mirror of
https://github.com/3proxy/3proxy.git
synced 2026-08-26 09:55:48 +08:00
1e019bad0e
rpm 4.14 (RHEL/CentOS/Rocky 8) cannot import an Ed25519 public key at all: the import fails and package verification reports SIGNATURES NOT OK. RHEL 8 is supported until 2029 and is a realistic target for a signed package repo, so the Ed25519 key excludes a large part of the rpm audience. Publish an RSA-4096 signing key as 3proxy-release-key.asc and keep the old Ed25519 key as 3proxy-release-key-ed25519.asc so artifacts up to 0.9.9 stay verifiable. Workflows derive the key id from the imported secret key, so no workflow change is needed.
71 lines
1.8 KiB
Markdown
71 lines
1.8 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 0.9.8 | :white_check_mark: |
|
|
| < 0.9.8 | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Report to 3proxy@3proxy.org or via [GitHub security reporting](https://github.com/3proxy/3proxy/security)
|
|
|
|
For High/Critical patched version is released within 2 weeks
|
|
|
|
## Verifying downloads
|
|
|
|
Release binaries are published with SHA256 checksums, an OpenPGP signature and
|
|
a GitHub build provenance attestation.
|
|
|
|
The release signing key is `3proxy-release-key.asc` in the root of this
|
|
repository, an RSA-4096 key:
|
|
|
|
```
|
|
pub rsa4096 2026-08-21 [SC]
|
|
FC12 2144 99FC C7BA 1CFF 6CDC 0312 384E 3A73 940B
|
|
uid 3proxy release signing <3proxy@3proxy.org>
|
|
```
|
|
|
|
Import it once:
|
|
|
|
```
|
|
gpg --import 3proxy-release-key.asc
|
|
```
|
|
|
|
Releases up to and including 0.9.9 were signed with an Ed25519 key, kept as
|
|
`3proxy-release-key-ed25519.asc` for verifying those older files. Note that
|
|
rpm 4.14 and earlier (RHEL/CentOS 8 and older) cannot import an Ed25519 key
|
|
and will report `SIGNATURES NOT OK`; use the RSA key and 0.9.9.1 or later on
|
|
those systems.
|
|
|
|
Checksums and the checksum file signature:
|
|
|
|
```
|
|
gpg --verify SHA256SUMS-x86_64.asc SHA256SUMS-x86_64
|
|
sha256sum -c SHA256SUMS-x86_64
|
|
```
|
|
|
|
RPM packages are signed, the signature is checked by rpm itself:
|
|
|
|
```
|
|
sudo rpm --import 3proxy-release-key.asc
|
|
rpm -K 3proxy-0.9.9.x86_64.rpm
|
|
```
|
|
|
|
DEB packages are published with a detached signature:
|
|
|
|
```
|
|
gpg --verify 3proxy-0.9.9.x86_64.deb.asc 3proxy-0.9.9.x86_64.deb
|
|
```
|
|
|
|
Build provenance (which workflow, commit and runner produced the file) is
|
|
verified with the GitHub CLI:
|
|
|
|
```
|
|
gh attestation verify 3proxy-0.9.9.x86_64.rpm --owner 3proxy
|
|
gh attestation verify oci://docker.io/3proxy/3proxy:latest --owner 3proxy
|
|
```
|
|
|
|
Windows binaries are Authenticode signed in addition to the above.
|