Can't find release gpg key

[mdbooth]

I see checksums.txt has a detached signature in the release artifacts, which is great. However, I can't find the key anywhere to verify it. Is it published somewhere?

> gpg --verify checksums.txt.sig
gpg: assuming signed data in 'checksums.txt'
gpg: Signature made Wed 07 Dec 2022 01:40:32 PM GMT
gpg:                using RSA key 81DF3546AA43EB287D276C87D1F231005DCF1180
gpg:                issuer "github-bot@hetzner-cloud.de"
gpg: Can't check signature: No public key

> gpg --recv-key 81DF3546AA43EB287D276C87D1F231005DCF1180
gpg: keyserver receive failed: No data

Possibly related to #120 and #209.

Could the key be posted somewhere obvious? Apologies if it is and I've just missed it!

[apricote]

Hey @mdbooth,

you can find the key on keys.openpgp.org:

• https://keys.openpgp.org/search?q=81DF3546AA43EB287D276C87D1F231005DCF1180
• https://keys.openpgp.org/search?q=github-bot@hetzner-cloud.de

[mdbooth]

Thanks! It would be good to see it posted somewhere canonical. Not 100% sure what the best practise is, but maybe:

• Checked into the repo itself with a docs link ("releases will be signed by docs/hetzner-release-key.asc")
• Served via https with a valid hetzner cert

[github-actions]

This issue has been marked as stale because it has not had recent activity. The bot will close the issue if no further action occurs.

[github-actions]

This issue has been marked as stale because it has not had recent activity. The bot will close the issue if no further action occurs.

[bheisig]

Quick info: GPG can't verify the checksum file anymore. Tested with release 1.38.2:

gpg: BAD signature from "github-bot@hetzner-cloud.de <github-bot@hetzner-cloud.de>" [unknown]

[jooola]

Quick info: GPG can't verify the checksum file anymore. Tested with release 1.38.2:

gpg: BAD signature from "github-bot@hetzner-cloud.de <github-bot@hetzner-cloud.de>" [unknown]

Should be fixed in 1.38.3

[kranurag7]

@apricote would you and the team be open to a patch that allows signing our artifacts using cosign? I think this way we will avoid having problems with importing GPG keys.
We can extend our existing goreleaser config to enable that.
Ref: https://goreleaser.com/customization/sign/#signing-with-cosign