Skip to content

Commit afa4c78

Browse files
aduh95aduh95
committed
feat: add gpg-only-active-keys/ keyring
1 parent 5f720ce commit afa4c78

File tree

6 files changed

+102
-58
lines changed

6 files changed

+102
-58
lines changed

‎.gitignore‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# Backup files, redundant with git history
2-
/gpg/*~
2+
/gpg*/*~
3+
/gpg*/S.*
34

45
# TOFU trust database (unused; see https://www.gnupg.org/documentation/manuals/gnupg/GPG-Configuration-Options.html)
5-
/gpg/tofu.db
6+
/gpg*/tofu.db

‎README.md‎

Lines changed: 61 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -2,70 +2,75 @@
22

33
Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
44

5-
* **Antoine du Hamel** <duhamelantoine1995@gmail.com>
6-
[`C0D6248439F1D5604AAFFB4021D900FFDB233756`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/C0D6248439F1D5604AAFFB4021D900FFDB233756.asc)
7-
* **Beth Griggs** <bgriggs@redhat.com>
8-
[`4ED778F539E3634C779C87C6D7062848A1AB005C`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/4ED778F539E3634C779C87C6D7062848A1AB005C.asc)
9-
* **Bryan English** <bryan@bryanenglish.com>
10-
[`141F07595B7B3FFE74309A937405533BE57C7D57`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/141F07595B7B3FFE74309A937405533BE57C7D57.asc)
11-
* **Colin Ihrig** <cjihrig@gmail.com>
12-
[`94AE36675C464D64BAFA68DD7434390BDBE9B9C5`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/94AE36675C464D64BAFA68DD7434390BDBE9B9C5.asc)
13-
* **Danielle Adams** <adamzdanielle@gmail.com>
14-
[`74F12602B6F1C4E913FAA37AD3A89613643B6201`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/74F12602B6F1C4E913FAA37AD3A89613643B6201.asc)
15-
* **James M Snell** <jasnell@keybase.io>
16-
[`71DCFD284A79C3B38668286BC97EC7A07EDE3FC1`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/71DCFD284A79C3B38668286BC97EC7A07EDE3FC1.asc)
17-
* **Michaël Zasso** <targos@protonmail.com>
18-
[`8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600.asc)
19-
* **Myles Borins** <myles.borins@gmail.com>
20-
[`C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8.asc)
21-
* **Rafael Gonzaga** <rafael.nunu@hotmail.com>
22-
[`890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4.asc)
23-
* **Richard Lau** <rlau@redhat.com>
24-
[`C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C.asc)
25-
* **Rod Vagg** <rod@vagg.org>
26-
[`DD8F2338BAE7501E3DD5AC78C273792F7D83545D`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/DD8F2338BAE7501E3DD5AC78C273792F7D83545D.asc)
27-
* **Ruben Bridgewater** <ruben@bridgewater.de>
28-
[`A48C2BEE680E841632CD4E44F07496B3EB3C1762`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/A48C2BEE680E841632CD4E44F07496B3EB3C1762.asc)
29-
* **Ruy Adorno** <ruyadorno@hotmail.com>
30-
[`108F52B48DB57BB0CC439B2997B01419BD92F80A`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/108F52B48DB57BB0CC439B2997B01419BD92F80A.asc)
31-
* **Shelley Vohr** <shelley.vohr@gmail.com>
32-
[`B9E2F5981AA6E0CD28160D9FF13993A75599653C`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/B9E2F5981AA6E0CD28160D9FF13993A75599653C.asc)
33-
* **Marco Ippolito** &lt;<marcoippolito54@gmail.com>&gt;
34-
[`CC68F5A3106FF448322E48ED27F5E38D5B0A215F`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/CC68F5A3106FF448322E48ED27F5E38D5B0A215F.asc)
35-
* **Ulises Gascón** &lt;ulisesgascongonzalez@gmail.com&gt;
36-
[`A363A499291CBBC940DD62E41F10027AF002F8B0`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/A363A499291CBBC940DD62E41F10027AF002F8B0.asc)
5+
* **Antoine du Hamel** <<duhamelantoine1995@gmail.com>>
6+
[`C0D6248439F1D5604AAFFB4021D900FFDB233756`](./keys/C0D6248439F1D5604AAFFB4021D900FFDB233756.asc)
7+
* **Juan José Arboleda** <<soyjuanarbol@gmail.com>>
8+
[`DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7`](./keys/DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7.asc)
9+
* **Marco Ippolito** <<marcoippolito54@gmail.com>>
10+
[`CC68F5A3106FF448322E48ED27F5E38D5B0A215F`](./keys/CC68F5A3106FF448322E48ED27F5E38D5B0A215F.asc)
11+
* **Michaël Zasso** <<targos@protonmail.com>>
12+
[`8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600`](./keys/8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600.asc)
13+
* **Rafael Gonzaga** <<rafael.nunu@hotmail.com>>
14+
[`890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4`](./keys/890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4.asc)
15+
* **Richard Lau** <<rlau@redhat.com>>
16+
[`C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C`](./keys/C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C.asc)
17+
* **Ruy Adorno** <<ruyadorno@hotmail.com>>
18+
[`108F52B48DB57BB0CC439B2997B01419BD92F80A`](./keys/108F52B48DB57BB0CC439B2997B01419BD92F80A.asc)
19+
* **Ulises Gascón** <<ulisesgascongonzalez@gmail.com>>
20+
[`A363A499291CBBC940DD62E41F10027AF002F8B0`](./keys/A363A499291CBBC940DD62E41F10027AF002F8B0.asc)
3721

