Switch release signing to an RSA-4096 key

rpm 4.14 (RHEL/CentOS/Rocky 8) cannot import an Ed25519 public key at all: the import fails and package verification reports SIGNATURES NOT OK. RHEL 8 is supported until 2029 and is a realistic target for a signed package repo, so the Ed25519 key excludes a large part of the rpm audience. Publish an RSA-4096 signing key as 3proxy-release-key.asc and keep the old Ed25519 key as 3proxy-release-key-ed25519.asc so artifacts up to 0.9.9 stay verifiable. Workflows derive the key id from the imported secret key, so no workflow change is needed.
rpm signing: accept non-RSA signature headers
2026-09-29 16:55:51 +08:00 · 2026-08-21 17:45:09 +03:00 · 2026-08-21 15:33:58 +03:00 · 2026-08-21 13:13:24 +03:00 · 2026-08-21 13:01:47 +03:00 · 2026-08-21 11:25:32 +03:00
11 changed files with 409 additions and 71 deletions
--- a/.github/workflows/build-rpm-arm64.yml
+++ b/.github/workflows/build-rpm-arm64.yml
@ -6,12 +6,14 @@ on:
  workflow_dispatch:

 permissions:
-  contents: write
-  id-token: write
-  attestations: write
+  contents: read

 jobs:
  ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
@ -51,12 +53,6 @@ jobs:
      with:
       name: "3proxy-${{ env.RELEASE }}-arm64.rpm"
       path: "*.rpm"
-    - name: Upload rpm to release
-      if: github.event_name == 'release'
-      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm64.rpm
    - name: debbuild
      run: |
        ret=`pwd`
@ -77,12 +73,68 @@ jobs:
      with:
       name: "3proxy-${{ env.RELEASE }}-arm64.deb"
       path: "*.deb"
-    - name: Upload deb to release
+    - name: Import signing key
      if: github.event_name == 'release'
      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm64.deb
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
+       printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
+       gpgconf --kill gpg-agent || true
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
+       echo prime > /tmp/prime.txt
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
+       rm -f /tmp/prime.txt
+    - name: Sign rpm
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       GPGBIN=$(command -v gpg)
+       if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
+       umask 077
+       printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
+       echo test > /tmp/signtest
+       gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
+           -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
+       echo "key can sign"
+       { echo "%_gpg_name $GPG_KEYID"
+         echo "%__gpg $GPGBIN"
+         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
+       } > ~/.rpmmacros
+       rpm --addsign *.rpm
+       rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
+       for f in *.rpm; do
+         sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
+         case "$sig" in ""|"(none)")
+           echo "$f is not signed"
+           echo "--- rpm version ---"; rpm --version
+           echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
+           echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
+           exit 1 ;;
+         esac
+         echo "$f: $sig"
+       done
+    - name: Checksums and detached signatures
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       sha256sum *.rpm *.deb > SHA256SUMS-arm64
+       for f in *.deb SHA256SUMS-arm64; do
+         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+             -u "$GPG_KEYID" --armor --detach-sign "$f"
+       done
+       sha256sum -c SHA256SUMS-arm64
+       gpg --verify SHA256SUMS-arm64.asc SHA256SUMS-arm64
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
@ -90,3 +142,9 @@ jobs:
        subject-path: |
          *.rpm
          *.deb
+    - name: Upload to release
+      if: github.event_name == 'release'
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm64 SHA256SUMS-arm64.asc
--- a/.github/workflows/build-rpm-armhf.yml
+++ b/.github/workflows/build-rpm-armhf.yml
@ -6,12 +6,14 @@ on:
  workflow_dispatch:

 permissions:
-  contents: write
-  id-token: write
-  attestations: write
+  contents: read

