Skip to content

Archlinux distro signing public key update to (expires 2037-10-27)#1457

Merged
tlaurion merged 1 commit intolinuxboot:masterfrom
tlaurion:archlinux_distro_pukey_update
Aug 11, 2023
Merged

Archlinux distro signing public key update to (expires 2037-10-27)#1457
tlaurion merged 1 commit intolinuxboot:masterfrom
tlaurion:archlinux_distro_pukey_update

Conversation

@tlaurion
Copy link
Copy Markdown
Collaborator

@tlaurion tlaurion commented Aug 8, 2023

Fixes #1456

Replication notes:

user@heads-tests-deb12:~/heads$ mkdir -p /tmp/archlinux
wget https://keys.openpgp.org/vks/v1/by-fingerprint/3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C -O /tmp/archlinux/archlinux.key
gpg --home /tmp/archlinux --import /tmp/archlinux/archlinux.key
gpg --home /tmp/archlinux --edit-key 3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C
--2023-08-08 12:51:45--  https://keys.openpgp.org/vks/v1/by-fingerprint/3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C
Resolving keys.openpgp.org (keys.openpgp.org)... 37.218.245.50, 2a00:c6c0:0:154:1::1
Connecting to keys.openpgp.org (keys.openpgp.org)|37.218.245.50|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1321 (1.3K) [application/pgp-keys]
Saving to: ‘/tmp/archlinux/archlinux.key’

/tmp/archlinux/archlinux.key          100%[=======================================================================>]   1.29K  --.-KB/s    in 0s      

2023-08-08 12:51:45 (13.1 MB/s) - ‘/tmp/archlinux/archlinux.key’ saved [1321/1321]

gpg: WARNING: unsafe permissions on homedir '/tmp/archlinux'
gpg: keybox '/tmp/archlinux/pubring.kbx' created
gpg: /tmp/archlinux/trustdb.gpg: trustdb created
gpg: key 76A5EF9054449A5C: public key "Pierre Schmitz <pierre@archlinux.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: WARNING: unsafe permissions on homedir '/tmp/archlinux'
gpg (GnuPG) 2.2.40; Copyright (C) 2022 g10 Code GmbH
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.


pub  ed25519/76A5EF9054449A5C
     created: 2022-10-31  expires: 2037-10-27  usage: SC  
     trust: unknown       validity: unknown
sub  ed25519/D6D13C45BFCFBAFD
     created: 2022-10-31  expires: 2037-10-27  usage: A   
sub  cv25519/7F56ADE50CA3D899
     created: 2022-10-31  expires: 2037-10-27  usage: E   
[ unknown] (1). Pierre Schmitz <pierre@archlinux.org>
[ unknown] (2)  Pierre Schmitz <pierre@archlinux.de>

gpg> minimize
User ID "Pierre Schmitz <pierre@archlinux.org>": already minimized
User ID "Pierre Schmitz <pierre@archlinux.de>": already minimized

gpg> q
user@heads-tests-deb12:~/heads$ gpg --home /tmp/archlinux  --export --armor  3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C 
gpg --home /tmp/archlinux  --export --armor  3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C > initrd/etc/distro/keys/archlinux.key
gpg: WARNING: unsafe permissions on homedir '/tmp/archlinux'
-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEY1+RVxYJKwYBBAHaRw8BAQdAd3XdZwOmmiALePwd26Bu3hPblAfHflGN+Lud
gE2Qyby0JFBpZXJyZSBTY2htaXR6IDxwaWVycmVAYXJjaGxpbnV4LmRlPoiWBBMW
CAA+AhsDBQkcMgSABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAFiEEPoDKGouJ9py6
V9mKdqXvkFREmlwFAmNfk2gACgkQdqXvkFREmlzdiwD9Hf7TDfxBrJ1YwpD9lLtU
VI4Kpze3P5deOb5REsGE5ocBAPn7WymPFoTUfrrxfmlsqZtSz+2D5GdXEWQYOTqU
vu0MtCVQaWVycmUgU2NobWl0eiA8cGllcnJlQGFyY2hsaW51eC5vcmc+iJkEExYI
AEECGwMFCRwyBIAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQQ+gMoai4n2nLpX
2Yp2pe+QVESaXAUCY1+TaAIZAQAKCRB2pe+QVESaXLQPAQCFeOXY4m9LPfMDNzrO
IElLyh+w9p9PBa80AsAsjXGC1gEAy9Ymc3jnAj2MJDnby3b5WyNzDbjBMKVhv2Cv
mDln0Aq4MwRjX5HTFgkrBgEEAdpHDwEBB0DjSWuxVrnVYEIcJlRJPmn54ReBGvqP
+EYB2BVx5ZFPv4h+BBgWCAAmFiEEPoDKGouJ9py6V9mKdqXvkFREmlwFAmNfkdMC
GyAFCRwyBIAACgkQdqXvkFREmlzEGwEAwvDuiUn1Mgw0x7/m0hXzveAAgLVdJWD+
0/YiepxE9GoA/jCgNca2AuWyi416FYQkFtqtlIjWUb56hY5WlBvpNZIOuDgEY1+R
VxIKKwYBBAGXVQEFAQEHQIhe0t8UMpN+G4c24ByW/Y1vu1m3C62KsvlRPzw/R0AN
AwEIB4h+BBgWCAAmFiEEPoDKGouJ9py6V9mKdqXvkFREmlwFAmNfkVcCGwwFCRwy
BIAACgkQdqXvkFREmlynZgD+PlibATlapVxz6EprGMfnktevUlfWQwShRJ+w/x8I
zyAA/0nOvoE7j4sdvg4QoW/s2nPYaDy8EK/XAMRT15eScYIH
=FFYH
-----END PGP PUBLIC KEY BLOCK-----

@tlaurion
Copy link
Copy Markdown
Collaborator Author

tlaurion commented Aug 8, 2023 •
edited
Loading

This PR should update CircleCI checks soon, meanwhile build is happening at https://app.circleci.com/pipelines/github/tlaurion/heads/1881/workflows/cc19a950-affb-4025-af15-960a9fa1ebaa

Upgrade instructions are at https://osresearch.net/Updating

@europeanchicken
Copy link
Copy Markdown

europeanchicken commented Aug 8, 2023 •
edited by tlaurion
Loading

T430 maximised unable to boot to Arch Linux iso:
"gpg: Can't check signature: No public key"

@tlaurion edit: that was prior of this PR, on master

@tlaurion
Copy link
Copy Markdown
Collaborator Author

tlaurion commented Aug 11, 2023 •
edited
Loading

Another case where things working is not reported as working I guess. Merging since otherwise what is upstream is not working? Assigning to not forget to push when we have a working cache to not consume CircleCI cpu time for nothing

@tlaurion tlaurion self-assigned this Aug 11, 2023
@tlaurion tlaurion merged commit f42070a into linuxboot:master Aug 11, 2023
tlaurion added a commit to tlaurion/heads that referenced this pull request Mar 27, 2026
@tlaurion
distro/keys: minimize archlinux and tails signing keys
348a306 
Re-export both keys through the new update_distro_signing_key scripts
to strip non-signing subkeys (encryption, authentication) and expired
subkeys that had accumulated in the in-tree copies.  Only the primary
key and currently-valid signing subkeys are retained.

  archlinux.key: 1168B -> 673B  (495B saved,   auth+encrypt subkeys removed)
  tails.key:     21282B -> 7376B (13906B saved, expired+non-signing subkeys removed)

Qubes OS keys (4.2, 4.3, weekly builds) were already minimal -- no change.

Fixes linuxboot#2066.

This class of manual update has been needed repeatedly in the past and
was caught late each time, causing distro ISO verification failures in
the field for Tails and other supported distros:
  linuxboot#1808 (issue: Tails key expired, ISOs unbootable)
  linuxboot#1631 (PR: update tails.key, replay of manual steps)
  linuxboot#1809 (PR: replay of linuxboot#1631 for next Tails rotation)
  linuxboot#2000 (PR: Tails 7.0 key, same manual process again)
  linuxboot#1457 (PR: Arch Linux key update)
  linuxboot#2033 (PR: Qubes OS 4.3 key addition)

TODO: wire bin/update_distro_signing_keys.sh into CI (e.g. a scheduled
      workflow) so upstream key rotations are detected automatically
      before they break users.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@tlaurion tlaurion

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Archlinux updated their distro signing key

2 participants

@tlaurion @europeanchicken