feat: add GPG signing for release PDFs - #39
Open
nisfeb wants to merge 1 commit into
Open
Conversation
Add detached-signature tooling so anyone can confirm a GhostNet PDF is the genuine S2 Underground release, even when the file travels off GitHub by radio or sneakernet. Addresses issue s2underground#13. A detached .asc is committed beside each PDF and travels with it, which serves the real threat model (forged PDFs circulating offline) better than git commit or tag signing would. - sign-ghostnet.sh: signer produces a detached armored signature. - verify-ghostnet.sh: anyone imports the bundled key into a throwaway keyring, sees the fingerprint to cross-check, and verifies. - selftest.sh: proves the logic with an ephemeral key, no network. - hooks/pre-commit: optional auto-sign for the signer (opt-in). - README: trust model and out-of-band key publication guidance. No public key is bundled; verify fails clearly until S2 Underground publishes a key, so trust rests on an out-of-band fingerprint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Takes a crack at #13 using a model I've used many times in the past with success. The concern raised is around fake copies of the manual going around with altered info, once it's off GitHub and moving by radio or hand to hand. So this signs the PDF itself with a detached signature that rides along with the file, rather than signing git commits or tags, which only help people who pull it from GitHub.
What's here:
signing/sign-ghostnet.shmakes the signature, one per PDF. @s2underground runs it.signing/verify-ghostnet.shis what everyone else runs to check a file. It loads the s2underground key into a scratch keyring, prints the fingerprint, and says OK or FAIL.signing/selftest.shproves the two scripts work using a throwaway key, so a reviewer can run it without needing your real key.hooks/pre-commitis optional.It re-signs a PDF whenever s2underground commits a change to it. Just a small convenience over remembering to sign each time.signing/README.mdwalks through this.A good signature means the PDF matches the key sitting in this repo, and anyone can fork the repo and drop in their own key. So the whole thing only means something if people can check your key's fingerprint somewhere a forger can't touch. I suggest something like:
Until s2underground publishes a key,
verifyjust tells the user it's not set up yet. To switch it on: publish a fingerprint, export a public key to signing/GHOSTNET-signing-key.asc, run the sign script, commit the .asc files.