Following quickstart docs:
(https://docs.caution.co/quickstart/ > https://docs.caution.co/quickstart/fully-managed/#install-the-cli > https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md)
I was blocked trying to follow https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md#moderate-trust
(削除) 2. Review and import signing keys (削除ここまで)
(削除) Once satisfied, import the keys you trust: (削除ここまで)
(削除) ~~ gpg --fetch-keys https://keyoxide.org/6B61ECD76088748C70590D55E90A401336C8AAA9 gpg --fetch-keys https://keyoxide.org/F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D gpg --fetch-keys https://keyoxide.org/88823A75ECAA786B0FF38B148E401478A3FBEF72 gpg --fetch-keys https://keyoxide.org/C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD ~~ (削除ここまで)
(削除) all returned gpg: no valid OpenPGP data found. This is because of how keyoxide is responding. (削除ここまで)
(削除) curl -L https://keyoxide.org/C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD (削除ここまで)
(削除) returns (削除ここまで)
(削除) <!DOCTYPE html> (削除ここまで)
(削除) I changed each command in a PR, which seems to work as is intended, see #205 (削除ここまで)
EDIT: PR merged! Section 2 is resolved.
3. Verify signatures
This section is currently not functioning.
After importing keys, I'm blocked trying to get manifest.txt and a signature for the manifest. Running make verify-cli returns:
make: *** No rule to make target 'dist/cli/manifest.txt', needed by 'verify-cli'. Stop.
I believe the end goal here is to allow caution cli users to confirm the integrity of their locally built binary. To do so they must have a reproducibly built binary with expectations anchored in the maintainers' keys.
Using make release-cli builds the binary and creates the manifest.txt derived from it, but in that case I still don't have one or more detached signature .asc files.
What we could do:
The 4 maintainers create an .asc file that is available to users via fetch or checked into the repo. In fact, checking in signatures seems to be encouraged later in the same README file being evaluated.
Then, create a new make target command for users to fetch the manifest, and verify with the signatures, or incorporate the proposed functionality into make verify-cli.
Finally, possibly create a canonical manifest.txt or eliminate ir. A signature for a blob can exist on its own.
(削除) I am not sure this is helpful, but I wrote a patch that uses make release-cli - which might be a partial solution. See #206 (削除ここまで)
Signers
Finally, a small related point: Daniel doesn't have any associated accounts linked on keyoxide, unlike the other signers - so a user has no way to simply follow the signers links, and confirm from there.)