Switch release signing to an RSA-4096 key

rpm 4.14 (RHEL/CentOS/Rocky 8) cannot import an Ed25519 public key at all:
the import fails and package verification reports SIGNATURES NOT OK. RHEL 8
is supported until 2029 and is a realistic target for a signed package repo,
so the Ed25519 key excludes a large part of the rpm audience.

Publish an RSA-4096 signing key as 3proxy-release-key.asc and keep the old
Ed25519 key as 3proxy-release-key-ed25519.asc so artifacts up to 0.9.9 stay
verifiable. Workflows derive the key id from the imported secret key, so no
workflow change is needed.

.github/workflows/build-rpm-arm64.yml

@@ -6,12 +6,14 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     name: "${{ matrix.target }}"
     strategy:
       matrix:
@@ -51,12 +53,6 @@ jobs:
       with:
        name: "3proxy-${{ env.RELEASE }}-arm64.rpm"
        path: "*.rpm"
-    - name: Upload rpm to release
-      if: github.event_name == 'release'
-      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm64.rpm
     - name: debbuild
       run: |
         ret=`pwd`
@@ -77,12 +73,68 @@ jobs:
       with:
        name: "3proxy-${{ env.RELEASE }}-arm64.deb"
        path: "*.deb"
-    - name: Upload deb to release
+    - name: Import signing key
       if: github.event_name == 'release'
       env:
-       GH_TOKEN: ${{ github.token }}
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-       TAG: ${{ github.event.release.tag_name }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm64.deb
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
+       printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
+       gpgconf --kill gpg-agent || true
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
+       echo prime > /tmp/prime.txt
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
+       rm -f /tmp/prime.txt
+    - name: Sign rpm
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       GPGBIN=$(command -v gpg)
+       if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
+       umask 077
+       printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
+       echo test > /tmp/signtest
+       gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
+           -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
+       echo "key can sign"
+       { echo "%_gpg_name $GPG_KEYID"
+         echo "%__gpg $GPGBIN"
+         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
+       } > ~/.rpmmacros
+       rpm --addsign *.rpm
+       rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
+       for f in *.rpm; do
+         sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
+         case "$sig" in ""|"(none)")
+           echo "$f is not signed"
+           echo "--- rpm version ---"; rpm --version
+           echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
+           echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
+           exit 1 ;;
+         esac
+         echo "$f: $sig"
+       done
+    - name: Checksums and detached signatures
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       sha256sum *.rpm *.deb > SHA256SUMS-arm64
+       for f in *.deb SHA256SUMS-arm64; do
+         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+             -u "$GPG_KEYID" --armor --detach-sign "$f"
+       done
+       sha256sum -c SHA256SUMS-arm64
+       gpg --verify SHA256SUMS-arm64.asc SHA256SUMS-arm64
     - name: Attest build provenance
       if: github.event_name == 'release'
       uses: actions/attest-build-provenance@v2
@@ -90,3 +142,9 @@ jobs:
         subject-path: |
           *.rpm
           *.deb
+    - name: Upload to release
+      if: github.event_name == 'release'
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm64 SHA256SUMS-arm64.asc

.github/workflows/build-rpm-armhf.yml

@@ -6,12 +6,14 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     name: "${{ matrix.target }}"
     strategy:
       matrix:
@@ -78,12 +80,6 @@ jobs:
       with:
        name: "3proxy-${{ env.RELEASE }}-arm.rpm"
        path: "*.rpm"
-    - name: Upload rpm to release
-      if: github.event_name == 'release'
-      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm.rpm
     - name: debbuild
       run: |
         ret=`pwd`
@@ -110,12 +106,68 @@ jobs:
       with:
        name: "3proxy-${{ env.RELEASE }}-arm.deb"
        path: "*.deb"
-    - name: Upload deb to release
+    - name: Import signing key
       if: github.event_name == 'release'
       env:
-       GH_TOKEN: ${{ github.token }}
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-       TAG: ${{ github.event.release.tag_name }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm.deb
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
+       printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
+       gpgconf --kill gpg-agent || true
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
+       echo prime > /tmp/prime.txt
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
+       rm -f /tmp/prime.txt
+    - name: Sign rpm
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       GPGBIN=$(command -v gpg)
+       if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
+       umask 077
+       printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
+       echo test > /tmp/signtest
+       gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
+           -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
+       echo "key can sign"
+       { echo "%_gpg_name $GPG_KEYID"
+         echo "%__gpg $GPGBIN"
+         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
+       } > ~/.rpmmacros
+       rpm --addsign *.rpm
+       rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
+       for f in *.rpm; do
+         sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
+         case "$sig" in ""|"(none)")
+           echo "$f is not signed"
+           echo "--- rpm version ---"; rpm --version
+           echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
+           echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
+           exit 1 ;;
+         esac
+         echo "$f: $sig"
+       done
+    - name: Checksums and detached signatures
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       sha256sum *.rpm *.deb > SHA256SUMS-arm
+       for f in *.deb SHA256SUMS-arm; do
+         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+             -u "$GPG_KEYID" --armor --detach-sign "$f"
+       done
+       sha256sum -c SHA256SUMS-arm
+       gpg --verify SHA256SUMS-arm.asc SHA256SUMS-arm
     - name: Attest build provenance
       if: github.event_name == 'release'
       uses: actions/attest-build-provenance@v2
@@ -123,3 +175,9 @@ jobs:
         subject-path: |
           *.rpm
           *.deb
+    - name: Upload to release
+      if: github.event_name == 'release'
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc

.github/workflows/build-rpm-x86-64.yml

@@ -6,12 +6,14 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     name: "${{ matrix.target }}"
     strategy:
       matrix:
@@ -51,12 +53,6 @@ jobs:
       with:
        name: "3proxy-${{ env.RELEASE }}-x86_64.rpm"
        path: "*.rpm"
-    - name: Upload rpm to release
-      if: github.event_name == 'release'
-      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.x86_64.rpm
     - name: debbuild
       run: |
         ret=`pwd`
@@ -77,13 +73,69 @@ jobs:
       with:
        name: "3proxy-${{ env.RELEASE }}-x86_64.deb"
        path: "*.deb"
-    - name: Upload deb to release
+
+    - name: Import signing key
       if: github.event_name == 'release'
       env:
-       GH_TOKEN: ${{ github.token }}
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-       TAG: ${{ github.event.release.tag_name }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.x86_64.deb
+      run: |
-
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
+       printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
+       gpgconf --kill gpg-agent || true
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
+       echo prime > /tmp/prime.txt
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
+       rm -f /tmp/prime.txt
+    - name: Sign rpm
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       GPGBIN=$(command -v gpg)
+       if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
+       umask 077
+       printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
+       echo test > /tmp/signtest
+       gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
+           -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
+       echo "key can sign"
+       { echo "%_gpg_name $GPG_KEYID"
+         echo "%__gpg $GPGBIN"
+         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
+       } > ~/.rpmmacros
+       rpm --addsign *.rpm
+       rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
+       for f in *.rpm; do
+         sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
+         case "$sig" in ""|"(none)")
+           echo "$f is not signed"
+           echo "--- rpm version ---"; rpm --version
+           echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
+           echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
+           exit 1 ;;
+         esac
+         echo "$f: $sig"
+       done
+    - name: Checksums and detached signatures
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       sha256sum *.rpm *.deb > SHA256SUMS-x86_64
+       for f in *.deb SHA256SUMS-x86_64; do
+         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+             -u "$GPG_KEYID" --armor --detach-sign "$f"
+       done
+       sha256sum -c SHA256SUMS-x86_64
+       gpg --verify SHA256SUMS-x86_64.asc SHA256SUMS-x86_64
     - name: Attest build provenance
       if: github.event_name == 'release'
       uses: actions/attest-build-provenance@v2
@@ -91,3 +143,9 @@ jobs:
         subject-path: |
           *.rpm
           *.deb
+    - name: Upload to release
+      if: github.event_name == 'release'
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-x86_64 SHA256SUMS-x86_64.asc

