Refresh builder GPG key

[yarikoptic]

alerted to by @jwodder in https://github.com/datalad/git-annex/pull/102#issuecomment-1050995050

pub   rsa3072 2020-03-24 [SC] [expires: 2022-03-24]
      13A1093296154584245E0300C98FC49D36DAB17F
uid                      DataLad package builder <team@datalad.org>
sub   rsa3072 2020-03-24 [E] [expires: 2022-03-24]

me need to recall what to do (could we just shift expiration in the same key, or just upload a new key?) for that ;-)

[jwodder]

@yarikoptic I don't think you can change a key's expiration date. At minimum, you'll need to:

• Create a new key
• Set the private key as the contents of the DATALAD_BUILDER_GPGKEY secret
• Save the public key at .github/workflows/tools/datalad-builder-key.asc
• Update the key fingerprint in the DEB_SIGN_KEYID line in .github/workflows/template/specs.yml
• As part of #102, update the key fingerprint in the git commit --gpg-sign=... command in .github/workflows/template/build-{{ostype}}.yaml.j2 and regenerate build-ubuntu.yaml
• Import the new public key on any clients set up for #57/#102

You may also need to update whatever consumes the signature generated for the Ubuntu build artifacts.

[yarikoptic]

THANK YOU @jwodder for the delayed instructions, will follow them soonish.

[yarikoptic]

Dang, now it is failing because I forgot to deal with it.. will fix tomorrow

[yarikoptic]

• followed "Suggested" https://makandracards.com/makandra-orga/13644-what-to-do-when-your-gpg-pgp-key-expires to update expiration to never expire
• updated DATALAD_BUILDER_GPGKEY secret with output of gpg --armor --export-secret-keys 13A1093296154584245E0300C98FC49D36DAB17F
• Saved the public key at .github/workflows/tools/datalad-builder-key.asc
• didn't need to update DEB_SIGN_KEYID since the same key, or gpg-sign command
• pushed
• [x] TODO -- update clients if all works out after push

[yarikoptic]

I think we are done with this