Keel-Linux/handbook
1
0
Fork 0
Code Issues 4 Pull requests 8 Projects Releases Packages Wiki Activity Actions

docs: evidence of the image artifacts signed by main and images (0055) #81

Merged
navigator merged 2 commits from docs/evidence-images-key-dual-sign into main 2026-10-15 15:04:30 -03:00
Conversation 0 Commits 2 Files changed 1 +373
navigator commented 2026-10-15 14:40:17 -03:00
Owner
Copy link

Evidence of step 4 of decision 0055 (images key): docs/evidence/2026-10-15-images-key-dual-sign.md.

  • keel-release signs the template .sha512 files, aplinfo.dat and MANIFEST with main and images, 1 .asc each (Keel-Linux/apt#30, merged).
  • Release 2026-10-11, the source of the live index, is signed again with --sign-only and published. The index and the APT archive did not change.
  • BR3-THIN (PVE 9.2.2, sqv 1.3.0): sqv, keel-pve 0.1.0 and 0.1.2 accept the published files with the main keyring alone and with the images keyring alone, and refuse a tampered index. pveam has fixed sources and the pve-manager keyring, so the admin path is keel-pve with /usr/share/keyrings/keel-images-keyring.gpg.
  • In a CT: keel verify --release-manifest and keel pull plus keel verify of a dual-signed .hash (Keel-Linux/keel#176, Keel-Linux/buildtasks#24) accept each key alone, and refuse a changed file.
  • The file lists what must be true before main is removed. Main stays.
Evidence of step 4 of decision 0055 (images key): `docs/evidence/2026-10-15-images-key-dual-sign.md`. - keel-release signs the template `.sha512` files, `aplinfo.dat` and `MANIFEST` with main and images, 1 `.asc` each (Keel-Linux/apt#30, merged). - Release 2026-10-11, the source of the live index, is signed again with `--sign-only` and published. The index and the APT archive did not change. - BR3-THIN (PVE 9.2.2, sqv 1.3.0): sqv, keel-pve 0.1.0 and 0.1.2 accept the published files with the main keyring alone and with the images keyring alone, and refuse a tampered index. `pveam` has fixed sources and the pve-manager keyring, so the admin path is keel-pve with `/usr/share/keyrings/keel-images-keyring.gpg`. - In a CT: `keel verify --release-manifest` and `keel pull` plus `keel verify` of a dual-signed `.hash` (Keel-Linux/keel#176, Keel-Linux/buildtasks#24) accept each key alone, and refuse a changed file. - The file lists what must be true before main is removed. Main stays.
docs: evidence of the image artifacts signed by main and images (0055)
All checks were successful
security / security (pull_request) Successful in 1m18s
Details
c9da209e8c 
Step 4 of decision 0055. keel-release signs the template .sha512 files,
aplinfo.dat and MANIFEST with main and images (apt#30). Release
2026-10-11 is signed again and published. On BR3-THIN, sqv, keel-pve and
keel verify (keel#176) accept the files with each key alone, and refuse
a tampered file. The file also gives what must be true before main is
removed.
docs: buildtasks#24 is merged
All checks were successful
security / security (pull_request) Successful in 1m31s
Details
fb3486012a
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accessibility

Barrier affecting people with disabilities

  
bug

Something isn't working

  
documentation

Improvements or additions to documentation

  
duplicate

This issue or pull request already exists

  
enhancement

New feature or request

  
good first issue

Good for newcomers

  
help wanted

Extra attention is needed

  
invalid

This doesn't seem right

  
question

Further information is requested

  
wontfix

This will not be worked on

No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Keel-Linux/handbook!81
No description provided.