Release-signing toolchain: HSM-backed OpenPGP workflow - #240

Open

quarckster wants to merge 24 commits into

openssl:masterfrom

quarckster:signing-script

Commits on May 7, 2026

release-tools: add openssl-pgp wrapper

quarckster
and
claude
committed
99ab18f
release-tools: add sq-pkcs11-git-shim

quarckster
and
claude
committed
3b9a73f
stage-release.sh: --gpg-program option for tag signing

quarckster
and
claude
committed
53fa859
release-tools/openssl-pgp: subkey-revoke takes --subkey-fingerprint

quarckster
and
claude
committed
f455ceb
release-tools/openssl-pgp: gate sign on cert-bound signing-key check

quarckster
and
claude
committed
d26538f

Commits on May 11, 2026

Commits on May 13, 2026

stage-release.sh: route all signing through openssl-pgp

quarckster
and
claude
committed
cc5708e
stage-release.sh: drop unused CLI flags and upload machinery

quarckster
and
claude
committed
eb7d738
stage-release.sh: drop announcement file, quiet copyright spinner

quarckster
and
claude
committed
4dc2a1a
stage-release.sh: hardcode signers, drop --gpg-program

quarckster
and
claude
committed
ce8e4f7
stage-release.sh: drop --branch, always create release branch when needed

quarckster
and
claude
committed
0893ac8

Commits on May 14, 2026

stage-release.sh: rename --local-user to --key-label
quarckster
committed
680fab6

Commits on Jun 14, 2026

release-tools: derive signing creation time from the published cert

quarckster
and
claude
committed
4b4f868

Commits on Aug 7, 2026

release-tools: drop tag signing from stage-release.sh

quarckster
and
claude
committed
cc180d5
release-tools: drop the --unsigned option

quarckster
and
claude
committed
4c0795c

Commits on Aug 8, 2026

openssl-pgp: drop the sign command

quarckster
and
claude
committed
213343f
move the OpenPGP key-lifecycle tools out of release-tools

quarckster
and
claude
committed
dc632c3
openpgp-tools: add a README

quarckster
and
claude
committed
305ac89