Every developer (currently me) who has the right to sign releases generates a pgp key, stored on dedicated hardware like a yubikey\r\n* The fingerprint is added to dist.ipfs.io\r\n* The public key is uploaded to https://pgp.mit.edu/ for ease of distribution\r\n\r\n### Verification\r\n* The user who downloads from dist.ipfs.io can fetch the listed public keys listed from https://pgp.mit.edu/ and add them to their keyring\r\n* The user downloads the signature + file\r\n* The user uses pgp + signature to verify the file \r\n\r\n## Checksums\r\nIn addition to the signatures there are also `file.sha` files containing the `sha512` checksum of the packages.","created_at":"2016-02-08T11:56:32Z","updated_at":"2016-07-18T17:14:07Z","closed_at":null,"merged_at":null,"merge_commit_sha":"74eebebb1b3f52e6c18ac973da1793ca3a8397a0","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/ipfs/distributions/pulls/51/commits","review_comments_url":"https://api.github.com/repos/ipfs/distributions/pulls/51/comments","review_comment_url":"https://api.github.com/repos/ipfs/distributions/pulls/comments{/number}","comments_url":"https://api.github.com/repos/ipfs/distributions/issues/51/comments","statuses_url":"https://api.github.com/repos/ipfs/distributions/statuses/01713d8397604269735793d7af0b39f4bd062f72","head":{"label":"ipfs:sign","ref":"sign","sha":"01713d8397604269735793d7af0b39f4bd062f72","user":{"login":"ipfs","id":10536621,"avatar_url":"https://avatars.githubusercontent.com/u/10536621?v=3","gravatar_id":"","url":"https://api.github.com/users/ipfs","html_url":"https://github.com/ipfs","followers_url":"https://api.github.com/users/ipfs/followers","following_url":"https://api.github.com/users/ipfs/following{/other_user}","gists_url":"https://api.github.com/users/ipfs/gists{/gist_id}","starred_url":"https://api.github.com/users/ipfs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ipfs/subscriptions","organizations_url":"https://api.github.com/users/ipfs/orgs","repos_url":"https://api.github.com/users/ipfs/repos","events_url":"https://api.github.com/users/ipfs/events{/privacy}","received_events_url":"https://api.github.com/users/ipfs/received_events","type":"Organization","site_admin":false},"repo":{"id":40225364,"name":"distributions","full_name":"ipfs/distributions","owner":{"login":"ipfs","id":10536621,"avatar_url":"https://avatars.githubusercontent.com/u/10536621?v=3","gravatar_id":"","url":"https://api.github.com/users/ipfs","html_url":"https://github.com/ipfs","followers_url":"https://api.github.com/users/ipfs/followers","following_url":"https://api.github.com/users/ipfs/following{/other_user}","gists_url":"https://api.github.com/users/ipfs/gists{/gist_id}","starred_url":"https://api.github.com/users/ipfs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ipfs/subscriptions","organizations_url":"https://api.github.com/users/ipfs/orgs","repos_url":"https://api.github.com/users/ipfs/repos","events_url":"https://api.github.com/users/ipfs/events{/privacy}","received_events_url":"https://api.github.com/users/ipfs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ipfs/distributions","description":"Source for building","fork":false,"url":"https://api.github.com/repos/ipfs/distributions","forks_url":"https://api.github.com/repos/ipfs/distributions/forks","keys_url":"https://api.github.com/repos/ipfs/distributions/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ipfs/distributions/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ipfs/distributions/teams","hooks_url":"https://api.github.com/repos/ipfs/distributions/hooks","issue_events_url":"https://api.github.com/repos/ipfs/distributions/issues/events{/number}","events_url":"https://api.github.com/repos/ipfs/distributions/events","assignees_url":"https://api.github.com/repos/ipfs/distributions/assignees{/user}","branches_url":"https://api.github.com/repos/ipfs/distributions/branches{/branch}","tags_url":"https://api.github.com/repos/ipfs/distributions/tags","blobs_url":"https://api.github.com/repos/ipfs/distributions/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ipfs/distributions/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ipfs/distributions/git/refs{/sha}","trees_url