Implement GPG verification wrt #236

README.md

@@ -18,6 +18,7 @@ Similar in scope to [rustup](https://github.com/rust-lang-nursery/rustup.rs), [p
      * [Vim integration](#vim-integration)
    * [Usage](#usage)
      * [Configuration](#configuration)
+     * [GPG verification](#gpg-verification)
      * [Manpages](#manpages)
      * [Shell-completion](#shell-completion)
      * [Compiling GHC from source](#compiling-ghc-from-source)
@@ -146,6 +147,34 @@ explaining all possible configurations can be found in this repo: [config.yaml](
 
 Partial configuration is fine. Command line options always override the config file settings.
 
+### GPG verification
+
+GHCup supports verifying the GPG signature of the metadata file. The metadata file then contains SHA256 hashes of all downloads, so
+this is cryptographically secure.
+
+First, obtain the gpg key:
+
+```sh
+gpg --batch --keyserver keys.openpgp.org --recv-keys 7784930957807690A66EBDBE3786C5262ECB4A3F
+```
+
+Then verify the gpg key in one of these ways:
+
+1. find out where I live and visit me to do offline key signing
+2. figure out my mobile phone number and call me to verify the fingerprint
+3. more boring: contact me on Libera IRC (`maerwald`) and verify the fingerprint
+
+Once you've verified the key, you have to figure out if you trust me.
+
+If you trust me, then you can configure gpg in `~/.ghcup/config.yaml`:
+
+```yml
+gpg-setting: GPGLax # GPGStrict | GPGLax | GPGNone
+```
+
+In `GPGStrict` mode, ghcup will fail if verification fails. In `GPGLax` mode it will just print a warning.
+You can also pass the mode via `ghcup --gpg <strict|lax|none>`.
+
 ### Manpages
 
 For man pages to work you need [man-db](http://man-db.nongnu.org/) as your `man` provider, then issue `man ghc`. Manpages only work for the currently set ghc.
@@ -206,6 +235,7 @@ This is the complete list of env variables that change GHCup behavior:
 * `GHCUP_INSTALL_BASE_PREFIX`: the base of ghcup (default: `$HOME`)
 * `GHCUP_CURL_OPTS`: additional options that can be passed to curl
 * `GHCUP_WGET_OPTS`: additional options that can be passed to wget
+* `GHCUP_GPG_OPTS`: additional options that can be passed to gpg
 * `GHCUP_SKIP_UPDATE_CHECK`: Skip the (possibly annoying) update check when you run a command
 * `CC`/`LD` etc.: full environment is passed to the build system when compiling GHC via GHCup