 jobs:
  ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
@ -78,12 +80,6 @@ jobs:
      with:
       name: "3proxy-${{ env.RELEASE }}-arm.rpm"
       path: "*.rpm"
-    - name: Upload rpm to release
-      if: github.event_name == 'release'
-      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm.rpm
    - name: debbuild
      run: |
        ret=`pwd`
@ -110,12 +106,68 @@ jobs:
      with:
       name: "3proxy-${{ env.RELEASE }}-arm.deb"
       path: "*.deb"
-    - name: Upload deb to release
+    - name: Import signing key
      if: github.event_name == 'release'
      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm.deb
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
+       printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
+       gpgconf --kill gpg-agent || true
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
+       echo prime > /tmp/prime.txt
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
+       rm -f /tmp/prime.txt
+    - name: Sign rpm
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       GPGBIN=$(command -v gpg)
+       if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
+       umask 077
+       printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
+       echo test > /tmp/signtest
+       gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
+           -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
+       echo "key can sign"
+       { echo "%_gpg_name $GPG_KEYID"
+         echo "%__gpg $GPGBIN"
+         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
+       } > ~/.rpmmacros
+       rpm --addsign *.rpm
+       rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
+       for f in *.rpm; do
+         sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
+         case "$sig" in ""|"(none)")
+           echo "$f is not signed"
+           echo "--- rpm version ---"; rpm --version
+           echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
+           echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
+           exit 1 ;;
+         esac
+         echo "$f: $sig"
+       done
+    - name: Checksums and detached signatures
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       sha256sum *.rpm *.deb > SHA256SUMS-arm
+       for f in *.deb SHA256SUMS-arm; do
+         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+             -u "$GPG_KEYID" --armor --detach-sign "$f"
+       done
+       sha256sum -c SHA256SUMS-arm
+       gpg --verify SHA256SUMS-arm.asc SHA256SUMS-arm
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
@ -123,3 +175,9 @@ jobs:
        subject-path: |
          *.rpm
          *.deb
+    - name: Upload to release
+      if: github.event_name == 'release'
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc
--- a/.github/workflows/build-rpm-x86-64.yml
+++ b/.github/workflows/build-rpm-x86-64.yml
@ -6,12 +6,14 @@ on:
  workflow_dispatch:

 permissions:
-  contents: write
-  id-token: write
-  attestations: write
+  contents: read

 jobs:
  ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
@ -51,12 +53,6 @@ jobs:
      with:
       name: "3proxy-${{ env.RELEASE }}-x86_64.rpm"
       path: "*.rpm"
-    - name: Upload rpm to release
-      if: github.event_name == 'release'
-      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.x86_64.rpm
    - name: debbuild
      run: |
        ret=`pwd`
@ -77,13 +73,69 @@ jobs:
      with:
       name: "3proxy-${{ env.RELEASE }}-x86_64.deb"
       path: "*.deb"
-    - name: Upload deb to release
+
+    - name: Import signing key
      if: github.event_name == 'release'
      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.x86_64.deb
-
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
+       printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
+       gpgconf --kill gpg-agent || true
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
+       echo prime > /tmp/prime.txt
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
+       rm -f /tmp/prime.txt
+    - name: Sign rpm
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       GPGBIN=$(command -v gpg)
+       if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
+       umask 077
+       printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
+       echo test > /tmp/signtest
+       gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
+           -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
+       echo "key can sign"
+       { echo "%_gpg_name $GPG_KEYID"
+         echo "%__gpg $GPGBIN"
+         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
+       } > ~/.rpmmacros
+       rpm --addsign *.rpm
+       rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
+       for f in *.rpm; do
+         sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
+         case "$sig" in ""|"(none)")
+           echo "$f is not signed"
+           echo "--- rpm version ---"; rpm --version
+           echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
+           echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
+           exit 1 ;;
+         esac
+         echo "$f: $sig"
+       done
+    - name: Checksums and detached signatures
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       sha256sum *.rpm *.deb > SHA256SUMS-x86_64
+       for f in *.deb SHA256SUMS-x86_64; do
+         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+             -u "$GPG_KEYID" --armor --detach-sign "$f"
+       done
+       sha256sum -c SHA256SUMS-x86_64
+       gpg --verify SHA256SUMS-x86_64.asc SHA256SUMS-x86_64
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
@ -91,3 +143,9 @@ jobs:
        subject-path: |
          *.rpm
          *.deb
+    - name: Upload to release
+      if: github.event_name == 'release'
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-x86_64 SHA256SUMS-x86_64.asc
--- a/.github/workflows/build-watcom.yml
+++ b/.github/workflows/build-watcom.yml
@ -6,12 +6,14 @@ on:
  workflow_dispatch:

 permissions:
-  contents: write
-  id-token: write
-  attestations: write
+  contents: read

 jobs:
  ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
@ -88,16 +90,30 @@ jobs:
      if: github.event_name == 'release'
      shell: pwsh
      run: Compress-Archive -Path dist/* -DestinationPath 3proxy-${{ env.RELEASE }}-lite.zip
-    - name: Upload to release
+    - name: Checksums and detached signature
      if: github.event_name == 'release'
      shell: bash
      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-lite.zip
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       sha256sum *.zip > SHA256SUMS-win-lite
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --armor --detach-sign SHA256SUMS-win-lite
+       sha256sum -c SHA256SUMS-win-lite
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
      with:
        subject-path: |
          *.zip
+    - name: Upload to release
+      if: github.event_name == 'release'
+      shell: bash
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.zip SHA256SUMS-win-lite SHA256SUMS-win-lite.asc
--- a/.github/workflows/build-win32.yml
+++ b/.github/workflows/build-win32.yml
@ -6,12 +6,14 @@ on:
  workflow_dispatch:

 permissions:
-  contents: write
-  id-token: write
-  attestations: write
+  contents: read

 jobs:
  ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
@ -103,16 +105,30 @@ jobs:
      if: github.event_name == 'release'
      shell: pwsh
      run: Compress-Archive -Path dist/* -DestinationPath 3proxy-${{ env.RELEASE }}-x86.zip
-    - name: Upload to release
+    - name: Checksums and detached signature
      if: github.event_name == 'release'
      shell: bash
      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-x86.zip
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       sha256sum *.zip > SHA256SUMS-win-x86
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --armor --detach-sign SHA256SUMS-win-x86
+       sha256sum -c SHA256SUMS-win-x86
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
      with:
        subject-path: |
          *.zip
+    - name: Upload to release
+      if: github.event_name == 'release'
+      shell: bash
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.zip SHA256SUMS-win-x86 SHA256SUMS-win-x86.asc
--- a/.github/workflows/build-win64.yml
+++ b/.github/workflows/build-win64.yml
@ -6,12 +6,14 @@ on:
  workflow_dispatch:

 permissions:
-  contents: write
-  id-token: write
-  attestations: write
+  contents: read

 jobs:
  ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
@ -104,16 +106,30 @@ jobs:
      if: github.event_name == 'release'
      shell: pwsh
      run: Compress-Archive -Path dist/* -DestinationPath 3proxy-${{ env.RELEASE }}-x64.zip
-    - name: Upload to release
+    - name: Checksums and detached signature
      if: github.event_name == 'release'
      shell: bash
      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-x64.zip
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       sha256sum *.zip > SHA256SUMS-win-x64
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --armor --detach-sign SHA256SUMS-win-x64
+       sha256sum -c SHA256SUMS-win-x64
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
      with:
        subject-path: |
          *.zip
+    - name: Upload to release
+      if: github.event_name == 'release'
+      shell: bash
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.zip SHA256SUMS-win-x64 SHA256SUMS-win-x64.asc
--- a/.github/workflows/build-winarm64.yml
+++ b/.github/workflows/build-winarm64.yml
@ -6,12 +6,14 @@ on:
  workflow_dispatch:

 permissions:
-  contents: write
-  id-token: write
-  attestations: write
+  contents: read

 jobs:
  ci:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
@ -103,16 +105,30 @@ jobs:
      if: github.event_name == 'release'
      shell: pwsh
      run: Compress-Archive -Path dist/* -DestinationPath 3proxy-${{ env.RELEASE }}-arm64.zip
-    - name: Upload to release
+    - name: Checksums and detached signature
      if: github.event_name == 'release'
      shell: bash
      env:
-       GH_TOKEN: ${{ github.token }}
-       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-arm64.zip
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       sha256sum *.zip > SHA256SUMS-win-arm64
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --armor --detach-sign SHA256SUMS-win-arm64
+       sha256sum -c SHA256SUMS-win-arm64
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
      with:
        subject-path: |
          *.zip
+    - name: Upload to release
+      if: github.event_name == 'release'
+      shell: bash
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: gh release upload "$TAG" *.zip SHA256SUMS-win-arm64 SHA256SUMS-win-arm64.asc
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@ -7,9 +7,6 @@ on:

 permissions:
  contents: read
-  packages: write
-  id-token: write
-  attestations: write

 env:
  DOCKERHUB_IMAGE: docker.io/3proxy/3proxy
@ -18,6 +15,9 @@ env:
 jobs:
  build:
    name: ${{ matrix.image }} ${{ matrix.platform }}
+    permissions:
+      contents: read
+      packages: write
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
@ -81,6 +81,11 @@ jobs:

