Conversation
Release artifacts are signed with GPG, but there is no record in the repository of which keys are allowed to sign them, so users have no trusted way to verify the signatures. Add crun.keyring listing the keys of the release managers, and document how to verify a release in README.md. The keyring is also shipped in the release tarballs, so distributions can use it. Each key block carries a "github=<user>" comment. Add build-aux/keyring_validate.sh (also available as "make validate-keyring") and run it in CI to check that every (sub)key in the keyring is one of the keys that user publishes on GitHub. Signed-off-by: Kir Kolyshkin <[email protected]>
Before starting the build, make sure the default GPG key can sign, and that the signature can be verified with the keys in crun.keyring. Otherwise the release would be signed with a key users cannot verify. Signed-off-by: Kir Kolyshkin <[email protected]>
Signed-off-by: Kir Kolyshkin <[email protected]>
Verify the signature of the release tarball in %prep using %gpgverify and the keys from crun.keyring. The keyring is synced to dist-git by Packit rather than downloaded from the release, so that whoever can replace the release assets cannot also replace the keyring. Copr builds made from git snapshots have no signature, so skip the verification there. Signed-off-by: Kir Kolyshkin <[email protected]>
giuseppe
approved these changes
Sep 15, 2026
giuseppe
left a comment
giuseppe
left a comment
Member
There was a problem hiding this comment.
yes, this is the key I use
LGTM
kolyshkin
marked this pull request as ready for review
September 15, 2026 22:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release artifacts are GPG-signed, but the repository has no record of which keys are allowed to sign them, so users (and distributions) have no trusted way to verify the
.ascfiles. This follows what runc does withrunc.keyring.crun.keyring: public keys of the release managers, each block tagged with agithub=<user>comment. It has @giuseppe's key (primaryAC404C1C0BF735C63FF4D562263D6DF2E163E1EA, taken from https://github.com/giuseppe.gpg; the 1.29.1 tag and release artifacts verify against it) and @kolyshkin's key (C2428CD75720FACDCF76B6EA17DE5ECB75A1100E, same as in runc.keyring).README.md: a "Releases" section explaining how to verify an artifact.build-aux/keyring_validate.sh(make validate-keyring), run in CI: checks that every (sub)key in the keyring belongs to the GitHub user named in its comment.build-aux/release.sh: before building, check that the default signing key verifies againstcrun.keyring.rpm/crun.spec: verify the release tarball signature in%prepwith%gpgverify. The keyring is synced to dist-git via Packitfiles_to_syncrather than downloaded from the release. Verification is skipped for Copr (git snapshot) builds, which have no signature; the Packit Copr builds on this PR will show whether that condition holds for the SRPM stage too.@giuseppe, please confirm this is the key you want to use for signing releases (or push the right one). Other maintainers who cut releases can add theirs.