github.com/joselitofilho/goreleaser@v0.155.1-0.20210123221854-e4891856c593/www/docs/customization/sign.md (about)

     1  ---
     2  title: Signing
     3  ---
     4  
     5  Signing ensures that the artifacts have been generated by yourself and your
     6  users can verify that by comparing the generated signature with your public
     7  signing key.
     8  
     9  GoReleaser provides means to sign both executables and archives.
    10  
    11  ## Archives
    12  
    13  Signing works in combination with checksum files and it is generally sufficient
    14  to sign the checksum files only.
    15  
    16  The default is configured to create a detached signature for the checksum files
    17  with [GnuPG](https://www.gnupg.org/) and your default key. To enable signing
    18  just add
    19  
    20  ```yaml
    21  # .goreleaser.yml
    22  signs:
    23    - artifacts: checksum
    24  ```
    25  
    26  To customize the signing pipeline you can use the following options:
    27  
    28  ```yaml
    29  # .goreleaser.yml
    30  signs:
    31    -
    32      # ID of the sign config, must be unique.
    33      # Defaults to "default".
    34      id: foo
    35  
    36      # name of the signature file.
    37      # '${artifact}' is the path to the artifact that should be signed.
    38      #
    39      # defaults to `${artifact}.sig`
    40      signature: "${artifact}_sig"
    41  
    42      # path to the signature command
    43      #
    44      # defaults to `gpg`
    45      cmd: gpg2
    46  
    47      # command line templateable arguments for the command
    48      #
    49      # to sign with a specific key use
    50      # args: ["-u", "<key id, fingerprint, email, ...>", "--output", "${signature}", "--detach-sign", "${artifact}"]
    51      #
    52      # defaults to `["--output", "${signature}", "--detach-sign", "${artifact}"]`
    53      args: ["--output", "${signature}", "${artifact}", "{{ .ProjectName }}"]
    54  
    55  
    56      # which artifacts to sign
    57      #
    58      #   checksum: only checksum file(s)
    59      #   all:      all artifacts
    60      #   none:     no signing
    61      #   source:   source archive
    62      #
    63      # defaults to `none`
    64      artifacts: all
    65  
    66      # IDs of the artifacts to sign.
    67      # Defaults to all.
    68      # If `artifacts` is checksum or source, this fields has no effect.
    69      ids:
    70        - foo
    71        - bar
    72  
    73      # Stdin data to be given to the signature command as stdin.
    74      # defaults to empty
    75      stdin: password
    76  
    77      # StdinFile file to be given to the signature command as stdin.
    78      # defaults to empty
    79      stdin_file: ./.password
    80  ```
    81  
    82  ### Limitations
    83  
    84  You can sign with any command that outputs a file.
    85  If what you want to use does not do it, you can always hack by setting the
    86  command to `sh -c`. For example:
    87  
    88  ```yaml
    89  # .goreleaser.yml
    90  signs:
    91  - cmd: sh
    92    args:
    93    - '-c'
    94    - 'echo "${artifact} is signed and I can prove it" | tee ${signature}'
    95    artifacts: all
    96  ```
    97  
    98  And it will work just fine. Just make sure to always use the `${signature}`
    99  template variable as the result file name and `${artifact}` as the origin file.
   100  
   101  
   102  ## Executables
   103  
   104  Executables can be signed after build using post hooks.
   105  
   106  For example you can use [gon][] to create notarized MacOS apps:
   107  
   108  ```yaml
   109  builds:
   110  - binary: foo
   111    id: foo
   112    goos:
   113    - linux
   114    - windows
   115    goarch:
   116    - amd64
   117  
   118  # notice that we need a separated build for the MacOS binary only:
   119  - binary: foo
   120    id: foo-macos
   121    goos:
   122    - darwin
   123    goarch:
   124    - amd64
   125    hooks:
   126      post: gon gon.hcl
   127  ```
   128  **`gon.hcl`:**
   129  ```hcl
   130  # The path follows a pattern
   131  # ./dist/BUILD-ID_TARGET/BINARY-NAME
   132  source = ["./dist/foo-macos_darwin_amd64/foo"]
   133  bundle_id = "com.mitchellh.example.terraform"
   134  
   135  apple_id {
   136    username = "mitchell@example.com"
   137    password = "@env:AC_PASSWORD"
   138  }
   139  
   140  sign {
   141    application_identity = "Developer ID Application: Mitchell Hashimoto"
   142  }
   143  ```
   144  
   145  Note that notarizing may take some time, and will need to be run from a MacOS machine.
   146  
   147  If you generate ZIP or DMG as part of your signing via gon you may need
   148  to ensure their file names align with desired pattern of other artifacts
   149  as GoReleaser doesn't control how these get generated beyond just executing `gon`
   150  with given arguments. Relatedly you may need to list these additional artifacts
   151  as `extra_files` in the `release` section to make sure they also get uploaded.
   152  
   153  You can also check [this issue](https://github.com/goreleaser/goreleaser/issues/1227) for more details.
   154  
   155  [gon]: https://github.com/mitchellh/gon