Repository navigation
chore(release): the release manager's tag-signing key - #27
Merged
Merged
Conversation
Adds the lead maintainer's SSH key for release tags to .github/allowed_signers (SHA256:HqIaFq/thUm844NjYC3a+4Br40cqD2yJHEq1L2iiw4E, also in MAINTAINERS.md). It's a key made only for tags, with the project's address as its comment: the GPG key that signs the maintainer's commits carries personal email addresses, and publishing a key publishes its user IDs. tag-release.sh gains --ssh-key FILE, which signs that one tag with the SSH key without changing how git signs commits. docs/stores.md now says to do it that way: its old advice, setting gpg.format ssh globally, would have switched commit signing to the tag key too. A test signs with --ssh-key while the repository is set up for GPG, and checks that its settings are untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What (Linear SCR-419)
.github/allowed_signers: SSH ed25519SHA256:HqIaFq/thUm844NjYC3a+4Br40cqD2yJHEq1L2iiw4E, commentdev@scriptkittyos.com, also listed in MAINTAINERS.md. Until now the file was empty, and every release tag was refused.scripts/tag-release.sh --ssh-key FILEsigns that one tag with the SSH key (git -c gpg.format=ssh -c user.signingkey=FILE tag -s), leaving how git signs commits untouched.docs/stores.md:git config --global gpg.format ssh) would have switched commit signing to the tag key too. It now says to make a tag-only key with the project's address and use--ssh-key, and warns that exporting a GPG key publishes its user IDs.scripts/tag-release.sh --rc 1 --ssh-key ~/.ssh/kotiko_release.pub.--ssh-keysigns, verifies and pushes, and the repo'sgpg.formatis unchanged. A missing file, or no key at all, gets a clear error.Checked
node --test test/unit/release-tags.test.mjs(9 pass), shellcheck,npm run lint(0 errors),reuse lint,check-old-name,bestpractices-links --check. The key line was read from~/.ssh/kotiko_release.pubitself and its fingerprint checked withssh-keygen -lf.🤖 Generated with Claude Code