{"action":"created","issue":{"url":"https://api.github.com/repos/gocd/gocd/issues/1091","labels_url":"https://api.github.com/repos/gocd/gocd/issues/1091/labels{/name}","comments_url":"https://api.github.com/repos/gocd/gocd/issues/1091/comments","events_url":"https://api.github.com/repos/gocd/gocd/issues/1091/events","html_url":"https://github.com/gocd/gocd/issues/1091","id":72241473,"number":1091,"title":"GPG public key missing for APT repository","user":{"login":"tiwoc","id":1260821,"avatar_url":"https://avatars.githubusercontent.com/u/1260821?v=3","gravatar_id":"","url":"https://api.github.com/users/tiwoc","html_url":"https://github.com/tiwoc","followers_url":"https://api.github.com/users/tiwoc/followers","following_url":"https://api.github.com/users/tiwoc/following{/other_user}","gists_url":"https://api.github.com/users/tiwoc/gists{/gist_id}","starred_url":"https://api.github.com/users/tiwoc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiwoc/subscriptions","organizations_url":"https://api.github.com/users/tiwoc/orgs","repos_url":"https://api.github.com/users/tiwoc/repos","events_url":"https://api.github.com/users/tiwoc/events{/privacy}","received_events_url":"https://api.github.com/users/tiwoc/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-04-30T18:26:48Z","updated_at":"2015-05-04T12:27:43Z","closed_at":"2015-05-04T12:27:43Z","body":"Great to see that there's an APT repository at [Bintray](http://dl.bintray.com/gocd/gocd-deb/)! The packages are signed, but in the current state of affairs, this is not particularly useful: The public GPG key which is necessary to validate the signatures on the packages is not published anywhere (at least not where I could find it). This leads to `apt-get` spewing errors about the missing key.\r\n\r\nThe missing public key has two drawbacks: It hampers automation, and it is dangerous when one ignores the warnings and installs anyways because downloads happen over unencrypted HTTP and are thus susceptible to MitM attacks, leading to remote code execution as root...\r\n\r\n### How to fix it\r\nThere's an easy fix: Publish the public key somewhere where it is protected by HTTPS so that we can trace back its origins to go.cd. As a good example, please have a look at [how PostgreSQL does it](http://www.postgresql.org/download/linux/ubuntu/).\r\n\r\n### References\r\n[The same issue has previously been reported to the go-cookbook repo](https://github.com/ThoughtWorksInc/go-cookbook/issues/39), which is probably the wrong place."},"comment":{"url":"https://api.github.com/repos/gocd/gocd/issues/comments/98692488","html_url":"https://github.com/gocd/gocd/issues/1091#issuecomment-98692488","issue_url":"https://api.github.com/repos/gocd/gocd/issues/1091","id":98692488,"user":{"login":"arvindsv","id":172235,"avatar_url":"https://avatars.githubusercontent.com/u/172235?v=3","gravatar_id":"","url":"https://api.github.com/users/arvindsv","html_url":"https://github.com/arvindsv","followers_url":"https://api.github.com/users/arvindsv/followers","following_url":"https://api.github.com/users/arvindsv/following{/other_user}","gists_url":"https://api.github.com/users/arvindsv/gists{/gist_id}","starred_url":"https://api.github.com/users/arvindsv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arvindsv/subscriptions","organizations_url":"https://api.github.com/users/arvindsv/orgs","repos_url":"https://api.github.com/users/arvindsv/repos","events_url":"https://api.github.com/users/arvindsv/events{/privacy}","received_events_url":"https://api.github.com/users/arvindsv/received_events","type":"User","site_admin":false},"created_at":"2015-05-04T12:27:42Z","updated_at":"2015-05-04T12:27:42Z","body":"@tiwoc: You're welcome. I'm closing this issue. I've opened [an issue](https://github.com/gocd/documentation/issues/118) in the documentation repository, for the installation docs."}}