This is Gentoo's testing wiki. It is a non-operational environment and its textual content is outdated.
Please visit our production wiki at https://wiki.gentoo.org
Project:Gentoo-keys
| Gentoo Keys | |
|---|---|
| Description | Gentoo Keys is a Python based project that aims to manage the OpenPGP keys used for validation on users and Gentoo's infrastructure servers. |
| Project email | gkeys@gentoo.org |
| IRC channel | #gentoo-keys |
| Lead(s) |
No lead election date set |
| Member(s) |
|
| Subproject(s) (and inherited member(s)) |
(none) |
| Parent Project | Gentoo |
| Project listing | |
Gentoo-keys a project to manage, update, and validate Gentoo developer and release keys used for Gentoo projects and release media.
Gentoo-keys is a Python based project that will wrap the pyGPG python interface libs to gnupg's gpg command. Its main focus is to manage the installation of the required gpg keys used for Gentoo's release media. Such media includes installation CDs, LiveDVDs, and other gpg-signed documents such as layman's repositories.xml list. It will likely also be used on Gentoo's infra servers for tasks related to the Gentoo ebuild tree migration to git. It will be used as part of the gpg-signed git commits validation. As such will have functions dedicated to authenticating commits made by developers.
Contributing members
| Member | Nick | Role |
|---|---|---|
| Douglas Freed | dwfreed | Draftee |
| Merlijn Wajer | Wizzup | Member |
| Angelos Perivolaropoulos | aeroiero | GSOC-2016 student |
Other members, contributors, beta testers are welcome.
Please Contact the team lead.
Recruitment
We are currently looking for users interested in helping the project with these jobs:
| Title | Description | Requirements | Contact |
|---|---|---|---|
| Members, Developers | Gentoo-keys is a management application to handle all aspects of gpg key handling and verification within the gentoo environment. | Good python skills and or gpg key creation, verification knowledge | gkeys@gentoo.org |
Subproject packages
| Name | Package | Description | Homepage |
|---|---|---|---|
| SSL-Fetch | dev-python/ssl-fetch | Breakout python lib to securely fetch files. | Homepage |
| pyGPG | dev-python/pyGPG | Python interface lib to wrap GPG in subprocess calls.
It also mines all data available from colon-listings and stderr messaging. |
Homepage |
Use the source, Luke
While most Linux distributions distribute a complete binary keyring for their authenticating. It is generally not the Gentoo way. Binary files do not play well with utilities like etc-update and dispatch-config. Also one system/user might need only a few keys, another might need a full set of developer keys + the release media keys. So to that end, gentoo-keys, aims to distribute it's utility app gkeys which will be used to import the desired gpg keys into the appropriate keyrings from information contained in "seed" files. The seed files will contain information like name, keyid, longkey-id, fingerprint. From that information, it will run gpg to import the key from a keyserver and validate that the key matches the expected fingerprint from the seed. It will have options to add, delete, update keys. It will have library classes, functions to be used in other python based apps like layman to validate a gpg signed repositories.xml list. Another is the git commit hooks that will be used to validate developer commits to a new git based ebuild tree.
TODO
- Extend pyGPG's data mining functions to parse stdout output for gpg --list-key, --list-keys since gpg does not output any info to it's --status-fd which is normally used for data gathering by pyGPG. This is needed as part of the key import and validation functions of gkeys.
- Add the appropriate function to mine stdout data for list-key, list-keys functions (pyGPG)
- Add key import capability to gkeys
- Add to gkeys the functions, cli options for initial import and creation of the seeds after verifying the import is correct. In progress
- Add binary keyring import and update support.
- Complete coding the task specific functions for installing, deleting, updating keys
- Code task specific functions for validating different types of media
- Release media: installation CDs, LiveDVDs, ...
- git commit validation hook functions, in-progress see gkeys-gpg app for configuring git to use gkeys-gpg for it's gpg command. The gkeys-gpg command uses the gkeys keyrings for the validation.
- Add gpg key creation and update functionality, following the Gentoo recommended settings. in-progress
- Make the recommended settings configurable/override-able.
- Add creation function - in progress, can only create the primary and one subkey, a Gentoo specific key must be added interactively in gnupg as well as secondary UIDs email addresses.
- Add update function - looks like this function is only available interactively in gnupg
Instructions and project subpages
Generating GLEP 63 based OpenPGP keys
Spec-check failure report explanations and help
FAQ on editing an existing OpenPGP key to be GLEP 63 compatible
External resources
Gentoo keys project:
pyGPG: