How-to guides¶

Task-oriented guides. Each one walks through a single concrete task and assumes you already know the basics. Start with Sign and verify your first release if you do not.

Receiving encrypted reports¶

• Receive an encrypted report: publish a KMS-backed certificate, advertise it in security.txt, and read what researchers send you.

The OpenPGP lane: signing checksum manifests¶

• Sign a release artefact: produce a detached OpenPGP signature with the AWS KMS or local PEM backend, dual-sign during a key rotation, and wire it into GitLab CI with AWS OIDC.
• Generate or mint a signing key: generate a fresh keypair locally, or mint an OpenPGP public key from a signer that already exists in KMS.
• Publish a WKD tree: serve your public keys from your own domain, so verifiers can check the copy embedded in a tool against one served from somewhere else.

The minisign lane: signing release artefacts¶

• Sign an artefact for Rust consumers: produce a .minisig artefact signature, emit the public key cargo-binstall and rtb-update pin, and publish it into a keys site with a manifest.

Which lane do I need?¶

Both, if you publish a checksum manifest and downloadable artefacts. They use different key algorithms (RSA for OpenPGP, Ed25519 for minisign), and one key cannot serve both, so a project doing both runs two keys.

The CLI reference has the compatibility table, and What sigillum does not do explains why the two cannot be merged.