Verifying signed releases

[diabonas]

Releases are currently signed by one of the three following PGP keys as described in RELEASE.md¹:

• William Roberts (5B482B8E3E19DA7C978E1D016DE2E9078E1F50C1)
• Javier Martinez Canillas (D75ED7AA24E50CD645C6F457C751E590D63F3D69)
• Joshua Lock (5BEC526CE3A61CAF07E7A7DA49BCAE5443FFFC34)

I noticed that only the second of these keys seems to be available on a public keyserver. Would it be possible to add the other two keys to the OpenPGP keyserver pool as well?

This would make it much easier to verify a release automatically, e.g. in the build process of an Arch Linux User Repository (AUR) package, as users can import the keys directly using gpg --receive-keys <fingerprint> instead of having to clone the Git repository and manually importing them from the tags.
For the sister projects tpm2-tss and tpm2-abrmd, this is already the case, as documented in their RELEASE.md.

¹ This document is a bit outdated, as it only lists the william-roberts-pub tag, but the other two keys in javier-martinez-pub and joshua-lock-pub can be found easily by looking at the list of all tags.

[williamcroberts]

I uploaded my key:

• https://pgp.mit.edu/pks/lookup?op=vindex&search=0x6DE2E9078E1F50C1
• I also archived revocation certificates in case I need to revoke the key from the server.

FYI How to generate "ascii armor version":

gpg --armor --export <key id>

I just grabbed the key id from my ~/.gitconfig file.

@joshuagl and @martinezjavier can you please do the same. I also recommend securely archiving revocation certs. I have a few generated for different scenarios:

• lost key/key no longer used
• compromised key

[williamcroberts]

We also should re-write our RELEASE.md to clarify this change. I still want to keep a public key as an object in the git repo.

[martinezjavier]

@williamcroberts as @diabonas mentioned, I already uploaded my key to a public keyserver (pgp.mit.edu) a long time ago.

[williamcroberts]

@martinezjavier sorry, senior moment.

[joshuagl]

I've uploaded my key: https://pgp.mit.edu/pks/lookup?op=vindex&search=0x49BCAE5443FFFC34

[martinezjavier]

@martinezjavier sorry, senior moment.

haha, no worries. I just mentioned to let you know that's already there.

[diabonas]

Nice, thank you very much @martinezjavier @williamcroberts @joshuagl! The next version of the Arch Linux AUR package for tpm2-tools will have signature verification enabled.