From: "Robin H. Johnson (robbat2)" <robbat2@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] gentoo commit in xml/htdocs/proj/en/releng: index.xml
Date: Wed, 02 Sep 2009 03:35:26 +0000 [thread overview]
Message-ID: <E1Migd4-0004tI-5M@stork.gentoo.org> (raw)
robbat2 09/09/02 03:35:26
Modified: index.xml
Log:
Document releng usage of PGP keys.
Revision Changes Path
1.118 xml/htdocs/proj/en/releng/index.xml
file : http://sources.gentoo.org/viewcvs.py/gentoo/xml/htdocs/proj/en/releng/index.xml?rev=1.118&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo/xml/htdocs/proj/en/releng/index.xml?rev=1.118&content-type=text/plain
diff : http://sources.gentoo.org/viewcvs.py/gentoo/xml/htdocs/proj/en/releng/index.xml?r1=1.117&r2=1.118
Index: index.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/releng/index.xml,v
retrieving revision 1.117
retrieving revision 1.118
diff -p -w -b -B -u -u -r1.117 -r1.118
--- index.xml 24 Sep 2008 17:47:21 -0000 1.117
+++ index.xml 2 Sep 2009 03:35:25 -0000 1.118
@@ -68,6 +68,83 @@ machines page</uri>.
</extraproject>
<extrachapter>
+<title>Release security & signing</title>
+<section>
+<body>
+<p>
+All release media will have its DIGESTS file signed by one of the <c>Gentoo Linux
+Release Engineering (releng@gentoo.org)</c> PGP keys listed on this page.
+The keys are available through the <c>subkeys.pgp.net</c> keyserver. They can
+be used to verify that the media is, in fact, the media shipped by Release
+Engineering and not from a potential attacker. You will find more detailed
+verification instructions in the handbooks for each release.
+</p>
+
+<p>
+New keys and changes to existing keys will be announced to the following
+Gentoo mailing lists: gentoo-dev-announce, gentoo-announce, gentoo-core.
+</p>
+
+<note>
+Releases up to and including 2007.0 had PGP signatures directly on top of the
+files. This required large quantities of disk IO for generation on the servers,
+and validation on the client side. As such, as of the 2008.0 release, the
+DIGESTS file is now signed instead, making verification a two-step process, but
+overall much quicker.
+</note>
+
+<pre caption="Obtaining the public key">
+$ <i>gpg --keyserver subkeys.pgp.net --recv-keys <key id></i>
+</pre>
+
+<pre caption="Verify the cryptographic signature">
+$ <i>gpg --verify <foo.DIGESTS.asc> <foo.DIGESTS></i>
+</pre>
+
+<pre caption="Verify the checksum">
+$ <i>sha1sum -c <foo.DIGESTS></i>
+</pre>
+
+<table>
+<tr>
+<th>Key ID</th>
+<th>Key Type</th>
+<th>Key Fingerprint</th>
+<th>Key Description</th>
+<th>Notes</th>
+</tr>
+
+<tr>
+<ti>0x239C75C4</ti>
+<ti>1024-bit DSA</ti>
+<ti>AE54 54F9 67B5 6AB0 9AE1 6064 0838 C26E 239C 75C4</ti>
+<ti>Gentoo Portage Snapshot Signing Key (Automated Signing Key)</ti>
+<ti>Used for daily Portage snapshots.</ti>
+</tr>
+
+<tr>
+<ti>0x17072058</ti>
+<ti>1024-bit DSA</ti>
+<ti>D99E AC73 79A8 50BC E47D A5F2 9E64 38C8 1707 2058</ti>
+<ti>Gentoo Linux Release Engineering (Gentoo Linux Release Signing Key)</ti>
+<ti>Used for releases 2004.2-2008.0</ti>
+</tr>
+
