Place public OpenPGP key in the file system directory openpgp

[bernhardreiter]

As clarified from @tschmidtb51 and others in January, the public OpenPGP key used for signing the CSAF files shall be placed in a directory openpgp/ next to the provider-metadata.json by the provider.

Accordingly this is where the pgp_keys url should point to.

[bernhardreiter]

Rationale

Not using WKD or public pubkey servers is making the implementation more reliable and simpler for provider and client implementors.

WKD would require an email address and public pubkeyservers often do not provide additional data to verify the pubkey.

[bernhardreiter]

changes towards csd02

The standard document has meanwhile changed to be more explicit about this:

https://docs.oasis-open.org/csaf/csaf/v2.0/csd02/csaf-v2.0-csd02.html#7120-requirement-20-public-openpgp-key :

The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.

For example, the public part of the OpenPGP key could be placed in a directory openpgp adjacent to the provider-metadata.json.

https://docs.oasis-open.org/csaf/csaf/v2.0/csd02/csaf-v2.0-csd02.html#717-requirement-7-provider-metadatajson :

 "public_openpgp_keys": [
      {
        "fingerprint": "8F5F267907B2C4559DB360DB2294BA7D2B2298B1",
        "url": "https://keys.example.net/vks/v1/by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
      }
    ],

technical approach

• We can use the long fingerprint as filename in the openpgp directory.
• The csaf_provider can use the create step to copy over the current public key in the directory, if it is not in there. Previous pubkeys stay in there.
• The aggregator will copy all pubkeys in mirror mode and add its own pubkey if it does additional signatures.
• The provider-metadata.json shall list all pubkeys in that directory.