Removes old release signing key from securedrop-keyring #5979
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Removed old key from existing keyring using commands: ``` cd install_files/securedrop-keyring gpg --no-default-keyring --keyring etc/apt/trusted.gpg.d/securedrop-keyring.gpg \ --delete-key "22245C81E3BAEB4138B36061310F561200F4AD77" ``` - Updated testinfra test to verify that only new signing key is present.
zenmonkeykstop
moved this from Ready for Review
to Near Term - SecureDrop Core
in SecureDrop Team Board
|
We've discussed including this change for v2.0.0, but decided against it: right now, the prod Release file is still signed with the old key, so let's continue to honor that config until we've shipped v2. Then we can follow up in the n+1 release and pull in the changes presented here, as well as yanking out the dual-key logic in e.g. the Tails Workstation admin logic. |
|
Testing locally: That's what we want! |
conorsch
approved these changes
Aug 13, 2021
27 tasks
conorsch
pushed a commit
that referenced
this pull request
Oct 12, 2021
Follow-up to #5979. Removes the old, i.e. 22245C81E3BAEB4138B36061310F561200F4AD77, apt key from the Ansible install-time logic. The key has been expired since 2021-06-30.
conorsch
pushed a commit
that referenced
this pull request
Oct 12, 2021
Follow-up to #5979. Removes the old, i.e. 22245C81E3BAEB4138B36061310F561200F4AD77, apt key from the Ansible install-time logic. The key has been expired since 2021-06-30.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready for review.
Description of Changes
Towards #5923 .
Removes the key with fingerprint
22245C81E3BAEB4138B36061310F561200F4AD77from the keyting installed by thesecuredrop-keyringpackage.Testing
securedrop-keyringkeyring, with fingerprint2359E6538C0613E652955E6C188EDD3B7B22E6A3make testinfrapasses against a staging environment built from this branch.Deployment
aptoperations will work, the keyring package will be updated successfully, and other packages should also be fine regardless of installation order.Checklist
If you added or removed a file deployed with the application:
If you made non-trivial code changes:
Choose one of the following: