I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment.
I have initially created a signing box that our devs can log on to and sign the rpm's using their GnuPG created key. They then move the signed package to an 'outbox' directory for QA to pick up, and move their public portion of the key to a 'public key' directory. This however is not ideal as multiple (fake) public keys can be made by each user...
The ultimate aim is to force each completed package to be signed by a single developer to ensure accountability and integrity as the package moves to our operations platform.
Therefore, I have a few areas that I need help/suggestions with:
- What is the best way to ensure only one key is made by each user? (A script maybe?)
- What is the best way to store and retrieve these keys that ensures integrity?