Bad signature for the OS X release mention in the README

[uri]

The README links to the following homebrew formula:

https://github.com/Amar1729/homebrew-formulae/blob/master/browserpass.rb

Which in turn references this release:

https://github.com/Amar1729/homebrew-formulae/releases/download/browserpass-3.0.6

Using browserpass-darwin64-3.0.6.tar.gz.asc it does not verify:

$ gpg --verify browserpass-darwin64-3.0.6.tar.gz.asc browserpass-3.0.6.mojave.bottle.tar.gz
gpg: Signature made Sat Apr 13 04:41:38 2019 EDT
gpg:                using RSA key 8053EB88879A68CB4873D32B011FDC52DA839335
gpg: BAD signature from "Maxim Baz <[email protected]>" [unknown]

@Amar1729

[maximbaz]

Hey, there's a bit of a misunderstanding 🙂

I sign the native application itself, the releases in this repo, because that's what I develop:

❯ gpg --verify browserpass-darwin64-3.0.6.tar.gz.asc 
gpg: assuming signed data in 'browserpass-darwin64-3.0.6.tar.gz'
gpg: Signature made Sat 13 Apr 2019 10:41:38 AM CEST
gpg:                using RSA key 8053EB88879A68CB4873D32B011FDC52DA839335
gpg: Good signature from "Maxim Baz <[email protected]>" [ultimate]
gpg:                 aka "Maxim Baz <[email protected]>" [ultimate]
gpg:                 aka "[jpeg image of size 21131]" [ultimate]
Primary key fingerprint: EB4F 9E5A 60D3 2232 BB52  150C 12C8 7A28 FEAC 6B20
     Subkey fingerprint: 8053 EB88 879A 68CB 4873  D32B 011F DC52 DA83 9335

The README links to the user-contributed homebrew formula, hoping in a good faith that it will not do anything malicious and will only simplify your installation procedure. But because I have nothing to do with that homebrew formula, I don't sign @Amar1729's releases of it (and neither does he).

By the way, @Amar1729 if this is supported, it would be very cool if your formula would also download my signature together with the release and verify it before installation, to prevent man-in-the-middle attack.

@uri if you are using homebrew formula, I guess there's nothing you can verify.

Let me know if this makes sense and if you have other questions! 🙂

[Amar1729]

@uri not a bad idea. I've linked here from an issue in my tap so other users with the same idea can see the discussion there.

in short - gpg verification of upstream isn't possible easy from within a formula right now because they use sha256 for "verification" instead, but there is a way you can verify the installation yourself by using brew fetch -s first to manually verify the downloaded sources.