.github/workflows/build-watcom.yml

@@ -6,12 +6,14 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     name: "${{ matrix.target }}"
     strategy:
       matrix:
@@ -88,16 +90,30 @@ jobs:
       if: github.event_name == 'release'
       shell: pwsh
       run: Compress-Archive -Path dist/* -DestinationPath 3proxy-${{ env.RELEASE }}-lite.zip
-    - name: Upload to release
+    - name: Checksums and detached signature
       if: github.event_name == 'release'
       shell: bash
       env:
-       GH_TOKEN: ${{ github.token }}
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-       TAG: ${{ github.event.release.tag_name }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-lite.zip
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       sha256sum *.zip > SHA256SUMS-win-lite
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --armor --detach-sign SHA256SUMS-win-lite
+       sha256sum -c SHA256SUMS-win-lite
     - name: Attest build provenance
       if: github.event_name == 'release'
       uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.zip
+    - name: Upload to release
+      if: github.event_name == 'release'
+      shell: bash
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.zip SHA256SUMS-win-lite SHA256SUMS-win-lite.asc

.github/workflows/build-win32.yml

@@ -6,12 +6,14 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     name: "${{ matrix.target }}"
     strategy:
       matrix:
@@ -103,16 +105,30 @@ jobs:
       if: github.event_name == 'release'
       shell: pwsh
       run: Compress-Archive -Path dist/* -DestinationPath 3proxy-${{ env.RELEASE }}-x86.zip
-    - name: Upload to release
+    - name: Checksums and detached signature
       if: github.event_name == 'release'
       shell: bash
       env:
-       GH_TOKEN: ${{ github.token }}
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-       TAG: ${{ github.event.release.tag_name }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-x86.zip
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       sha256sum *.zip > SHA256SUMS-win-x86
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --armor --detach-sign SHA256SUMS-win-x86
+       sha256sum -c SHA256SUMS-win-x86
     - name: Attest build provenance
       if: github.event_name == 'release'
       uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.zip
+    - name: Upload to release
+      if: github.event_name == 'release'
+      shell: bash
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.zip SHA256SUMS-win-x86 SHA256SUMS-win-x86.asc

.github/workflows/build-win64.yml

@@ -6,12 +6,14 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     name: "${{ matrix.target }}"
     strategy:
       matrix:
@@ -104,16 +106,30 @@ jobs:
       if: github.event_name == 'release'
       shell: pwsh
       run: Compress-Archive -Path dist/* -DestinationPath 3proxy-${{ env.RELEASE }}-x64.zip
-    - name: Upload to release
+    - name: Checksums and detached signature
       if: github.event_name == 'release'
       shell: bash
       env:
-       GH_TOKEN: ${{ github.token }}
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-       TAG: ${{ github.event.release.tag_name }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-x64.zip
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       sha256sum *.zip > SHA256SUMS-win-x64
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --armor --detach-sign SHA256SUMS-win-x64
+       sha256sum -c SHA256SUMS-win-x64
     - name: Attest build provenance
       if: github.event_name == 'release'
       uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.zip
+    - name: Upload to release
+      if: github.event_name == 'release'
+      shell: bash
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.zip SHA256SUMS-win-x64 SHA256SUMS-win-x64.asc

.github/workflows/build-winarm64.yml

@@ -6,12 +6,14 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     name: "${{ matrix.target }}"
     strategy:
       matrix:
@@ -103,16 +105,30 @@ jobs:
       if: github.event_name == 'release'
       shell: pwsh
       run: Compress-Archive -Path dist/* -DestinationPath 3proxy-${{ env.RELEASE }}-arm64.zip
-    - name: Upload to release
+    - name: Checksums and detached signature
       if: github.event_name == 'release'
       shell: bash
       env:
-       GH_TOKEN: ${{ github.token }}
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-       TAG: ${{ github.event.release.tag_name }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-arm64.zip
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       sha256sum *.zip > SHA256SUMS-win-arm64
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --armor --detach-sign SHA256SUMS-win-arm64
+       sha256sum -c SHA256SUMS-win-arm64
     - name: Attest build provenance
       if: github.event_name == 'release'
       uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.zip
+    - name: Upload to release
+      if: github.event_name == 'release'
+      shell: bash
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.zip SHA256SUMS-win-arm64 SHA256SUMS-win-arm64.asc

.github/workflows/docker.yml

@@ -7,9 +7,6 @@ on:
 
 permissions:
   contents: read
-  packages: write
-  id-token: write
-  attestations: write
 
 env:
   DOCKERHUB_IMAGE: docker.io/3proxy/3proxy
@@ -18,6 +15,9 @@ env:
 jobs:
   build:
     name: ${{ matrix.image }} ${{ matrix.platform }}
+    permissions:
+      contents: read
+      packages: write
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
@@ -81,6 +81,11 @@ jobs:
 
   publish:
     name: Publish ${{ matrix.image }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     runs-on: ubuntu-latest
     needs: build
     strategy:

