How-to guides¶

Task-oriented guides. Each one walks through a single concrete task and assumes you already know the basics — start with Sign and verify your first release if you do not.

Receiving encrypted reports¶

• Receive an encrypted report — publish a KMS-backed certificate, advertise it in security.txt, and read what researchers send you.

The OpenPGP lane — signing checksum manifests¶

• Sign a release artefact — produce a detached OpenPGP signature with the AWS KMS or local PEM backend, dual-sign during a key rotation, and wire it into GitLab CI with AWS OIDC.
• Generate or mint a signing key — generate a fresh keypair locally, or mint an OpenPGP public key from a signer that already exists in KMS.
• Publish a WKD tree — serve your public keys from your own domain so verifiers can cross-check them against an externally-administered copy.

The minisign lane — signing release artefacts¶

• Sign an artefact for Rust consumers — produce a .minisig artefact signature, emit the public key cargo-binstall and rtb-update pin, and publish it into a keys site with a manifest.

Which lane do I need?¶

Both, if you publish a checksum manifest and downloadable artefacts. They use different key algorithms — RSA for OpenPGP, Ed25519 for minisign — and one key cannot serve both, so a project doing both runs two keys.

The CLI reference has the compatibility table, and What sigillum does not do explains why the two cannot be merged.