Transfer canterberry/nodejs-keys into nodejs/keys

[canterberry]

Delivers nodejs/build#1913.

Summary

https://github.com/canterberry/nodejs-keys → https://github.com/nodejs/keys

The proposed nodejs/keys repo would hold the PGP signing keys for members of the Node.js release team.

Permissions

This repo should be readable by the general public, but only members of the Node.js organization with permission to manage membership in the release team should have write or merge privileges on master.

[Trott]

@nodejs/build @nodejs/tsc

[Trott]

@nodejs/community-committee

[addaleax]

👍

Only suggestion I’d have to is to be more explicit when naming the repo, e.g. nodejs/release-keys rather than just nodejs/keys.

[canterberry]

Well observed, @addaleax. In the immediate term, the only known use case for this repo would be for the release team's signing keys. However, there's little reason why it could not be the source of truth for the PGP keys of other members of the organization as well! For example, members of the security team, for researchers to submit vulnerability disclosures via encrypted email.

[rvagg]

^ I agree, I was imagining the same thing re adding the option of sending encrypted emails to security@, report@, etc.

[sam-github]

nodejs/pgp-keys? nodejs/org-keys? nodejs/nodejs-keys?

[bnb]

+1 as long as build and TSC +1. I'm also okay with nodejs/keys simply based on my personal naming aesthetics, but can understand why others may differ. If we plan on including additional keys, I think this makes even more sense given that it'll be a generic catch-all and we can avoid forcing a specific use with the most generic term.

One thing I would recommend is avoiding duplicate information, like the org name ❤️

[sam-github]

Remember we already have a repo that contains keys:

• github.com/nodejs/keys - has gpg keys
• github.com/nodejs/secrets - has ssh keys

I don't think anybody could guess that from the names.

Thus my suggested more specific names: #456 (comment)

Not blocking, just anticipating people coming along and wanting to know why the build keys aren't in "nodejs/keys".

[joyeecheung]

@sam-github https://github.com/nodejs/secrets contains private keys (for ssh-ing into the machines), https://github.com/nodejs/keys doesn't seem to exist? (EDIT: oh right, its what this issue requests) From what I can tell, https://github.com/canterberry/nodejs-keys only contains public keys. I guess we should be fine if simply document what those repos are in the README, or the distinction would be obvious from the fact that https://github.com/nodejs/secrets is um, private

[bnb]

@joyeecheung +1 to distinguishing in READMEs. The description could also include something along the lines of If you're looking for public keys, please see [nodejs/keys](). and If you're looking for private keys, please see [nodejs/secrets (private)](). for nodejs/secrets and nodejs/keys, respectively.

[canterberry]

@joyeecheung 👍 Knowing now that both nodejs/keys and nodejs/secrets both currently exist and contain secrets, to revise my initial proposal:

• Move all GPG private keys into the nodejs/secrets repo.
• Delete the current private nodejs/keys repo (to ensure private keys are absent from the repo history).
• Create a new nodejs/keys repo, initially marked as private.
• Copy the contents of canterberry/nodejs-keys into the nodejs/keys repo.
• Perform an internal review/audit of the nodejs/keys repo at this point to ensure its accuracy and trustworthiness.
• Mark the nodejs/keys repo as public.
• Update references to Node.js release signing keys to direct users to the nodejs/keys repo as the source of truth for these.
• Incorporate addition/removal of signing keys into the onboarding/offboarding process for authorized members of the release team.

[rvagg]

What is this existing nodejs/keys repo? Can someone with org access please definitively confirm that such a thing exists and what it contains? I'm not aware of it ever existing and have only been without org admin access for a year or so now. The secrets repo is nodejs-private/secrets. I don't believe we're storing GPG private keys for anything anywhere, I know for sure we're not in secrets. Our policy to date has for people who access nodejs-private/secrets (and releasers who sign releases) to maintain their own GPG keys and we just use public keys for encrypting shared secrets so they can be accessed by certain individuals only (see https://github.com/ConradIrwin/dotgpg for our main tool).

[canterberry]

Thanks for clarifying @rvagg . It's a bit unclear to non-members whether such a repo exists, since if it does it would be private. It wasn't until this comment that it seemed like there might be a conflict preventing this proposal from moving forward.