3proxy-release-key-ed25519.asc

@@ -0,0 +1,10 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEaogJthYJKwYBBAHaRw8BAQdA8rZ4l90kTOSrlosP0yyeX6jFGfiFFizawjS0
+vyQnmu60KjNwcm94eSByZWxlYXNlIHNpZ25pbmcgPDNwcm94eUAzcHJveHkub3Jn
+PoivBBMWCgBXFiEEvHxfo3tIuOfF5ScUw2JYsMbAg6oFAmqICbYbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheA
+AAoJEMNiWLDGwIOqBHIA/iRus5VEqL+v6nYQ+GDLDUZJzMfFcnDBI+BOOhiESnTp
+AP4s3uvhigRcdutxkYwSXBlJ+7wE1yZeuUmjPoJXvgNaDw==
+=Ngp2
+-----END PGP PUBLIC KEY BLOCK-----

3proxy-release-key.asc

@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGqIZCIBEADF3zxdMo2dvUGAlQm3aIcQiqmpLMHucvLfSK3fHtwagO8f03CO
+bEx9EfIK/U6BzLwEJ0CxyClzfvgo9COVpi5EjES9sI2LXzcgc4hGaYO0Q4Unj//0
+W/G8aarDaLF2NRKMLf07eaYGBRJjqHnmeHgOHdr+SnN0JtMSadWMHoliB8esnabz
+5CO4JabTrhwoez3DMLSgJNIod7wL6PJJv/2BeRahwNr2CjaXmzZKr/j7fc1MKLij
+bsvJ5OmLmngZr6CHDa9cBhVhiH+7RgWLCsRlEGxEv7w0afp/T0xDwNAPkGzk5ObC
+BrdXvypTAbNyUoVT8qSVJwkneZ4S0Ts4rRRNfNpaus4tsCmgyGKzsrbxvbiBOTPW
+jB/fjkgr6X9M/AQ3yGpXrwXRJrM/nSfjUyOEHXttTC9HpGt41NH/mpC4mDWa1Kxi
+FMxuo1+dw2kpDKl0Bp78IGdCo5akHwftFr8aHgmfZoGXAGJRHPAWbJGjC2ARy8yp
+QOpxba0S3VlCU6bs8MDKl6cpWItnlXcl/GD/Qc55bjLXjFv1pbn2RUSYZS+n9wDX
+64syZf3dZ/N5U4ydmybWfiLFUXqKQLtdO8QAWQGt4TSwKptTmI581/MMCTQ8qWZL
+zgFj6C/8K0SZ4lMOv+5zfc2+QOoWw7E2Ws3stEKTyWjOMm/QMJAGumqvqwARAQAB
+tCozcHJveHkgcmVsZWFzZSBzaWduaW5nIDwzcHJveHlAM3Byb3h5Lm9yZz6JAm0E
+EwEIAFcWIQT8EiFEmfzHuhz/bNwDEjhOOnOUCwUCaohkIhsUgAAAAAAEAA5tYW51
+MiwyLjUrMS4xMiwwLDMCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQ
+AxI4TjpzlAsCwRAAtH3OO42yCd2B8Od4yS1yBDkaIFwEm8hF68eou6uaSDkKG8YZ
+C3DUH7qk0nXEMQu/5J6RWZKlW1C8D3AkUR9A1g54o6mUg4IL5196XsrQRdVu64YF
+nLCk17Piku1lMk+Re6bZ6uJv5UlSv8d0dvxmAYzjusyPyBC2VXy7B0CoDif6AmXt
+aw2/V6m0dRrfFo4W9mJKUqTAJcdBOKzEiQb7qLnzuwy4CB5qsvnEQTqymoCXFXzg
+VDCSKRLXnbDPbIs0TvsCmthn/w1hCgftPq4W0s7EUJBOhbrjF59+AuTb+U1wIXNR
+1+DPF+V+5RlwWjOWMlsOVGk2jaxjVY8wuaD3rE6ISJkt1pRv/WVdY984rT7Eu94J
+ZHnxPjFrb2ohFKjoBCt60kbgZbuQ6yvEma5lAF9K63gwMNNyGZvq6QWl58iouzuS
+3B9t7EwGwFstJfaXVhn/rnIHoExgxVZMbbsmXiGJyE2KcfVmlZcEi0MIyqEeBSDD
+gjpE4yVO6StBtJKfXra8rMwtsbWBw9MptPhcLvdWtN6TG0CxDyTHhdL1pSLNcwX1
+CTVpwi6+WmGogcv0WFNn5caQUpu9le/v/5qLRK08KWOH8inMJmTfpJg/9869YJuF
+vDKdzJd6jug5YQRfV/7YVC2hdSOBLvBuDpRINePrj9CKJ34qG+jRSJ5xwYk=
+=IS3Y
+-----END PGP PUBLIC KEY BLOCK-----

