Skip to content

esrp: use new Linux signing key #2373

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mjcheetham merged 3 commits into from
Jul 7, 2026
Merged

esrp: use new Linux signing key #2373

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dcb5fd1
linux: use the appropriate PGP key to sign the Debian packages
dscho Jul 7, 2026
ac43912
linux: adjust the instructions how to verify the signatures
dscho Jul 7, 2026
cd57ef8
linux: fix instructions where to download the latest archive
dscho Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .azure-pipelines/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -639,7 +639,7 @@ extends:
inlineOperation: |
[
{
"KeyCode": "CP-453387-Pgp",
"KeyCode": "CP-500207-Pgp",
"OperationCode": "LinuxSign",
"ToolName": "sign",
"ToolVersion": "1.0",
Expand Down
42 changes: 17 additions & 25 deletions docs/linux-validate-gpg.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,46 +10,42 @@ the latest Debian package and/or tarball signature.
apt-get install -y curl debsig-verify

# Download public key signature file
curl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \
| grep -E 'browser_download_url.*gcm-public.asc' \
| cut -d : -f 2,3 \
| tr -d \" \
| xargs -I 'url' curl -L -o gcm-public.asc 'url'
curl -Os https://packages.microsoft.com/keys/microsoft-2025.asc

# De-armor public key signature file
gpg --output gcm-public.gpg --dearmor gcm-public.asc
gpg --output microsoft-2025.gpg --dearmor microsoft-2025.asc

# Note that the fingerprint of this key is "3C853823978B07FA", which you can
# Note that the fingerprint of this key is "EE4D7792F748182B", which you can
# determine by running:
gpg --show-keys gcm-public.asc | head -n 2 | tail -n 1 | tail -c 17
gpg --show-keys microsoft-2025.asc | head -n 2 | tail -n 1 | tail -c 17

# Copy de-armored public key to debsig keyring folder
mkdir /usr/share/debsig/keyrings/3C853823978B07FA
mv gcm-public.gpg /usr/share/debsig/keyrings/3C853823978B07FA/
mkdir /usr/share/debsig/keyrings/EE4D7792F748182B
mv microsoft-2025.gpg /usr/share/debsig/keyrings/EE4D7792F748182B/

# Create an appropriate policy file
mkdir /etc/debsig/policies/3C853823978B07FA
cat > /etc/debsig/policies/3C853823978B07FA/generic.pol << EOL
mkdir /etc/debsig/policies/EE4D7792F748182B
cat > /etc/debsig/policies/EE4D7792F748182B/generic.pol << EOL
<?xml version="1.0"?>
<!DOCTYPE Policy SYSTEM "https://www.debian.org/debsig/1.0/policy.dtd">
<Policy xmlns="https://www.debian.org/debsig/1.0/">

<Origin Name="Git Credential Manager" id="3C853823978B07FA" Description="Git Credential Manager public key"/>
<Origin Name="Git Credential Manager" id="EE4D7792F748182B" Description="Git Credential Manager public key"/>

<Selection>
<Required Type="origin" File="gcm-public.gpg" id="3C853823978B07FA"/>
<Required Type="origin" File="microsoft-2025.gpg" id="EE4D7792F748182B"/>
</Selection>

<Verification MinOptional="0">
<Required Type="origin" File="gcm-public.gpg" id="3C853823978B07FA"/>
<Required Type="origin" File="microsoft-2025.gpg" id="EE4D7792F748182B"/>
</Verification>

</Policy>
EOL

# Download Debian package
# Download Debian package (substitute `x64` with `arm64` on ARM machines)
curl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \
| grep "browser_download_url.*deb" \
| grep "browser_download_url.*-x64-.*deb" \
| cut -d : -f 2,3 \
| tr -d \" \
| xargs -I 'url' curl -L -o gcm.deb 'url'
Expand All @@ -61,24 +57,20 @@ debsig-verify gcm.deb
## Tarball
```shell
# Download the public key signature file
curl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \
| grep -E 'browser_download_url.*gcm-public.asc' \
| cut -d : -f 2,3 \
| tr -d \" \
| xargs -I 'url' curl -L -o gcm-public.asc 'url'
curl -Os https://packages.microsoft.com/keys/microsoft-2025.asc

# Import the public key
gpg --import gcm-public.asc
gpg --import microsoft-2025.asc

# Download the tarball and its signature file
curl -s https://api.github.com/repos/ldennington/git-credential-manager/releases/latest \
curl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \
| grep -E 'browser_download_url.*gcm-linux.*[0-9].[0-9].[0-9].tar.gz' \
| cut -d : -f 2,3 \
| tr -d \" \
| xargs -I 'url' curl -LO 'url'

# Trust the public key
echo -e "5\ny\n" | gpg --command-fd 0 --expert --edit-key 3C853823978B07FA trust
echo -e "5\ny\n" | gpg --command-fd 0 --expert --edit-key EE4D7792F748182B trust

# Verify the signature
gpg --verify gcm-linux_amd64*.tar.gz.asc gcm-linux*.tar.gz
Expand Down
Loading