🔒 SECURITY (Long-term): Implement cryptographic script signing

[dean0x]

Security Enhancement: Cryptographic Script Signing

Severity: LOW
Priority: LOW (Long-term)
Category: Advanced Security

Problem

Current checksum verification prevents tampering but doesn't prove authenticity. Anyone could create malicious scripts with matching checksums if they compromise the build process.

Impact

• Build-time supply chain attacks
• No proof of origin
• No non-repudiation

Solution

Implement GPG/PGP signing for scripts:

// Sign scripts during build (CI/CD)
gpg --detach-sign --armor statusline.sh
# Creates statusline.sh.asc

// Verify signature during installation
const verified = await verifySignature('statusline.sh', 'statusline.sh.asc', PUBLIC_KEY);
if (!verified) {
  throw new Error('Script signature verification failed');
}

Implementation Requirements

• Signing key management (secure CI/CD)
• Public key distribution
• Signature verification logic
• Key rotation strategy
• Documentation for verification

Acceptance Criteria

• Scripts signed during release build
• Signatures verified during installation
• Public key embedded or distributed securely
• Key rotation process documented
• Verification failures block installation

Dependencies

• Requires 🔒 SECURITY: Implement script integrity verification #8 (Script integrity) to be completed first
• GPG/PGP tooling in CI/CD
• Secure key management infrastructure

Related Issues

• 🔒 SECURITY: Implement script integrity verification #8 (Script integrity - prerequisite)