Giters

sigp / siren

User interface for Lighthouse

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

CI: signing key does not match published one

antondlr opened this issue · comments

commented

As discussed internally;

our published pgp identity

pub   rsa4096 2020-11-27 [SC] [expires: 2036-11-23]
      15E66D941F697E28F49381F426416DC3F30674B0
uid           [ unknown] Sigma Prime <security@sigmaprime.io>
sig 3        26416DC3F30674B0 2020-11-27  Sigma Prime <security@sigmaprime.io>
sub   rsa4096 2020-11-27 [E] [expires: 2036-11-23]
sig          26416DC3F30674B0 2020-11-27  Sigma Prime <security@sigmaprime.io>

does not contain the (newly-added, 20230227) signing subkey that we use for signing Siren releases:

pub   rsa4096 2020-11-27 [SC] [expires: 2036-11-23]
      15E66D941F697E28F49381F426416DC3F30674B0
uid           [ unknown] Sigma Prime <security@sigmaprime.io>
sig 3        26416DC3F30674B0 2020-11-27  Sigma Prime <security@sigmaprime.io>
sub   rsa4096 2020-11-27 [E] [expires: 2036-11-23]
sig          26416DC3F30674B0 2020-11-27  Sigma Prime <security@sigmaprime.io>
sub   rsa4096 2023-02-27 [S]
sig          26416DC3F30674B0 2023-02-27  Sigma Prime <security@sigmaprime.io>

so we either have to:

  • update the published key on keybase.io
  • revert to a version that does not have that subkey in CI
  • modify CI to specifically not use the signing subkey

I could do (3) probably but would prefer (1) or (2)

gpg --verify siren-v1.0.1-x86_64-unknown-linux-gnu.zip.asc
gpg: assuming signed data in 'siren-v1.0.1-x86_64-unknown-linux-gnu.zip'
gpg: Signature made vr 25 aug 21:39:43 2023 CEST
gpg:                using RSA key 33529CF9962816DC16B4D6254EBBF0959B313321
gpg: Can't check signature: No public key

sec#  rsa4096 2020-11-27 [SC] [expires: 2036-11-23]
      15E66D941F697E28F49381F426416DC3F30674B0
uid                      Sigma Prime <security@sigmaprime.io>
ssb   rsa4096 2020-11-27 [E] [expires: 2036-11-23]
      33679A097ADCF6797525C4357ACF1E5A8D9E2514
ssb   rsa4096 2023-02-27 [S]
      33529CF9962816DC16B4D6254EBBF0959B313321
commented

closing since we're no longer signing releases