Linux: signed releases (SHA256SUMS + signature), signed apt repo, signed Arch/Flatpak artifacts

sky_line commented

2026-10-04 07:22:37 +00:00

Owner

Linux downloads are currently unsigned: users can't verify the tarball/.deb/PKGBUILD came from us, and an apt repo or Flatpak repo (#286) needs signing anyway. Related: Windows signing ticket.

Release signing (all artifacts)

Create a project release signing key (OpenPGP, ed25519; offline primary + signing subkey used by CI), or use minisign/signify for simple detached signatures in addition. Publish the public key on the website (and its fingerprint in the wiki and README), served over HTTPS.
CI on tag: produce SHA256SUMS for every asset, plus a detached signature SHA256SUMS.asc (and/or per-file .sig). Attach both to the Forgejo release.
Document verification in the wiki (gpg --verify SHA256SUMS.asc && sha256sum -c SHA256SUMS).

Per-format

.deb: sign the package (debsigs/dpkg-sig are rarely checked). Better: host an apt repository (apt.slipstreamviewer.org, reprepro/aptly) with a signed Release/InRelease, and a signed-by= keyring instructions/.sources file. Then users get updates via apt upgrade. This is the real value for Debian/Ubuntu/Mint users.
Arch: sign the PKGBUILD's source tarball (validpgpkeys=() + the .sig in source=() so makepkg verifies it), and later the AUR package. Optionally an Arch binary repo signed with repo-add --sign.
Flatpak (#286): GPG-sign the self-hosted repo (flatpak build-update-repo --gpg-sign) and ship the key in the .flatpakrepo/.flatpakref. Flathub signs on its own side.
Tarball: covered by SHA256SUMS + signature. Optionally an AppImage-style embedded signature if we ever ship an AppImage.

Key management

Signing subkey (or minisign key) stored as a Forgejo Actions secret, usable only by tag builds on applejack. Primary key offline. Plan for expiry, rotation and revocation (revocation certificate stored offline).
One key for all Linux repos is fine; publish it in one place and reference it everywhere.

Linux downloads are currently unsigned: users can't verify the tarball/.deb/PKGBUILD came from us, and an apt repo or Flatpak repo (#286) needs signing anyway. Related: Windows signing ticket. ### Release signing (all artifacts) - Create a project **release signing key** (OpenPGP, ed25519; offline primary + signing subkey used by CI), or use **minisign/signify** for simple detached signatures in addition. Publish the public key on the website (and its fingerprint in the wiki and README), served over HTTPS. - CI on tag: produce `SHA256SUMS` for every asset, plus a detached signature `SHA256SUMS.asc` (and/or per-file `.sig`). Attach both to the Forgejo release. - Document verification in the wiki (`gpg --verify SHA256SUMS.asc && sha256sum -c SHA256SUMS`). ### Per-format - **.deb:** sign the package (`debsigs`/`dpkg-sig` are rarely checked). Better: host an **apt repository** (`apt.slipstreamviewer.org`, `reprepro`/`aptly`) with a signed `Release`/`InRelease`, and a `signed-by=` keyring instructions/`.sources` file. Then users get updates via `apt upgrade`. This is the real value for Debian/Ubuntu/Mint users. - **Arch:** sign the PKGBUILD's source tarball (`validpgpkeys=()` + the `.sig` in `source=()` so makepkg verifies it), and later the AUR package. Optionally an Arch binary repo signed with `repo-add --sign`. - **Flatpak (#286):** GPG-sign the self-hosted repo (`flatpak build-update-repo --gpg-sign`) and ship the key in the `.flatpakrepo`/`.flatpakref`. Flathub signs on its own side. - **Tarball:** covered by SHA256SUMS + signature. Optionally an AppImage-style embedded signature if we ever ship an AppImage. ### Key management - Signing subkey (or minisign key) stored as a Forgejo Actions secret, usable only by tag builds on applejack. Primary key offline. Plan for expiry, rotation and revocation (revocation certificate stored offline). - One key for all Linux repos is fine; publish it in one place and reference it everywhere.

sky_line added the

feature

platform

labels

2026-10-04 07:22:37 +00:00

sky_line referenced this issue

2026-10-04 07:22:43 +00:00

Linux: official Flatpak + self-hosted Flatpak repo (then Flathub) for distros without AUR/.deb #286

sky_line referenced this issue

2026-10-04 07:22:43 +00:00

Windows: Authenticode code signing for the viewer and installer (SmartScreen / AV) #287

sky_line commented

2026-10-04 07:22:43 +00:00

Author

Owner

Windows counterpart: #287. Flatpak repo: #286.

sky_line referenced this issue from a commit

2026-10-04 08:28:25 +00:00

Linux: signed releases + signed apt repository (#288)

sky_line referenced this issue from a commit

2026-10-04 08:28:25 +00:00

apt INFRA.md: scope the text/plain MIME override to .sources/.asc (#288)

sky_line referenced this issue from a commit

2026-10-04 08:28:25 +00:00

#286: official Flatpak + self-hosted GPG-signed Flatpak repo

sky_line referenced this issue

2026-10-04 12:22:27 +00:00

Update check: notify when a new Slipstream version is available (foundation for an auto-updater) #293

sky_line commented

2026-10-05 13:33:19 +00:00

Author

Owner

Done: releases ship SHA256SUMS + a detached signature and a signed tarball; the apt repo and Flatpak repo are signed with the release key; the key is published (keyserver, keys.openpgp.org, website). Windows code signing is #287; the pacman repo is #419.

sky_line closed this issue

2026-10-05 13:33:19 +00:00

Rows
Columns

Linux: signed releases (SHA256SUMS + signature), signed apt repo, signed Arch/Flatpak artifacts #288

Release signing (all artifacts)

Per-format

Key management