Where to get the code signing key?

[htgoebel]

Hi,

the archives at PyPi seem to be signed — which is good, many thanks for this: Anyhow I would appreciate to have the Fingerprint of the signing key documented in the manual or Readme as well as where to get the public key.

Many Thanks.

Keywords: GnuPG PGP GPG code signing

[MartinThoma]

I'm uncertain what to share. Maybe those two?

$ gpg --keyserver hkp://keyserver.ubuntu.com --search-key '[email protected]'
gpg: data source: http://162.213.33.8:11371
(1)	Martin Thoma (Created 2015-01-18) <[email protected]>
	  4096 bit RSA key 4832A5B4EFE81152, created: 2015-01-18
(2)	Martin Thoma (Generated on 2021-01-15 for private use) <info@martin-th
	  4096 bit RSA key 6901E782EF663EC4, created: 2021-01-15
Keys 1-2 of 2 for "[email protected]".  Enter number(s), N)ext, or Q)uit > 2
gpg: key 6901E782EF663EC4: "Martin Thoma (Generated on 2021-01-15 for private use) <[email protected]>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

and

$ gpg --export -a $GPGKEY
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGABTesBEADowAufz/CfLAZ4DlgxpopnJkENGJ9+yDyNVtOQGpMjEGj/K5h0
BcPKACnXmZWb08la/N9DDODxI8qSJFKbGzsSqpl8O9TyVWMZJmGZLaHSr1VZwVzl
CLunqxMyqpmEm04yAPIbtbSF2iIeN4ZDJMLzuGWE3uOoLj2WHi1VvIsmFNrnAi74
X/vTqppwSmNN/9mIEqk3C2gYGNCwSkA44SHy+Mfup70EJuisonk2pUnvQzJE4uv2
rTSUVYQnxxrrCO3LMM7FITuk+LGhIOfQECNXtdkf30f+oYaHipY8hOoRtMp4l7D4
EQN7gk+6kd2UloGcPrqSJ8kUYfghYKxLDzcZ4dWcGIfM+nNXNOs5gteS7R1Nhjnx
96CFt36mozcwE6Sv+onmUtJ2o9HgVLuKOqhdeYGMmcdLAKogM/XGaa3esg6p+NHF
e63QmwdSIXRW98diJkjM7c5NucQx2Nfkvq+laevY5daGpEVzEdkuCzMJRmRW1Fgv
HYTaE9TfieoG68lcMfe6pbWN8EdFhXvgcwXqT3JfLAgcw/jVN6MjnK7Gf+yoALfV
oLkRn1JtDN1QRgyNJfOdXrowC5wXH0wOdSMNCtiJFzTZqCovshrOquTZA2cGXqNG
+GzOuYXgKR+7VBwcHmLbl3coegEwmoBv8mJggkzCMJhk6l/JWaHmo475PQARAQAB
tE1NYXJ0aW4gVGhvbWEgKEdlbmVyYXRlZCBvbiAyMDIxLTAxLTE1IGZvciBwcml2
YXRlIHVzZSkgPGluZm9AbWFydGluLXRob21hLmRlPokCTgQTAQoAOBYhBNHmMjRr
ZCaA7zYNaWkB54LvZj7EBQJgAU3rAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
AAoJEGkB54LvZj7EAmAQAKkBpqsikQi+5gHunwBALnlOsPsloBviQ8VWqbEiKLmc
aG7ewgh2M99T/HI2h2GcjTdQf+cc3zRzoCgJM9YZIvuhf4+8qpJ2F5Na9SWTGs7i
3qb4z6CeX1hoMxaStWfC5u9cmOuBnq4pM0kse1vF1lme0EjsX3+kThjupM6hNQDy
hhxXte3f9ryj/OxFl2jtFz2ALfaGWXYz7/4GxN9bpjnWMT3vokD7lU726Z2PF17H
0EqQmMWMIBBXXzr3gjzG0XDxU5sww0lzhMVoks5d78VaXVHDgUsRid65J4Eb7kxh
fzPt3xkSlHHNcD0aogEwD5npAZeTFdmeh/sj3SzfGrJYJFHfXFfvZ9jOXw4fQRaL
1sjrojngWAEFrvHaNwlnADEyEIFeJlcOqbUx2YBCkNj1SdoO+hzbtdkRTPYf+o01
KJeUx1Qr+N7G1nnaNIkvPszCFc/5/m9EQCJ4ZEkQy5y4spwTOvuTYiTzqk8O5weS
MB99iLLNKVCKA0XRXtKbQCnRRB6Wbbx5SM3XkL5bjYj/f35YQUbZJeGrYffzoYsG
