3 ms·
> signing build artifacts can be harder. Is this like signing an RPM package?
by silly-silly 6y ago
> signing build artifacts can be harder.
Is this like signing an RPM package?
- dathinab 6y agoSomewhat. It's not really hard just a bit harder. Mainly on your desktop system you can easily use a hardware security key (like a yubikey) to get a good level of signing security. But your CI server has a good chance to not be your own hardware so you can't plug in a yubikey so to have good key security you either need to find a CI server where you have a HSM or you need to have some form of signing server/service to keep your private key save. You also should at least consider things like "could the artifact be changed in between your CI creating it and your build signing server/IP-based HSM signing it". There are ways to handle it, with different benefits and drawbacks. And considering and understanding this things is maybe the biggest additional amount of work. Or you use a schema-F solution which seems reasonable without understanding it and be okey with it.