  publish:
    name: Publish ${{ matrix.image }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
    runs-on: ubuntu-latest
    needs: build
    strategy:
--- a/3proxy-release-key-ed25519.asc
+++ b/3proxy-release-key-ed25519.asc
@ -0,0 +1,10 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEaogJthYJKwYBBAHaRw8BAQdA8rZ4l90kTOSrlosP0yyeX6jFGfiFFizawjS0
+vyQnmu60KjNwcm94eSByZWxlYXNlIHNpZ25pbmcgPDNwcm94eUAzcHJveHkub3Jn
+PoivBBMWCgBXFiEEvHxfo3tIuOfF5ScUw2JYsMbAg6oFAmqICbYbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheA
+AAoJEMNiWLDGwIOqBHIA/iRus5VEqL+v6nYQ+GDLDUZJzMfFcnDBI+BOOhiESnTp
+AP4s3uvhigRcdutxkYwSXBlJ+7wE1yZeuUmjPoJXvgNaDw==
+=Ngp2
+-----END PGP PUBLIC KEY BLOCK-----
--- a/3proxy-release-key.asc
+++ b/3proxy-release-key.asc
@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGqIZCIBEADF3zxdMo2dvUGAlQm3aIcQiqmpLMHucvLfSK3fHtwagO8f03CO
+bEx9EfIK/U6BzLwEJ0CxyClzfvgo9COVpi5EjES9sI2LXzcgc4hGaYO0Q4Unj//0
+W/G8aarDaLF2NRKMLf07eaYGBRJjqHnmeHgOHdr+SnN0JtMSadWMHoliB8esnabz
+5CO4JabTrhwoez3DMLSgJNIod7wL6PJJv/2BeRahwNr2CjaXmzZKr/j7fc1MKLij
+bsvJ5OmLmngZr6CHDa9cBhVhiH+7RgWLCsRlEGxEv7w0afp/T0xDwNAPkGzk5ObC
+BrdXvypTAbNyUoVT8qSVJwkneZ4S0Ts4rRRNfNpaus4tsCmgyGKzsrbxvbiBOTPW
+jB/fjkgr6X9M/AQ3yGpXrwXRJrM/nSfjUyOEHXttTC9HpGt41NH/mpC4mDWa1Kxi
+FMxuo1+dw2kpDKl0Bp78IGdCo5akHwftFr8aHgmfZoGXAGJRHPAWbJGjC2ARy8yp
+QOpxba0S3VlCU6bs8MDKl6cpWItnlXcl/GD/Qc55bjLXjFv1pbn2RUSYZS+n9wDX
+64syZf3dZ/N5U4ydmybWfiLFUXqKQLtdO8QAWQGt4TSwKptTmI581/MMCTQ8qWZL
+zgFj6C/8K0SZ4lMOv+5zfc2+QOoWw7E2Ws3stEKTyWjOMm/QMJAGumqvqwARAQAB
+tCozcHJveHkgcmVsZWFzZSBzaWduaW5nIDwzcHJveHlAM3Byb3h5Lm9yZz6JAm0E
+EwEIAFcWIQT8EiFEmfzHuhz/bNwDEjhOOnOUCwUCaohkIhsUgAAAAAAEAA5tYW51
+MiwyLjUrMS4xMiwwLDMCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQ
+AxI4TjpzlAsCwRAAtH3OO42yCd2B8Od4yS1yBDkaIFwEm8hF68eou6uaSDkKG8YZ
+C3DUH7qk0nXEMQu/5J6RWZKlW1C8D3AkUR9A1g54o6mUg4IL5196XsrQRdVu64YF
+nLCk17Piku1lMk+Re6bZ6uJv5UlSv8d0dvxmAYzjusyPyBC2VXy7B0CoDif6AmXt
+aw2/V6m0dRrfFo4W9mJKUqTAJcdBOKzEiQb7qLnzuwy4CB5qsvnEQTqymoCXFXzg
+VDCSKRLXnbDPbIs0TvsCmthn/w1hCgftPq4W0s7EUJBOhbrjF59+AuTb+U1wIXNR
+1+DPF+V+5RlwWjOWMlsOVGk2jaxjVY8wuaD3rE6ISJkt1pRv/WVdY984rT7Eu94J
+ZHnxPjFrb2ohFKjoBCt60kbgZbuQ6yvEma5lAF9K63gwMNNyGZvq6QWl58iouzuS
+3B9t7EwGwFstJfaXVhn/rnIHoExgxVZMbbsmXiGJyE2KcfVmlZcEi0MIyqEeBSDD
+gjpE4yVO6StBtJKfXra8rMwtsbWBw9MptPhcLvdWtN6TG0CxDyTHhdL1pSLNcwX1
+CTVpwi6+WmGogcv0WFNn5caQUpu9le/v/5qLRK08KWOH8inMJmTfpJg/9869YJuF
+vDKdzJd6jug5YQRfV/7YVC2hdSOBLvBuDpRINePrj9CKJ34qG+jRSJ5xwYk=
+=IS3Y
+-----END PGP PUBLIC KEY BLOCK-----
--- a/SECURITY.md
+++ b/SECURITY.md
@ -12,3 +12,59 @@
 Report to 3proxy@3proxy.org or via [GitHub security reporting](https://github.com/3proxy/3proxy/security)

