feat: the index signature is also trusted from the images keyring #4

Merged

marcos-mendez merged 1 commit from feat/index-trusts-images-key into main

2026-10-14 16:17:19 -03:00

marcos-mendez commented

2026-10-14 15:01:46 -03:00

(Migrated from github.com)

Step 4 of handbook decision 0055, the Proxmox verifier. Do not merge. This is for review.

What changes

verify_signature gives sqv 2 keyrings: KEEL_PVE_KEYRING (main, as before) and KEEL_PVE_IMAGES_KEYRING, default /usr/share/keyrings/keel-images-keyring.gpg. The second keyring is given only when the file is there. The files are never merged.
KEEL_PVE_KEYRING keeps its value. lib/source.sh also uses it as the Signed-By of the apt source of keel-pve, so it must stay the main keyring.
The dependency stays keel-archive-keyring (>= 0.1.1). Before 0.3.0 there is no images keyring, and keel-pve verifies with main alone, as before.
Version 0.1.2. The man page, the help text and the README name the second keyring.

Tests (throwaway keys, sqv 1.3.0)

The images key alone with the images keyring: accepted.
The images key alone without the images keyring: refused.
1 .asc with signatures by main and images, and the main keyring alone: accepted. This is the property that lets the publisher add the images signature before every host has keyring 0.3.0.
The same .asc with both keyrings: accepted.
A foreign key, with the images keyring present: refused.
Coverage stays at 100 percent.

Open point

The test proves sqv 1.3.0 on trixie. A Proxmox VE 9 host has its own sqv. Before the publisher signs with the images key alone, measure the dual-signed index on a real Proxmox host.

Step 4 of handbook decision 0055, the Proxmox verifier. **Do not merge. This is for review.** ## What changes - `verify_signature` gives sqv 2 keyrings: `KEEL_PVE_KEYRING` (main, as before) and `KEEL_PVE_IMAGES_KEYRING`, default `/usr/share/keyrings/keel-images-keyring.gpg`. The second keyring is given only when the file is there. The files are never merged. - `KEEL_PVE_KEYRING` keeps its value. `lib/source.sh` also uses it as the `Signed-By` of the apt source of keel-pve, so it must stay the main keyring. - The dependency stays `keel-archive-keyring (>= 0.1.1)`. Before 0.3.0 there is no images keyring, and keel-pve verifies with main alone, as before. - Version 0.1.2. The man page, the help text and the README name the second keyring. ## Tests (throwaway keys, sqv 1.3.0) - The images key alone with the images keyring: accepted. - The images key alone without the images keyring: refused. - 1 `.asc` with signatures by main and images, and the main keyring alone: **accepted**. This is the property that lets the publisher add the images signature before every host has keyring 0.3.0. - The same `.asc` with both keyrings: accepted. - A foreign key, with the images keyring present: refused. - Coverage stays at 100 percent. ## Open point The test proves sqv 1.3.0 on trixie. A Proxmox VE 9 host has its own sqv. Before the publisher signs with the images key alone, measure the dual-signed index on a real Proxmox host.