Verify signatures

Slave tech does not understand security. All these access tokens and 2FA are total bs, which leads to supply chain disasters. You cannot achieve security with legacy account-based architectures that rely on unsigned events.

The real security comes from a modern architecture that relies on Spasm-style direct signing of all events such as messages, files, and code commits.

Most signature verification happens automatically in your software, but manual checks are often necessary for establishing Trust On First Use (TOFU) or verifying specific artifacts. This guide covers manual verification with GPG.

Import a key from one of the sources:

curl -sL https://git.spasm.network/degenrocket.gpg | gpg --import
curl -sL https://codeberg.org/degenrocket.gpg | gpg --import
curl -sL https://github.com/degenrocket.gpg | gpg --import

Verify key fingerprint:

gpg --fingerprint noreply@degenrocket.space

You should see this exact key fingerprint:

pub   ed25519/19896421F4AE9EA4 2020-04-20 [SC]
      Key fingerprint = 0DEA 1743 A674 2F25 CF83  A4E5 1989 6421 F4AE 9EA4
uid                 [ unknown] degenrocket <noreply@degenrocket.space>
sub   cv25519/05F017E01E8CCC9B 2020-04-20 [E]

Verify a message, file, or git commit/tag:

# Verify a message
gpg --verify message.txt

# Verify a message with detached signature
gpg --verify signature.asc message.txt

# Verify the latest git commit
git verify-commit HEAD
# Verify a git commit by hash
git verify-commit <commit-hash>

# Verify the latest tag
git verify-tag $(git describe --tags $(git rev-list --tags --max-count=1))
# Verify a git tag by name
git verify-tag <tag-name>

# Verify a release artifact
gpg --verify artifact.tar.gz.sig artifact.tar.gz

You should see a "good signature" output, but with a different date:

gpg: Signature made Tue Apr 20 00:00:00 2020 UTC
gpg:                using EDDSA key 0DEA1743A6742F25CF83A4E519896421F4AE9EA4
gpg: Good signature from "degenrocket <noreply@degenrocket.space>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 0DEA 1743 A674 2F25 CF83  A4E5 1989 6421 F4AE 9EA4