Skip to content

Add keyringctl as tooling for a curated keyring

David Runge requested to merge feature/curated-keyring into master

This implements a keyringctl command (fronting sq) that can be used to convert the current set of PGP certificates to a more specific directory structure (see #6 (closed) for details):

Workflow (for testing)

# convert current setup
./keyringctl -v import --main master master-revoked
./keyringctl -v import packager packager-revoked

The tool allows for exporting the combined PGP packets to a file, that can be used as a pacman keyring:

# export converted certificate layout to a keyring file and export ownertrust and revoker status
./keyringctl -v build

(Future) Workflow

# update an existing main public key (and e.g. its signatures)
./keyringctl -v import --main <some_file>.gpg
# update an existing packager public key (and e.g. its signatures)
./keyringctl -v import <some_file>.gpg

Currently it is untested whether

  • the conversion exports all relevant PGP packets from the existing certificates
  • the export creates a functioning file that can be used as a pacman keyring
  • the revoker status can be improved (to not have to rely on a separate file)

NOTE: Currently it is not yet possible to create a deterministic keyring using sq keyring merge: https://gitlab.com/sequoia-pgp/sequoia/-/issues/762

TODO

  • update README.md to reflect changes and explain new workflow
  • derive username by matching against existing public key fingerprints in the target directory (to not simply rely on input certificate name)
  • filter out any certifications that are not done by main or packager public keys
  • simplify the command-line interface (e.g. import-packager, import-main, export-packager, export-main, export-keyring)
  • add gitlab CI integration to create keyring files, import them with pacman-key and use them
  • standardize directory naming (e.g. uids -> uid, subkeys -> subkey)
  • check new keys to match our requirements (as is currently done in CI)
  • Allow

Related to #6 (closed)

Edited by Levente Polyak

Merge request reports

Loading