Creating a release of a free software project with PGP signatures is quite simple, especially if you have everything set up already. This guide uses GnuPG, but it should be roughly applicable to OpenPGP or other implementations. For completeness, I've included a (very) short introduction to how to create a PGP key and how PGP works.
gz-c
/ how-to-pgp-release.md
Created
March 19, 2018 16:24
— forked from cyphar/how-to-pgp-release.md
Document describing how to create PGP-signed releases of projects.
gz-c
/ gist:f7cbc0b091a7d74d343448603bc62343
Created
March 23, 2018 11:13
— forked from atoponce/gist:07d8d4c833873be2f68c34f9afc5a78a
Cryptographic Best Practices
The only way to encrypt today is authenticated encryption, or "AEAD". ChaCha20-Poly1305 is faster in software than AES-GCM. AES-GCM will be faster than ChaCha20-Poly1305 with AES-NI. Poly1305 is also easier than GCM for library designers to implement safely. AES-GCM is the industry standard.
Use, in order of preference:
- The NaCl/libsodium default