 For High/Critical patched version is released within 2 weeks
+
+## Verifying downloads
+
+Release binaries are published with SHA256 checksums, an OpenPGP signature and
+a GitHub build provenance attestation.
+
+The release signing key is `3proxy-release-key.asc` in the root of this
+repository, an RSA-4096 key:
+
+```
+pub   rsa4096 2026-08-21 [SC]
+      FC12 2144 99FC C7BA 1CFF  6CDC 0312 384E 3A73 940B
+uid   3proxy release signing <3proxy@3proxy.org>
+```
+
+Import it once:
+
+```
+gpg --import 3proxy-release-key.asc
+```
+
+Releases up to and including 0.9.9 were signed with an Ed25519 key, kept as
+`3proxy-release-key-ed25519.asc` for verifying those older files. Note that
+rpm 4.14 and earlier (RHEL/CentOS 8 and older) cannot import an Ed25519 key
+and will report `SIGNATURES NOT OK`; use the RSA key and 0.9.9.1 or later on
+those systems.
+
+Checksums and the checksum file signature:
+
+```
+gpg --verify SHA256SUMS-x86_64.asc SHA256SUMS-x86_64
+sha256sum -c SHA256SUMS-x86_64
+```
+
+RPM packages are signed, the signature is checked by rpm itself:
+
+```
+sudo rpm --import 3proxy-release-key.asc
+rpm -K 3proxy-0.9.9.x86_64.rpm
+```
+
+DEB packages are published with a detached signature:
+
+```
+gpg --verify 3proxy-0.9.9.x86_64.deb.asc 3proxy-0.9.9.x86_64.deb
+```
+
+Build provenance (which workflow, commit and runner produced the file) is
+verified with the GitHub CLI:
+
+```
+gh attestation verify 3proxy-0.9.9.x86_64.rpm --owner 3proxy
+gh attestation verify oci://docker.io/3proxy/3proxy:lts --owner 3proxy
+```
+
+Windows binaries are Authenticode signed in addition to the above.
Author	SHA1	Message	Date
Vladimir Dubrovin	39bc8b065c	Switch release signing to an RSA-4096 key rpm 4.14 (RHEL/CentOS/Rocky 8) cannot import an Ed25519 public key at all: the import fails and package verification reports SIGNATURES NOT OK. RHEL 8 is supported until 2029 and is a realistic target for a signed package repo, so the Ed25519 key excludes a large part of the rpm audience. Publish an RSA-4096 signing key as 3proxy-release-key.asc and keep the old Ed25519 key as 3proxy-release-key-ed25519.asc so artifacts up to 0.9.9 stay verifiable. Workflows derive the key id from the imported secret key, so no workflow change is needed.	2026-08-21 17:45:09 +03:00
Vladimir Dubrovin	63cc737b62	rpm signing: accept non-RSA signature headers The release key is ed25519, so rpm stores the header signature in DSAHEADER (EdDSA/SHA256) and RSAHEADER is empty. The verification only looked at RSAHEADER and failed correctly signed packages.	2026-08-21 15:33:58 +03:00
Vladimir Dubrovin	aeee37998e	rpm signing: pass the passphrase explicitly, add diagnostics on failure Do not rely on the gpg-agent passphrase cache surviving between steps: the signing command gets the passphrase from a file. A test signature is made first, so a wrong passphrase or a key which can not sign fails with a clear gpg error instead of an rpm which is silently left unsigned. On failure the rpm version, the sign command and the key capabilities are printed.	2026-08-21 13:13:24 +03:00
Vladimir Dubrovin	a830104238	Fix rpm signing: point %__gpg at the real gpg binary rpm on Debian/Ubuntu defaults %__gpg to /usr/bin/gpg2, which does not exist, so rpm --addsign failed with 'Could not exec gpg' and packages were left unsigned.	2026-08-21 13:01:47 +03:00
Vladimir Dubrovin	b5e75daee4	Publish release key	2026-08-21 11:25:32 +03:00
Vladimir Dubrovin	db2f57fdd2	Sign packages, publish checksums, attest before upload, narrow permissions GPG signing of rpm packages and detached signatures for deb packages and for the SHA256SUMS files, using GPG_PRIVATE_KEY / GPG_PASSPHRASE secrets. Checksums are published as release assets. Build provenance is attested before the assets are uploaded, so a failed attestation does not leave unattested files published. Workflow permissions are read-only, write permissions are requested per job only where they are used.	2026-08-21 11:08:20 +03:00