Sign every release with a post-quantum signature
Duration: 2:01English
Lumen Pay's CI signs each release artifact with its own ML-DSA-65 key through QuantumAPI and stores the signature next to the file. The deploy script verifies the artifact before installing anything: valid, it installs. Then one byte of the artifact is changed, the verify answers invalid, the deploy refuses and the script exits with an error. The signing key never leaves the vault, and the sign and both verifications are in the key activity log.