README.md

@@ -6,8 +6,8 @@
 
 ### Branches
 
-- **Master** (stable) branch - 3proxy 1.0
+- **Master** (current/latest) branch - 3proxy 1.0
-- **0.9** (LTS) branch - 3proxy 0.9.9
+- **0.9** (LTS) branch - 3proxy 0.9.9.x
 - **Devel** branch - 3proxy 2.0-devel (don't use it)
 
 ### Binaries (deb / rpm / Windows zip)
@@ -30,7 +30,9 @@ Documentation (man pages and HTML) available with download, on https://3proxy.or
 
 ## Docker images
 
-3 docker configurations are provided, default (full) also tagged as `:latest`, `:busybox` and `:minimal`, all refer to newest stable version. Except busybox, images are distroless and contain only binaries, you can not sh inside the container. `:busybox` contains busybox shell.
+3 docker configurations are provided, default (full) also tagged as `:latest`, `:busybox` and `:minimal`, all refer to newest stable version. Except busybox, images are distroless and contain only binaries, you can not sh inside the container. `:busybox` contains busybox shell. Images are based on current (master) branch.
+
+Images marked as LTS (`:lts`, `:lts-busybox`, `:lts-minimal`) are built from LTS branch (0.9.9.x)
 
 ### Default image (`:latest`):
 

SECURITY.md

@@ -12,3 +12,59 @@
 Report to 3proxy@3proxy.org or via [GitHub security reporting](https://github.com/3proxy/3proxy/security)
 
 For High/Critical patched version is released within 2 weeks
+
+## Verifying downloads
+
+Release binaries are published with SHA256 checksums, an OpenPGP signature and
+a GitHub build provenance attestation.
+
+The release signing key is `3proxy-release-key.asc` in the root of this
+repository, an RSA-4096 key:
+
+```
+pub   rsa4096 2026-08-21 [SC]
+      FC12 2144 99FC C7BA 1CFF  6CDC 0312 384E 3A73 940B
+uid   3proxy release signing <3proxy@3proxy.org>
+```
+
+Import it once:
+
+```
+gpg --import 3proxy-release-key.asc
+```
+
+Releases up to and including 0.9.9 were signed with an Ed25519 key, kept as
+`3proxy-release-key-ed25519.asc` for verifying those older files. Note that
+rpm 4.14 and earlier (RHEL/CentOS 8 and older) cannot import an Ed25519 key
+and will report `SIGNATURES NOT OK`; use the RSA key and 0.9.9.1 or later on
+those systems.
+
+Checksums and the checksum file signature:
+
+```
+gpg --verify SHA256SUMS-x86_64.asc SHA256SUMS-x86_64
+sha256sum -c SHA256SUMS-x86_64
+```
+
+RPM packages are signed, the signature is checked by rpm itself:
+
+```
+sudo rpm --import 3proxy-release-key.asc
+rpm -K 3proxy-0.9.9.x86_64.rpm
+```
+
+DEB packages are published with a detached signature:
+
+```
+gpg --verify 3proxy-0.9.9.x86_64.deb.asc 3proxy-0.9.9.x86_64.deb
+```
+
+Build provenance (which workflow, commit and runner produced the file) is
+verified with the GitHub CLI:
+
+```
+gh attestation verify 3proxy-0.9.9.x86_64.rpm --owner 3proxy
+gh attestation verify oci://docker.io/3proxy/3proxy:latest --owner 3proxy
+```
+
+Windows binaries are Authenticode signed in addition to the above.