What is this PGP thing, and how can I use it?
summary
Workshop shows how to install gpgtools from a USB or gpgtools.org, generate a 4096‑bit PGP key with a one‑year expiry, export a public key to keyservers, and sign git commits so signatures travel with pushes. It walks through upload public keys to keyservers, exchanging fingerprints and checking photo ID before you sign keys after verifying identity, and explains why current gem signing (OpenSSL) is weak and how OpenPGP would improve gem verification.
AI-written summary · about
chapters (10)
- 0:00Start
- 3:27Verify SHA of package against the one published on the website
- 12:27Uses OpenSSL keys
- 12:52Uses certificate authorities
- 16:27Required Reading
- 17:02Aptitude, Homebrew, etc. automate this
- 17:36Need automatic verification before installation
- 20:38Claim Social Accounts
- 25:22Get the key
- 29:08Upload to keyserver
related talks
05mIgnite – Konstantin Ryabitsev
34mSafe and Signed Git Commits with PGP
01h 30mDigital Privacy – low and high hanging fruits, and how to pick them.
26mAn Introduction To pgcrypto
30mPractical (and impractical) git commit signing
29mIdentity-based Source Integrity with Gitsign
38mSecuring Git Repositories with Gittuf
52mPrivacy & Security, Policy & Technology