[gentoo-project] GPG Keyring distribution & packages

[Robin H. Johnson]

On Fri, Nov 15, 2013 at 01:51:32PM -0500, Rick "Zero_Chaos" Farina wrote:
> On 11/15/2013 01:23 AM, Robin H. Johnson wrote:
> > You crossed sections, but let's collapse both to:
> >
> > Bare minimum requirements:
> > 3. Key expiry: 6 months min, 3 years max.
> > Recommendations:
> > 4.1. Root key: 6 months min, 3 year max;
> > 4.2. Signing subkey: 3 months min, 1 year max;
> > 4.3. For both keys, expiry date should always be update at least 1 month before expiry.
> How are we planning on updating keys on user's systems to verify things?
>  I only ask because 3 months on the signing key means whatever we do
> needs to happen *securely* every 3 months at most.  So like, if we are
> pushing an ebuild with a keyring then we have to update it every 2
> months so keys don't expire and then that would break if the user
> doesn't update every 3 months...  Might be an issue as we try as a whole
> to keep systems updatable for 1 year.
So some more details regarding how we plan to deploy keys is probably
needed here. It was out of scope for the discussion about what keys
should look like.

There are a few parts to it:
- gentoo-keys (lead by dolsen)
  This is a mostly infra-level tool that takes the data in LDAP, does
  validation, mixes in the keys from keyserver/homedir, and generates
  keyrings.
- keyring packages:
  Thus far, based on the Debian keyring model, where keyrings of trusted
  keys are installed locally in /usr/share/keyrings/, and the package
  manager (or other tools) looks there for validation. I've got a few
  planned so far:
  $CAT/gentoo-dev-keyring
  $CAT/gentoo-releng-keyring
  $CAT/gentoo-master-keyring
  To ease the 1-year-updatability requirement, these three packages
  should explicitly be signed by the master key (and not a dev key),
  which has a much longer validity. This would always enable you to
  rsync, install the latest gentoo-dev-keyring, and then install other
  packages thereafter.
- layman keyrings:
  dolsen is also working on allowing overlays to specify keyrings in the
  repositories.xml; there's a few unanswered questions about how to
  ensure nobody does MITM attacks on those keyrings (either convince the
  overlays admins to change the URL to the keyring, or simply intercept
  requests for the keyring itself). This maps to how Ubuntu's Launchpad
  handles keys for PPAs.
 
TODO:
We need a way for a given repo, once installed, to specify what keyrings
to use for validation. I'm thinking of adding it to
metadata/layout.conf.
The main gentoo-x86 repo would have for example:
keyrings = gentoo-master gentoo-releng gentoo-dev

Overlays might have:
keyrings = gentoo-overlay-mysql 

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Trustee & Infrastructure Lead
E-Mail     : robbat2@g.o
GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85