38-
Other keys used to sign some previous releases:
3922

40-
* **Danielle Adams** &lt;adamzdanielle@gmail.com&gt;
41-
[`1C050899334244A8AF75E53792EF661D867B9DFA`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/1C050899334244A8AF75E53792EF661D867B9DFA.asc)
42-
* **Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
43-
[`9554F04D7259F04124DE6B476D5A82AC7E37093B`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/9554F04D7259F04124DE6B476D5A82AC7E37093B.asc)
44-
* **Evan Lucas** &lt;evanlucas@me.com&gt;
45-
[`B9AE9905FFD7803F25714661B63B535A4C206CA9`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/B9AE9905FFD7803F25714661B63B535A4C206CA9.asc)
46-
* **Gibson Fahnestock** &lt;gibfahn@gmail.com&gt;
47-
[`77984A986EBC2AA786BC0F66B01FBB92821C587A`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/77984A986EBC2AA786BC0F66B01FBB92821C587A.asc)
48-
* **Isaac Z. Schlueter** &lt;i@izs.me&gt;
49-
[`93C7E9E91B49E432C2F75674B0A78B0A6C481CF6`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/93C7E9E91B49E432C2F75674B0A78B0A6C481CF6.asc)
50-
* **Italo A. Casas** &lt;me@italoacasas.com&gt;
51-
[`56730D5401028683275BD23C23EFEFE93C4CFFFE`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/56730D5401028683275BD23C23EFEFE93C4CFFFE.asc)
52-
* **Jeremiah Senkpiel** &lt;fishrock@keybase.io&gt;
53-
[`FD3A5288F042B6850C66B31F09FE44734EB7990E`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/FD3A5288F042B6850C66B31F09FE44734EB7990E.asc)
54-
* **Julien Gilli** &lt;jgilli@fastmail.fm&gt;
55-
[`114F43EE0176B71C7BC219DD50A3051F888C628D`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/114F43EE0176B71C7BC219DD50A3051F888C628D.asc)
56-
* **Timothy J Fontaine** &lt;tjfontaine@gmail.com&gt;
57-
[`7937DFD2AB06298B2293C3187D33FF9D0246406D`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/7937DFD2AB06298B2293C3187D33FF9D0246406D.asc)
58-
* **Juan José Arboleda** &lt;soyjuanarbol@gmail.com&gt;
59-
[`61FC681DFB92A079F1685E77973F295594EC4689`](https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/61FC681DFB92A079F1685E77973F295594EC4689.asc)
23+
Other keys used to sign some previous releases:
6024

