Release signing keys may be poisoned #29531

💡 Initially reported in this comment, but I felt it warranted an issue of its own given the age of the issue on which it is attached.

This is not an issue with Node.js itself, but rather with the manner in which the release team's keys are currently distributed.

Impact

Automated installations of Node.js binaries which depend upon the documented method of verifying release signatures are no longer functional. No suitable alternatives currently exist for obtaining public keys of the Node.js release team.

Any tools which continue to rely on the SKS keyserver network may be rendered unusable by certificates poisoned via CVE-2019-13050.

Bottom Line

The SKS keyserver network is no longer a viable option for distributing release keys.

Details

With the recent and unmitigated death of the SKS keyserver network (in CVE-2019-13050), the documented method of obtaining the PGP public keys of the release team is no longer viable, and in fact may have dire consequences to an OpenPGP installation. A different method of distributing release keys, or even of signing and verifying the release package itself, is necessary.

Proposed Solution

For minimal impact, my recommendation would be to place the public keys or authorized releasers within this repo, under a /keys directory, in a manner similar to that of signed RubyGems (except instead of X.509 certificates in a certs/ directory, we'd be talking about ASCII-armored PGP certificates in a keys/ directory), and update the README with instructions on how to import those keys into the OpenGPG keychain from the repo instead of from the SKS keyserver network.

Alternatively, or in addition to the above, publishing these keys to nodejs.org may also provide a second factor to build assurance of the keys' integrity.

💡 Especially paranoid users may want to seek additional verification from unaffiliated yet equally trusted soruces by fetching and comparing keys from those sources as well.