Skip to content

openpgpkey

Extracted into the signing module

This package was extracted from go-tool-base. It now lives in the standalone, independently-versioned signing module at gitlab.com/phpboyscout/go/signing/openpgpkey (v0.1.0). go-tool-base consumes it as an ordinary dependency.

The gtb CLI behaviour is unchanged — only the Go import path moved. The change is relevant to anyone writing Go against the package.

What it does

Mints an ASCII-armored OpenPGP public key from any crypto.Signer whose Public() returns *rsa.PublicKey. The OpenPGP self-signature is produced by calling signer.Sign(...) exactly once — so an opaque HSM-backed signer (AWS KMS, GCP KMS, YubiKey) works without the private key ever leaving the HSM.

It also exposes:

  • DetachSign — armored OpenPGP detached signatures over arbitrary data (the per-release checksums.txt → checksums.txt.sig step), verifiable with gpg --verify and by the in-tool verifier.
  • Web Key Directory (WKD) tree generation (WriteWKDTree, WKDHash) — the publish-side layout per draft-koch-openpgp-webkey-service §3.1, paired with the client-side WKDResolver in gitlab.com/phpboyscout/go/signing/verify.

The single seam is stdlib crypto.Signer, so any backend that produces RSA signatures can use it directly.

How gtb uses it

Inside the gtb binary it backs gtb keys mint, gtb keys generate (RSA path), gtb keys wkd, and the DetachSign half of gtb sign. The full API reference, algorithm/version details, reproducibility notes, and worked examples now live in the signing module documentation and on pkg.go.dev.

For the operator-facing recipes, see: