Home / server / Questions / 580490
Accepted
Matthias Braun
Asked: 2014-03-08 05:32:51 +0800 CST

Where to store private key on Linux build server

  • 772

On my Debian 3.2.54-2 build server I'd like to sign the build artifacts (JAR files) with my private key to ensure their authenticity.

I've created a private key secring.gpg using GnuPG and protected it with a password. I'm using Jenkins and Gradle for automated building and signing. I have to pass Gradle the location of secring.gpg so it can sign the JARs, but I'm not sure where to put it.

Are there any conventions or best practices regarding this?

I've browsed the related questions and googled the question but that didn't yield any answers to me.

I'm new to security related topics, so if I can provide any additional information, please let me know.

Thanks.

debian

1 Answers

  1. Best Answer

    I have to pass Gradle the location of secring.gpg so it can sign the JARs, but I'm not sure where to put it.

    Are there any conventions or best practices regarding this?

    The only thing close to a "standard" in this regard would be to put your keyring in a dotfolder within the home directory of whatever user needs access to it.

    Ensure that permissions are set such that only the user in question has read/write access to the file.

    • 1