NotificationsYou must be signed in to change notification settings
Fork948
Star10.5k

cherry: feat: sign coder binaries with the release key using GPG (#18774)#18867

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

deansheather merged 1 commit intorelease/2.23fromdean/cherry-sigs-2.23

Jul 15, 2025

Merged

cherry: feat: sign coder binaries with the release key using GPG (#18774)#18867

deansheather merged 1 commit intorelease/2.23fromdean/cherry-sigs-2.23

Jul 15, 2025

Conversation

Copy link

Member

deansheather commentedJul 15, 2025

(cherry picked from commitdc0919d)

feat: sign coder binaries with the release key using GPG (#18774)

3fe9f08

### DescriptionThis PR introduces GPG signing for all Coder *slim-binaries*.Detached signatures will allow users to verify the integrity andauthenticity of the binaries they download.### Changes  * `scripts/sign_with_gpg.sh`: New script to sign a given binary     using GPG. It imports the release key, signs the binary, and     verifies the signature.   * `scripts/build_go.sh`: Updated to call `sign_with_gpg.sh` when the     `CODER_SIGN_GPG` environment variable is set to 1.   * `.github/workflows/release.yaml`: The` CODER_SIGN_GPG` environment     variable is now set to 1 during the release build, enabling GPG     signing for all release binaries.   * `.github/workflows/ci.yaml`: The `CODER_SIGN_GPG` environment     variable is now set to 1 during the CI build, enabling GPG     signing for all CI binaries.* `Makefile`: Detached signatures are moved to the `/site/out/bin/`directory(cherry picked from commitdc0919d)