Brave-browser: Publish code signing keys and signatures for Linux

[bsclifton]

Carried over from https://github.com/brave/browser-laptop/issues/197

We should publish our code signing keys and signatures so that anyone can independently verify them. See https://www.torproject.org/docs/verifying-signatures.html.en for an example of a project that does this.

I also think it's a good idea to sign git tags.

Our current status (browser-laptop):

• we publish the Linux signing keys(used for .deb/.rpm packages)
• many of us sign commits our already (which is reflected on GitHub)

On browser-laptop, end users can check the signature on the installer / binaries:

• macOS can verify by running spctl --assess --verbose /Applications/Brave.app/. If app is signed, it should return something like this:
  /Applications/Brave.app/: accepted source=Developer ID
• Windows Authenticode signature can be checked by right clicking the installer and choosing properties. Once open, go to the Digital Signatures tab and double click on the signature. Make sure it says The digital signature is OK

[diracdeltas]

marking this for releasable builds since we already publish the linux signing keys on the website

as mentioned to @mbacchi and @RyanJarv we will need to rotate the keys for brave-core since they are inadequately secure. we will then need to publish the new keys before release. https://brave.com/signing-keys

[bsclifton]

@mbacchi @RyanJarv I'd love to help with this- hit me up anytime 😄

[bkero]

I've supplied Sampson with the public signing key for our Linux builds. MacOS and Windows builds ongoing.

[bbondy]

This is waiting until closer to release date, but as far as I understand everything is ready to go.

[bbondy]

@jonathansampson has this on staging server for Linux so I'm going to close this issue.
This issue is meant to be blocking only for Linux.

I posted this issue for Windows and macOS though:
https://github.com/brave/brave-browser/issues/1703

If we get it today too that's great and we can close it too, but tracking it in 1.x in the meantime.

[cg505]

Is there any plan to sign git tags?

[bsclifton]

@cg505 that's a good request - I created an issue to track that here (in case you wanted to subscribe):
https://github.com/brave/brave-browser/issues/3243