25+
* **Beth Griggs** <<bethanyngriggs@gmail.com>>
26+
[`4ED778F539E3634C779C87C6D7062848A1AB005C`](./keys/4ED778F539E3634C779C87C6D7062848A1AB005C.asc)
27+
* **Bryan English** <<bryan@bryanenglish.com>>
28+
[`141F07595B7B3FFE74309A937405533BE57C7D57`](./keys/141F07595B7B3FFE74309A937405533BE57C7D57.asc)
29+
* **Chris Dickinson** <<christopher.s.dickinson@gmail.com>>
30+
[`9554F04D7259F04124DE6B476D5A82AC7E37093B`](./keys/9554F04D7259F04124DE6B476D5A82AC7E37093B.asc)
31+
* **Colin Ihrig** <<cjihrig@gmail.com>>
32+
[`94AE36675C464D64BAFA68DD7434390BDBE9B9C5`](./keys/94AE36675C464D64BAFA68DD7434390BDBE9B9C5.asc)
33+
* **Danielle Adams** <<adamzdanielle@gmail.com>>
34+
[`1C050899334244A8AF75E53792EF661D867B9DFA`](./keys/1C050899334244A8AF75E53792EF661D867B9DFA.asc)
35+
[`74F12602B6F1C4E913FAA37AD3A89613643B6201`](./keys/74F12602B6F1C4E913FAA37AD3A89613643B6201.asc)
36+
* **Evan Lucas** <<evanlucas@me.com>>
37+
[`B9AE9905FFD7803F25714661B63B535A4C206CA9`](./keys/B9AE9905FFD7803F25714661B63B535A4C206CA9.asc)
38+
* **Gibson Fahnestock** <<gibfahn@gmail.com>>
39+
[`77984A986EBC2AA786BC0F66B01FBB92821C587A`](./keys/77984A986EBC2AA786BC0F66B01FBB92821C587A.asc)
40+
* **Isaac Z. Schlueter** <<i@izs.me>>
41+
[`93C7E9E91B49E432C2F75674B0A78B0A6C481CF6`](./keys/93C7E9E91B49E432C2F75674B0A78B0A6C481CF6.asc)
42+
* **Italo A. Casas** <<me@italoacasas.com>>
43+
[`56730D5401028683275BD23C23EFEFE93C4CFFFE`](./keys/56730D5401028683275BD23C23EFEFE93C4CFFFE.asc)
44+
* **James M Snell** <<jasnell@keybase.io>>
45+
[`71DCFD284A79C3B38668286BC97EC7A07EDE3FC1`](./keys/71DCFD284A79C3B38668286BC97EC7A07EDE3FC1.asc)
46+
* **Jeremiah Senkpiel** <<fishrock@keybase.io>>
47+
[`FD3A5288F042B6850C66B31F09FE44734EB7990E`](./keys/FD3A5288F042B6850C66B31F09FE44734EB7990E.asc)
48+
* **Juan José Arboleda** <<soyjuanarbol@gmail.com>>
49+
[`61FC681DFB92A079F1685E77973F295594EC4689`](./keys/61FC681DFB92A079F1685E77973F295594EC4689.asc)
50+
* **Julien Gilli** <<jgilli@fastmail.fm>>
51+
[`114F43EE0176B71C7BC219DD50A3051F888C628D`](./keys/114F43EE0176B71C7BC219DD50A3051F888C628D.asc)
52+
* **Myles Borins** <<myles.borins@gmail.com>>
53+
[`C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8`](./keys/C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8.asc)
54+
* **Rod Vagg** <<rod@vagg.org>>
55+
[`DD8F2338BAE7501E3DD5AC78C273792F7D83545D`](./keys/DD8F2338BAE7501E3DD5AC78C273792F7D83545D.asc)
56+
* **Ruben Bridgewater** <<ruben@bridgewater.de>>
57+
[`A48C2BEE680E841632CD4E44F07496B3EB3C1762`](./keys/A48C2BEE680E841632CD4E44F07496B3EB3C1762.asc)
58+
* **Shelley Vohr** <<shelley.vohr@gmail.com>>
59+
[`B9E2F5981AA6E0CD28160D9FF13993A75599653C`](./keys/B9E2F5981AA6E0CD28160D9FF13993A75599653C.asc)
60+
* **Timothy J Fontaine** <<tjfontaine@gmail.com>>
61+
[`7937DFD2AB06298B2293C3187D33FF9D0246406D`](./keys/7937DFD2AB06298B2293C3187D33FF9D0246406D.asc)
6162