":"https://api.github.com/repos/ipfs/distributions/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ipfs/distributions/statuses/{sha}","languages_url":"https://api.github.com/repos/ipfs/distributions/languages","stargazers_url":"https://api.github.com/repos/ipfs/distributions/stargazers","contributors_url":"https://api.github.com/repos/ipfs/distributions/contributors","subscribers_url":"https://api.github.com/repos/ipfs/distributions/subscribers","subscription_url":"https://api.github.com/repos/ipfs/distributions/subscription","commits_url":"https://api.github.com/repos/ipfs/distributions/commits{/sha}","git_commits_url":"https://api.github.com/repos/ipfs/distributions/git/commits{/sha}","comments_url":"https://api.github.com/repos/ipfs/distributions/comments{/number}","issue_comment_url":"https://api.github.com/repos/ipfs/distributions/issues/comments{/number}","contents_url":"https://api.github.com/repos/ipfs/distributions/contents/{+path}","compare_url":"https://api.github.com/repos/ipfs/distributions/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ipfs/distributions/merges","archive_url":"https://api.github.com/repos/ipfs/distributions/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ipfs/distributions/downloads","issues_url":"https://api.github.com/repos/ipfs/distributions/issues{/number}","pulls_url":"https://api.github.com/repos/ipfs/distributions/pulls{/number}","milestones_url":"https://api.github.com/repos/ipfs/distributions/milestones{/number}","notifications_url":"https://api.github.com/repos/ipfs/distributions/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ipfs/distributions/labels{/name}","releases_url":"https://api.github.com/repos/ipfs/distributions/releases{/id}","deployments_url":"https://api.github.com/repos/ipfs/distributions/deployments","created_at":"2015-08-05T04:59:55Z","updated_at":"2016-05-06T21:31:31Z","pushed_at":"2016-07-10T05:13:26Z","git_url":"git://github.com/ipfs/distributions.git","ssh_url":"git@github.com:ipfs/distributions.git","clone_url":"https://github.com/ipfs/distributions.git","svn_url":"https://github.com/ipfs/distributions","homepage":"http://dist.ipfs.io","size":166006,"stargazers_count":10,"watchers_count":10,"language":"CSS","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":4,"mirror_url":null,"open_issues_count":23,"forks":4,"open_issues":23,"watchers":10,"default_branch":"master"}},"base":{"label":"ipfs:master","ref":"master","sha":"b876f06b9e3a6c7b8101a2cc41ca83f99f9b4029","user":{"login":"ipfs","id":10536621,"avatar_url":"https://avatars.githubusercontent.com/u/10536621?v=3","gravatar_id":"","url":"https://api.github.com/users/ipfs","html_url":"https://github.com/ipfs","followers_url":"https://api.github.com/users/ipfs/followers","following_url":"https://api.github.com/users/ipfs/following{/other_user}","gists_url":"https://api.github.com/users/ipfs/gists{/gist_id}","starred_url":"https://api.github.com/users/ipfs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ipfs/subscriptions","organizations_url":"https://api.github.com/users/ipfs/orgs","repos_url":"https://api.github.com/users/ipfs/repos","events_url":"https://api.github.com/users/ipfs/events{/privacy}","received_events_url":"https://api.github.com/users/ipfs/received_events","type":"Organization","site_admin":false},"repo":{"id":40225364,"name":"distributions","full_name":"ipfs/distributions","owner":{"login":"ipfs","id":10536621,"avatar_url":"https://avatars.githubusercontent.com/u/10536621?v=3","gravatar_id":"","url":"https://api.github.com/users/ipfs","html_url":"https://github.com/ipfs","followers_url":"https://api.github.com/users/ipfs/followers","following_url":"https://api.github.com/users/ipfs/following{/other_user}","gists_url":"https://api.github.com/users/ipfs/gists{/gist_id}","starred_url":"https://api.github.com/users/ipfs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ipfs/subscriptions","organizations_url":"https://api.github.com/users/ipfs/orgs","repos_url":"https://api.github.com/users/ipfs/repos","events_url":"https://api.github.com/users/ipfs/events{/privacy}","received_events_url":"https://api.github.com/users/ipfs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ipfs/distributions","description":"Source