Xb3ztXJHD1txzgB2RIv8SZT+h512EoHcX27s03WFlMz3YqvJ0z1ZuhLIJ91koxJ+
imPOVLouRGGwdNXUN7QjEh5vd3vDRhkp3DfQ+xE4OREDUJGBgOpAz8LqQgn5rVtm
uQINBGABTesBEADqu7mI921hcTf2y+FSs++hi3xbDLpUFSXVuL/96BKBsMtlglIk
xzge7tNxZyQy1Dycq6WIpRRiFmysXODWZ2ZxcW0c3GVnVC4RwO6b6X1fD6sGsWHq
3HgyFtGy/JU8aaFSZG3HNLbYYEKDCsLuxZFG9fVFG5Mp82g7j/NhZYi773JiJt43
/B4qNatoYPYPBHBsM/OBkMrptpGwSzmY6oycgDOjFgMdQK3KBWpNcV+l05sxtkd6
uxgWmhh/6P5Eaxlvk0brmd4Ww1Vg5dVi9g+/MdyU9ksMv3cHsaXSqcVVDWaXY7jc
b3lI6YDBTDZHTM/gdhClzGi/JU1V4iWpXvVg887s0ZoZRfF/myDow7lFNJ1QBmsv
Y1ix+mfeQrNkO20IkDxgnMsNhCvF2h5FkiQiD4K8GAvr5Yr+Hgm7h/en0KuyxfYs
PReHOp4mlEgUcuB7F86JmZl/sfsAMQJh8SgmsalU53onZTUCMm616d49ecpyZiaC
gGY2QkEaOJjdeSJFgo9XExKUpYRziFbhr0h8qjdtAC0LDapE27M8OH8eyvypvfWp
GFGLqM8fEUOm1FJ4432rYRfql0DNiJSZlEtL0yxLRm1LxijDLTU+xN7YlxUm4Gn5
Exek8+DDj54733d1HkBtDDcrGqqb6PJzaEmNH5dZXSyJapeyI3w4Y5JjKwARAQAB
iQI2BBgBCgAgFiEE0eYyNGtkJoDvNg1paQHngu9mPsQFAmABTesCGwwACgkQaQHn
gu9mPsTqvA//Q5zP/hl66zF2GxFf1l44IO0PnfvqXXx1uf4wgHzMlDqsLlmwYXhZ
78SUR52cq13Mr3nsiNnl4zwRekiLxbV5w50EhGq+kD/sTlaMXibsnK7utxOWidYA
lz3NXKqqOlvk7nhpO0ugXSRYRWrKIz3VeEm/4rkIwjHBr7qkiNIjk5neYHF/MiPc
Xqh0RD8dUU86knZIEJ5haZOS0sMByQ6Oh231n0Js2V9DXxiyPtDjGe7lAl6pAeGd
TaPRilCyLK4f0IGzXhKvCa/x9faE/RnAQztZ8zKjUix/mfdQvHZ89+PMEfdzK0Ot
fBrZfUncNAcfGfWWl/rVEscFmzaOjzyMgOt9CLHFxdtmyg2tYpZWMUe1A4WKPVlA
nUtMrjeQElFuLEe/aESGY5NSXOVsBbNY2nodky6QxZzcwP8AHl0uo9/uWv0mfPh7
pAD2UNV3ALrkCFfmJMOHgimdzPjwVzTB0xKujjBZZWUSDW/hBkK77ZHdFR5QNfNU
Q5q3joieW41Zk1pZ5vyXJpZlGYZ2o9LOfqSHAdnCwejRoxpxtzQ+XgkI9lNRLNUa
GuB3ey5lJw6aeI81ZJeYvLiSb93cGN/txCVZk1cMMFYT3TDQg01UffThctTbyhwV
+0A1u3GYO2/LycLmpOYXApTYvPMsbVGT5UhTu7iM+EzwKKqtqMh0Otw=
=mkP9
-----END PGP PUBLIC KEY BLOCK-----

[MartinThoma]

I would appreciate to have the Fingerprint of the signing key documented in the manual or Readme as well as where to get the public key

Do you know a project where you would say that this is done well? An example would help me a lot.

[htgoebel]

Many thanks for this info.

Do you know a project where you would say that this is done well? An example would help me a lot.

Sorry, I don't know an example. For former releases of PyInstaller I provided the .tar.gz and the .tar.gz.asc file in the Github release. Anyhow I missed providing this info, see https://github.com/pyinstaller/pyinstaller/releases/tag/v4.2

Maybe some thing like this:

Releases ar PyPi are signed with Martin Thoma's PGP/GNUPG key.
The Key-ID is D1E632346B642680EF360D696901E782EF663EC4.
To fetch the public key you can use the following command:

gpg --keyserver hkp://keyserver.ubuntu.com
--recv-keys D1E632346B642680EF360D696901E782EF663EC4