6263
## Verifying Release Packages
6364

64-
This repo contains the raw release signing keys in two forms:
65+
This repo contains the raw release signing keys in three forms:
66+
67+
- The **keys/** directory contains the raw ASCII-armored release signing keys listed above.
6568

66-
1. The **keys/** directory contains the raw ASCII-armored release signing keys listed above.
69+
- The **gpg/** directory contains a GPG keyring preloaded with these release signing keys.
6770

68-
2. The **gpg/** directory contains a GPG keyring preloaded with these release signing keys.
71+
- The **gpg-only-active-keys/** directory contains a GPG keyring preloaded with
72+
the active release signing keys. Use this if you only need to verify
73+
signatures of "future" releases.
6974

7075
For additional verification of both the keys' content *and* of the list of authorized signing
7176
keys, you may cross-reference the list with [nodejs.org](https://nodejs.org) and attempt to

‎cli.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ nodejs_keys_add() {
5555
gpg --export --armor "${KEY_ID}" > "${CLI_DIR}/keys/${KEY_ID}.asc"
5656

5757
GNUPGHOME="${CLI_DIR}/gpg" gpg --import "${CLI_DIR}/keys/${KEY_ID}.asc"
58+
GNUPGHOME="${CLI_DIR}/gpg-only-active-keys" gpg --import "${CLI_DIR}/keys/${KEY_ID}.asc"
5859

5960
printf "keys.list <- "
6061
if grep --quiet "${KEY_ID}" "${CLI_DIR}/keys.list"; then

‎generate-gpg-dir.sh‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/bin/sh
2+
3+
set -ex
4+
5+
GNUPGHOME=${1:-"$(cd "$(dirname "$0")"; pwd)/gpg"}
6+
ONLY_ACTIVE_KEYS=${2:-"$GNUPGHOME-only-active-keys"}
7+
8+
if [ -d "$GNUPGHOME" ]; then
9+
# If folder exists, move it to a temp dir
10+
# Removing it could be dangerous
11+
TRASH=$(mktemp -d)
12+
mv "$GNUPGHOME" "$TRASH"
13+
fi
14+
if [ -d "$ONLY_ACTIVE_KEYS" ]; then
15+
# If folder exists, move it to a temp dir
16+
# Removing it could be dangerous
17+
TRASH=$(mktemp -d)
18+
mv "$ONLY_ACTIVE_KEYS" "$TRASH"
19+
fi
20+
21+
mkdir -p "$GNUPGHOME"
22+
23+
# You can set this variable in your env to use a local version of the nodejs/node README instead of getting it from the internet.
24+
[ -n "$NODEJS_README_PATH" ] || {
25+
NODEJS_README_PATH=$(mktemp)
26+
curl -sSLo "$NODEJS_README_PATH" https://github.com/nodejs/node/raw/HEAD/README.md
27+
}
28+
29+
awk -F'`' '/^### Release keys$/,/^<summary>Other keys used to sign some previous releases<.summary>$/{if($1 == " ") print $2 }' "$NODEJS_README_PATH" | while read -r KEY_ID; do
30+
GNUPGHOME="$GNUPGHOME" gpg --import "keys/$KEY_ID.asc"
31+
done
32+
33+
cp -R "$GNUPGHOME" "$ONLY_ACTIVE_KEYS"
34+
35+
awk -F'`' '/^<summary>Other keys used to sign some previous releases<.summary>$/,/^<.details>$/{if($1 == " ") print $2 }' "$NODEJS_README_PATH" | while read -r OLD_KEY; do
36+
GNUPGHOME="$GNUPGHOME" gpg --import "keys/$OLD_KEY.asc"
37+
done

‎gpg-only-active-keys/pubring.kbx‎

20.5 KB
Binary file not shown.

‎gpg-only-active-keys/trustdb.gpg‎

1.17 KB
Binary file not shown.

0 commit comments

Comments
 (0)