Commits on Oct 26, 2023

1. Have JI validate journalist key is valid …

   During the Sequoia migration, we need to export the journalist public
   key from the GPG keyring into a file on disk. We also needed to validate
   the key was usable by Sequoia (e.g. no SHA-1 binding signatures).
   
   Previously the plan was to validate it during the postinst and error out
   if it wasn't valid, but if validation fails for whatever reason, then we
   abort, which interrupts the postinst, so, e.g. database upgrades won't
   be applied. In retrospect having the validation fail at package install
   time is bad, because it requires even more manual work to get an
   instance in a working state since you need to manually apply the updates
   after doing a key rotation.
   
   Now we validate the journalist key during startup of the Journalist
   Interface, printing and logging an error if it doesn't validate and then
   exiting. This should bring attention to journalists and therefore the
   admin that the instance needs manual attention. We will also include
   information about this change in the pre-release and release
   announcements.
   
   Fixes #7030.

   

   legoktm committed Oct 26, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 7fd01d9
   • Browse repository at this point

   Copy the full SHA

   7fd01d9 View commit details

   Browse the repository at this point in the history