+<tr>
+<ti>0x2D182910</ti>
+<ti>4096-bit RSA</ti>
+<ti>13EB BDBE DE7A 1277 5DFD B1BA BB57 2E0E 2D18 2910</ti>
+<ti>Gentoo Linux Release Engineering (Automated Weekly Release Key)</ti>
+<ti>Used for automated weekly releases.</ti>
+</tr>
+
+</table>
+
+</body>
+</section>
+</extrachapter>
+
+<extrachapter>
<title>Latest release</title>
<section>
next reply other threads:[~2009-09-01 22:26 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-09-02 3:35 Robin H. Johnson (robbat2) [this message]
-- strict thread matches above, loose matches on Subject: below --
2013-12-29 14:24 [gentoo-commits] gentoo commit in xml/htdocs/proj/en/releng: index.xml Markos Chandras (hwoarang)
2013-12-16 4:00 Matt Turner (mattst88)
2013-08-24 20:20 Robin H. Johnson (robbat2)
2013-08-24 20:16 Robin H. Johnson (robbat2)
2013-08-15 22:47 William Hubbs (williamh)
2013-08-15 19:22 Richard Farina (zerochaos)
2013-08-15 18:57 Richard Farina (zerochaos)
2013-08-15 18:54 Richard Farina (zerochaos)
2013-08-15 18:24 Michael Weber (xmw)
2013-08-15 17:37 Michael Weber (xmw)
2013-08-15 16:28 Markos Chandras (hwoarang)
2013-01-10 19:27 Robin H. Johnson (robbat2)
2012-12-04 22:44 Richard Farina (zerochaos)
2012-10-20 15:03 Anthony G. Basile (blueness)
2012-10-07 13:53 Raul Porcel (armin76)
2012-06-30 12:47 Jorge Manuel B. S. Vicetto (jmbsvicetto)
2012-06-30 11:49 Jorge Manuel B. S. Vicetto (jmbsvicetto)
2011-11-25 5:32 Robin H. Johnson (robbat2)
2011-11-25 5:24 Robin H. Johnson (robbat2)
2011-11-25 5:18 Robin H. Johnson (robbat2)
2011-10-09 13:57 David Abbott (dabbott)
2011-06-03 21:26 Matt Turner (mattst88)
2011-04-08 4:56 Jorge Manuel B. S. Vicetto (jmbsvicetto)
2011-04-08 4:35 Jorge Manuel B. S. Vicetto (jmbsvicetto)
2011-04-08 3:18 Jorge Manuel B. S. Vicetto (jmbsvicetto)
2011-04-08 2:52 Jorge Manuel B. S. Vicetto (jmbsvicetto)
2010-08-09 0:51 Jorge Manuel B. S. Vicetto (jmbsvicetto)
2010-05-10 7:11 Peter Volkov (pva)
2010-03-18 15:18 Ben de Groot (yngwin)
2009-09-02 9:38 Torsten Veller (tove)
2009-09-02 7:38 Robin H. Johnson (robbat2)
2009-09-02 7:33 Robin H. Johnson (robbat2)
2008-09-24 17:47 Christoph Mende (angelos)
2008-09-18 8:46 Joshua Saddler (nightmorph)
2008-09-17 20:53 Ben de Groot (yngwin)
2008-09-10 19:55 Ben de Groot (yngwin)
2008-07-28 19:55 Ben de Groot (yngwin)
2008-07-18 14:40 Ben de Groot (yngwin)
2008-07-07 9:57 Peter Volkov (pva)
2008-07-06 8:36 Joshua Saddler (nightmorph)
2008-06-20 2:44 Joshua Saddler (nightmorph)
2008-03-10 22:02 Tobias Klausmann (klausman)
2008-03-09 13:48 Lukasz Damentko (rane)
2008-01-28 16:38 Chris Gianelloni (wolf31o2)
2008-01-25 0:26 Chris Gianelloni (wolf31o2)
2008-01-24 4:19 Chris Gianelloni (wolf31o2)
2007-11-24 0:58 Chris Gianelloni (wolf31o2)
2007-11-22 0:43 Chris Gianelloni (wolf31o2)
2007-11-21 23:00 Chris Gianelloni (wolf31o2)
2007-10-30 23:50 Chris Gianelloni (wolf31o2)
2007-10-30 23:21 Chris Gianelloni (wolf31o2)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E1Migd4-0004tI-5M@stork.gentoo.org \
--to=robbat2@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox