Feat: validate gpg releasers signatures #760
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Notes
This is currently under a draft version. They main objetive is to collect early feedback before creating the final PR (proper linting, tests, etc...)
This is my first time doing changes on NCU so I might be using wrongly the API or breaking any expected convention, please let me know 👍
What is this feature about?
While working on nodejs/Release#966, @RafaelGSS suggested to extend the NCU to review the signatures.
This PR introduce a new command
ncu-team check-gpg
. This command will check the current releasers team members and the available information in the README.md and make some checks on the status of the individuals keys and if the keys/releasers are properly listed on theREADME.md
Currently checks included
README.md
Potential additional checks
hkps://keys.openpgp.org
as expected?Current output
![Screenshot 2023-12-04 at 17 44 03](https://private-user-images.githubusercontent.com/5110813/287774281-1c2d1112-805a-4a7d-a1ff-75cceec35edb.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYwODYwODEsIm5iZiI6MTcyNjA4NTc4MSwicGF0aCI6Ii81MTEwODEzLzI4Nzc3NDI4MS0xYzJkMTExMi04MDVhLTRhN2QtYTFmZi03NWNjZWVjMzVlZGIucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDkxMSUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA5MTFUMjAxNjIxWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9MjQzMTAyNDgwOWEwODRmNGM1N2NhZDQzNDliODg4MTFjOTRjNDBlMmYwMWFiNzAxYzA1MTIxZmNkNWIzYTk2MiZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.jv9UhxEEjlv67pF9WNhh-rHG4ZF2mOcO-hrHje-xMWs)