Sign scripts and releases with GPG on Slackware

1. Goal

Add a verifiable signature to scripts, archives, and checksums distributed by your repository.

2. Files and components involved

gpg
release.tar.gz
CHECKSUMS.sha256
publickey.asc

3. Operational flow

sha256sum release.tar.gz > CHECKSUMS.sha256
gpg --armor --detach-sign CHECKSUMS.sha256
gpg --armor --export tua@email > publickey.asc

4. Operational verification

gpg --verify CHECKSUMS.sha256.asc CHECKSUMS.sha256
sha256sum -c CHECKSUMS.sha256

5. Practical notes

On Slackware, it is worth noting the package, version, source, and build output before updating or cleaning.

Writing down where a package comes from avoids a lot of confusion when you have to troubleshoot or rebuild a system months later.

Quick checklist

[ ] Backup or copy of the existing configuration completed
[ ] Files and commands updated as expected
[ ] Local test completed successfully
[ ] Logs or final output verified
[ ] Rollback procedure documented

Back to the Linux HowTo section