Vscodium: GPG sign for Linux packages

[paulcarroty]

The latest (minimum) Linux packages aren't signed - https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/issues/1

I can sign them with my repository key, but then verifications by checksums will be broken. So, I'd suggest sign them after build like MS did.

[stripedpajamas]

Is the recommendation that we sign the packages with a vscodium gpg key and then you include the same key in your repo?

[paulcarroty]

Yeah. Repository metadata also should be sign with the same key.

• https://blog.packagecloud.io/eng/2014/11/24/howto-gpg-sign-verify-rpm-packages-yum-repositories/
• https://blog.packagecloud.io/eng/2014/10/28/howto-gpg-sign-verify-deb-packages-apt-repositories/

[paulcarroty]

@stripedpajamas you should generate the default key pair. Most tricky moment here - how to sign Gitlab repos with your key.

Alternative way - sign all packages with my repo keys. It breaks checksums verifications but packages can be compared via something like pkgdiff.

[JL2210]

rng-tools should be very useful in generating GPG keys. You could probably generate your own with them

[paulcarroty]

Fixed by https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/commit/f53761c927b3e38f52a0b625748c18ebc89d223e