for building","fork":false,"url":"https://api.github.com/repos/ipfs/distributions","forks_url":"https://api.github.com/repos/ipfs/distributions/forks","keys_url":"https://api.github.com/repos/ipfs/distributions/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ipfs/distributions/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ipfs/distributions/teams","hooks_url":"https://api.github.com/repos/ipfs/distributions/hooks","issue_events_url":"https://api.github.com/repos/ipfs/distributions/issues/events{/number}","events_url":"https://api.github.com/repos/ipfs/distributions/events","assignees_url":"https://api.github.com/repos/ipfs/distributions/assignees{/user}","branches_url":"https://api.github.com/repos/ipfs/distributions/branches{/branch}","tags_url":"https://api.github.com/repos/ipfs/distributions/tags","blobs_url":"https://api.github.com/repos/ipfs/distributions/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ipfs/distributions/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ipfs/distributions/git/refs{/sha}","trees_url":"https://api.github.com/repos/ipfs/distributions/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ipfs/distributions/statuses/{sha}","languages_url":"https://api.github.com/repos/ipfs/distributions/languages","stargazers_url":"https://api.github.com/repos/ipfs/distributions/stargazers","contributors_url":"https://api.github.com/repos/ipfs/distributions/contributors","subscribers_url":"https://api.github.com/repos/ipfs/distributions/subscribers","subscription_url":"https://api.github.com/repos/ipfs/distributions/subscription","commits_url":"https://api.github.com/repos/ipfs/distributions/commits{/sha}","git_commits_url":"https://api.github.com/repos/ipfs/distributions/git/commits{/sha}","comments_url":"https://api.github.com/repos/ipfs/distributions/comments{/number}","issue_comment_url":"https://api.github.com/repos/ipfs/distributions/issues/comments{/number}","contents_url":"https://api.github.com/repos/ipfs/distributions/contents/{+path}","compare_url":"https://api.github.com/repos/ipfs/distributions/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ipfs/distributions/merges","archive_url":"https://api.github.com/repos/ipfs/distributions/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ipfs/distributions/downloads","issues_url":"https://api.github.com/repos/ipfs/distributions/issues{/number}","pulls_url":"https://api.github.com/repos/ipfs/distributions/pulls{/number}","milestones_url":"https://api.github.com/repos/ipfs/distributions/milestones{/number}","notifications_url":"https://api.github.com/repos/ipfs/distributions/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ipfs/distributions/labels{/name}","releases_url":"https://api.github.com/repos/ipfs/distributions/releases{/id}","deployments_url":"https://api.github.com/repos/ipfs/distributions/deployments","created_at":"2015-08-05T04:59:55Z","updated_at":"2016-05-06T21:31:31Z","pushed_at":"2016-07-10T05:13:26Z","git_url":"git://github.com/ipfs/distributions.git","ssh_url":"git@github.com:ipfs/distributions.git","clone_url":"https://github.com/ipfs/distributions.git","svn_url":"https://github.com/ipfs/distributions","homepage":"http://dist.ipfs.io","size":166006,"stargazers_count":10,"watchers_count":10,"language":"CSS","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":4,"mirror_url":null,"open_issues_count":23,"forks":4,"open_issues":23,"watchers":10,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/ipfs/distributions/pulls/51"},"html":{"href":"https://github.com/ipfs/distributions/pull/51"},"issue":{"href":"https://api.github.com/repos/ipfs/distributions/issues/51"},"comments":{"href":"https://api.github.com/repos/ipfs/distributions/issues/51/comments"},"review_comments":{"href":"https://api.github.com/repos/ipfs/distributions/pulls/51/comments"},"review_comment":{"href":"https://api.github.com/repos/ipfs/distributions/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/ipfs/distributions/pulls/51/commits"},"statuses":{"href":"https://api.github.com/repos/ipfs/distributions/statuses/01713d8397604269735793d7af0b39f4bd062f72"}}}}
{"actor":{"display_login":"Kubuxu"}}