Decision 0011: two signing keys, and what each is allowed to say #11

Open

marcos-mendez wants to merge 3 commits from docs/0011-placeholder into main

marcos-mendez commented

2026-09-28 02:21:37 -03:00

(Migrated from github.com)

Adds decision note 0011, "Two signing keys, and what each is allowed to say".

This pull request first proposed a placeholder saying 0011 was never written, on the reasoning that nothing referenced it. That was wrong: Keel-Linux/apt cites decision 0011 in five places (conf/distributions, lib/common.sh, lib/publish.sh twice, README.md) for the two key separation it implemented on 2026-09-27 (apt becf0e8). The second commit replaces the placeholder with the note those citations point to.

What it records, all measured: trixie is signed with the release key (offline primary AD0964BE, passphrase protected signing subkey on the build host); trixie-staging with a separate key, 33516A96, unprotected on the build host so a nightly needs nobody at a keyboard. The release key means a person stood behind the bits; the staging key means only that the build host produced them.

Decision 0016 (handbook#10) builds on this note, so this should be merged before it.

For the maintainer: key custody is reserved to you (brief, section 11). The staging key answers your instruction that a nightly must not wait for a passphrase; please confirm the rule the note draws (the unattended key may sign only what the build host could claim anyway, never what an installed appliance reads), or say what should change.

Adds decision note 0011, "Two signing keys, and what each is allowed to say". This pull request first proposed a placeholder saying 0011 was never written, on the reasoning that nothing referenced it. That was wrong: `Keel-Linux/apt` cites decision 0011 in five places (`conf/distributions`, `lib/common.sh`, `lib/publish.sh` twice, `README.md`) for the two key separation it implemented on 2026-09-27 (apt becf0e8). The second commit replaces the placeholder with the note those citations point to. What it records, all measured: `trixie` is signed with the release key (offline primary AD0964BE, passphrase protected signing subkey on the build host); `trixie-staging` with a separate key, 33516A96, unprotected on the build host so a nightly needs nobody at a keyboard. The release key means a person stood behind the bits; the staging key means only that the build host produced them. Decision 0016 (handbook#10) builds on this note, so this should be merged before it. For the maintainer: key custody is reserved to you (brief, section 11). The staging key answers your instruction that a nightly must not wait for a passphrase; please confirm the rule the note draws (the unattended key may sign only what the build host could claim anyway, never what an installed appliance reads), or say what should change.

marcos-mendez commented

2026-09-29 00:15:52 -03:00

(Migrated from github.com)

Title and description now match the content (the note, not the placeholder); 1e12ac9 corrects the citation count to five and states that custody is the maintainer's to ratify, which is the one open question here. Merge before #10, which cites 0011.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin docs/0011-placeholder:docs/0011-placeholder

git switch docs/0011-placeholder

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff docs/0011-placeholder

git switch docs/0011-placeholder

git rebase main

git switch main

git merge --ff-only docs/0011-placeholder

git switch docs/0011-placeholder

git rebase main

git switch main

git merge --no-ff docs/0011-placeholder

git switch main

git merge --squash docs/0011-placeholder