search

eduvpn / eduvpn-common

Code to be shared between eduVPN clients
MIT License
5 stars 3 forks source link

PGP public key? #11

Closed hv15 closed 1 year ago

hv15 commented 1 year ago

Hi, I've packaged this for ArchLinux and noticed that the PGP detached signature for the release 1.0.0 uses a public key (0x02BB8048BBFF222C) that isn't published on the major key servers. Is the public key located somewhere public? Thanks!

jwijenbergh commented 1 year ago

Hey! Thanks, this is something I overlooked to document as these signatures are right now mainly verified in our own package builders.

Thanks a lot for updating your AUR packages (and so quickly!). The keys have just been uploaded here https://github.com/eduvpn/eduvpn-common/tree/main/keys, maybe you can then push the GPG key within the AUR packages (or hardcode it in the pkgbuild?) so that you immediately notice if it has changed.

They are available on external sources too (so that this repo is not a single source of truth), e.g. https://app.eduvpn.org/linux/v4/deb/app+linux@eduvpn.org.asc and https://git.sr.ht/~jwijenbergh/python3-eduvpn-common.rpm/tree/main/item/SOURCES/minisign-CA9409316AC93C07.pub.

Keyservers is possible, but also not the most secure way.

Apologies for replying so late, I did not get a notification for some reason.

I will make sure this is all better documented

hv15 commented 1 year ago

Hi @jwijenbergh, no worries! Thank you for uploading the keys and also pointing to alternative urls. Do you know if this key will be used for the other eduvpn packages?

jwijenbergh commented 1 year ago

This was the plan indeed, I have just released a tiny hotfix release on the linux client that fixes 2 issues. These tarballs are also signed with the same keys https://github.com/eduvpn/python-eduvpn-client/releases/tag/4.0.1

hv15 commented 1 year ago

Thank you! I've updated the archlinux packages!

jwijenbergh commented 1 year ago

Thank you! I've updated the archlinux packages!

Thanks a ton for your hard work!

jwijenbergh commented 1 year ago

@hv15 Sorry to contact you. Could you add -tags=release to the python eduvpn-common AUR package in GOFLAGS. I made a short document describing release building here https://eduvpn.github.io/eduvpn-common/gettingstarted/building/release.html

Maybe I should add a makefile target that adds this flag :)

This ensures the list of servers is also embedded in the shared library in case the discovery server is offline

hv15 commented 1 year ago

Thank you! New release pushed!

jwijenbergh commented 1 year ago

Thanks!