bazelbuild / bazelbuild/bazelisk

Provide detached signatures for bazelisk release binaries

Open
#738 1 comment 0 reactions 0 assignees View on GitHub
P2
Dominant language
Go
Stars
2.7k
Forks
424
PR merge metrics
No merged PRs in 30d

Description

Would it be possible to sign the releases here like we do for bazel itself?

e.g. https://github.com/bazelbuild/bazel/releases/download/8.4.2/bazel-8.4.2-linux-x86_64 and https://github.com/bazelbuild/bazel/releases/download/8.4.2/bazel-8.4.2-linux-x86_64.sig which is generated using the bazel GPG key: https://bazel.build/bazel-release.pub.gpg

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the Bazelisk release binaries and comparing them with the linked Bazel release assets and bazel-release.pub.gpg key. Done means each Bazelisk release binary has a matching detached .sig file generated with the release key and published alongside it.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
release, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.