Code Signing an RPM package using keys stored in Azure Key Vault RRS feed

  • Question

  • Hi,

    We have an application requirement of code signing RPM packages. For such an operation we thought the most suited way would be the use of GnuPG (GPG). However we are unable to find any support for the tool GPG on Azure Key Vault. We would be grateful if you could provide us guidance on the usage of GPG configured with Azure Key Vault or if you are aware of a any code signing procedure that incorporates Azure Key Vault as the key storage provider.

    Wednesday, September 18, 2019 6:08 AM

All replies

  • I am not sure if I follow you. As I understand GPG is a signing utility in Linux which you can use to sign your RPM package.  Do you want to store the GPG keys on Azure Key Vault ?
    Wednesday, September 18, 2019 2:17 PM
  • Yes, I would prefer storing keys in Azure Key vault. As an and result I want to Sign a RPM Package using GPG signing utility/openssl sign tool or any other Signing tool (which can sign RPM packages) with keys generated/stored in Azure Key vault.
    Thursday, September 19, 2019 7:41 AM