Make authenticity verification for downloaded binaries more configurable - support skipping it and using alternative signature#769

Draft

valco1994 wants to merge 13 commits into

bazelbuild:masterfrom

valco1994:authenticity-verification

Commits on Jan 26, 2026

Authenticate releases using the embedded verification key.

PiotrSikora
authored and
valco1994
committed
Check authenticity for all download URLs
valco1994
committed
Support authentication for downloading signatures
valco1994
committed
Rework Bazel downloading and verification:
valco1994
committed
Introduce BAZELISK_NO_SIGNATURE_VERIFICATION config value to allow disabling of authenticity check
valco1994
committed
Introduce BAZELISK_VERIFICATION_KEY_FILE config value to allow explicitly using an alternative verification key.
valco1994
committed
Switch from golang.org/x/crypto to github.com/ProtonMail/gopenpgp/v3, because golang.org/x/crypto is deprecated and unmaintained
valco1994
committed
Verify authenticity for rolling releases
valco1994
committed
Don't try to verify authenticity when no signature is available (unreleased versions)
valco1994
committed
Handle expired verification key especially
valco1994
committed
Update embedded verification key
valco1994
committed

Commits on Jan 27, 2026