Currently all verification of Janus files is made by janus itself. Which means that if a hacker got access to Janus git repo, he can change verification process too, including changing PGP pubkey. So you shouldn't download and verify from same place, because if it will be compromised, it will be everything at once.
So more secure installation process should look like:
gpg --import .janus-gpg.txt
curl -O https://raw.githubusercontent.com/ethereumproject/janus/master/get-windows.sh
curl -O https://raw.githubusercontent.com/ethereumproject/janus/master/get-windows.sh.asc
gpg --verify get-windows.sh.asc
bash get-windows.sh
Where .janus-gpg.txt MUST be provided with application sources (i.e. committed into Geth/Emerald/etc).
But that brings another problem, you need a versioning for that stuff. Because if you'll decide to to change your PGP key at some point, every dependent project will stop working until they will import your new key. As a workaround you can give a link pointing to a tag, instead of master branch. (also, just realised, a link to particular commit maybe a useful for security too, because it will be hard to forge a commit, but I don't think it supposed to be used this way)
Currently all verification of Janus files is made by janus itself. Which means that if a hacker got access to Janus git repo, he can change verification process too, including changing PGP pubkey. So you shouldn't download and verify from same place, because if it will be compromised, it will be everything at once.
So more secure installation process should look like:
Where
.janus-gpg.txtMUST be provided with application sources (i.e. committed into Geth/Emerald/etc).But that brings another problem, you need a versioning for that stuff. Because if you'll decide to to change your PGP key at some point, every dependent project will stop working until they will import your new key. As a workaround you can give a link pointing to a tag, instead of
masterbranch. (also, just realised, a link to particular commit maybe a useful for security too, because it will be hard to forge a commit, but I don't think it supposed to be used this way)