feat: keel verify trusts a signature by main or images (decision 0055) #176

Merged

navigator merged 1 commit from feat/images-key-verifiers into main 2026-10-15 15:46:37 -03:00

Conversation 0 Commits 1 Files changed 16 +891 -43

navigator commented 2026-10-15 13:54:27 -03:00

Owner

Copy link

Step 4 of handbook decision 0055 (images key). Every verifier must trust the images key before an image artifact is signed with it alone. Until then main and images both sign, in 1 file. This makes keel verify such a verifier. It replaces the "no code change" conclusion of #151.

What changes

• keel verify checks a signed layer .hash file against /usr/share/keyrings/keel-archive-keyring.gpg (main) and keel-images-keyring.gpg (images), from keel-archive-keyring 0.3.0. A signature by either key is good. The files stay separate. A missing file is skipped.
• gpgv exits 2 for a file with 2 signatures when one key is in no keyring. signature.verify_by_any reads the status lines one signature at a time: one BADSIG refuses, and one GOODSIG with VALIDSIG by a key that is not revoked or expired is good. The channel pointer path (signature.verify) does not change.
• A good .hash file gives ok: hash file signed by <fingerprint>, and its digests come from the signed text. A BADSIG is a mismatch. A key in no keyring stays unverified (exit 8, which keel-release step 2 accepts).
• keel verify --release-manifest FILE verifies FILE against FILE.asc, then the size and sha256 of each listed file that is present. A path that leaves the release directory is refused.
• --keyring FILE (can repeat) and $KEEL_IMAGE_KEYRINGS replace the 2 defaults.
• docs/layers.md, README, changelog 0.23.28.

Version

0.23.28, because #175 holds 0.23.27. I merge this after #175, so the changelog gate of #175 does not change. This PR does not publish a release.

Tests

tests/test_layers_rolesig.py, real keys and real gpgv: a dual-signed detached and clear-signed file verifies with each keyring alone; a changed file is BADSIG with either keyring; an unknown or revoked key is refused; a missing keyring is skipped and named; the MANIFEST checks (ok, mismatch, not present, bad path, no .asc); the CLI paths. release_manifest.py, verify.py and the new signature.py code are at 100 percent line coverage.

Step 4 of handbook decision 0055 (images key). Every verifier must trust the images key before an image artifact is signed with it alone. Until then main and images both sign, in 1 file. This makes `keel verify` such a verifier. It replaces the "no code change" conclusion of #151. ## What changes - `keel verify` checks a signed layer `.hash` file against `/usr/share/keyrings/keel-archive-keyring.gpg` (main) and `keel-images-keyring.gpg` (images), from keel-archive-keyring 0.3.0. A signature by either key is good. The files stay separate. A missing file is skipped. - gpgv exits 2 for a file with 2 signatures when one key is in no keyring. `signature.verify_by_any` reads the status lines one signature at a time: one BADSIG refuses, and one GOODSIG with VALIDSIG by a key that is not revoked or expired is good. The channel pointer path (`signature.verify`) does not change. - A good `.hash` file gives `ok: hash file signed by <fingerprint>`, and its digests come from the signed text. A BADSIG is a mismatch. A key in no keyring stays `unverified` (exit 8, which keel-release step 2 accepts). - `keel verify --release-manifest FILE` verifies FILE against FILE.asc, then the size and sha256 of each listed file that is present. A path that leaves the release directory is refused. - `--keyring FILE` (can repeat) and `$KEEL_IMAGE_KEYRINGS` replace the 2 defaults. - `docs/layers.md`, README, changelog 0.23.28. ## Version 0.23.28, because #175 holds 0.23.27. I merge this after #175, so the changelog gate of #175 does not change. This PR does not publish a release. ## Tests `tests/test_layers_rolesig.py`, real keys and real gpgv: a dual-signed detached and clear-signed file verifies with each keyring alone; a changed file is BADSIG with either keyring; an unknown or revoked key is refused; a missing keyring is skipped and named; the MANIFEST checks (ok, mismatch, not present, bad path, no .asc); the CLI paths. release_manifest.py, verify.py and the new signature.py code are at 100 percent line coverage.

navigator added 1 commit 2026-10-15 13:54:27 -03:00

feat: keel verify trusts a signature by main or images (decision 0055) ... 1850960a20

Step 4 of decision 0055. Every verifier must trust the images key before
an image artifact is signed with it alone, and until then main and
images both sign, in 1 file.

- keel verify checks a signed layer .hash file against
  /usr/share/keyrings/keel-archive-keyring.gpg and
  keel-images-keyring.gpg, from keel-archive-keyring 0.3.0. A signature
  by either key is good. A missing file is skipped.
- gpgv exits 2 for a file with 2 signatures when one key is in no
  keyring. signature.verify_by_any reads the status lines one signature
  at a time: one BADSIG refuses, and one GOODSIG with VALIDSIG by a key
  that is not retired is good.
- A good .hash file is "ok: hash file signed by <fingerprint>", and its
  digests come from the signed text. A BADSIG is a mismatch.
- keel verify --release-manifest FILE verifies FILE against FILE.asc,
  then the size and sha256 of each listed file that is present.
- --keyring, which can repeat, and $KEEL_IMAGE_KEYRINGS replace the 2
  default keyrings.

keel pull copies a .hash file into the cache, and keel verify on the
cache checks it. The channel pointer still uses the channel keyring.

navigator referenced this pull request 2026-10-15 13:58:55 -03:00

docs: which key signs each layer artifact, after decision 0055 #151

navigator referenced this pull request from Keel-Linux/handbook 2026-10-15 14:40:17 -03:00

docs: evidence of the image artifacts signed by main and images (0055) #81

navigator force-pushed feat/images-key-verifiers from 1850960a20 to 48212cb6e8 2026-10-15 14:40:19 -03:00 Compare

navigator force-pushed feat/images-key-verifiers from 48212cb6e8 to efead4e607 2026-10-15 15:05:08 -03:00 Compare

navigator merged commit 1093a01e56 into main 2026-10-15 15:46:37 -03:00

navigator referenced this pull request from a commit 2026-10-15 15:46:37 -03:00

Merge pull request 'feat: keel verify trusts a signature by main or images (decision 0055)' (#176) from feat/images-key-verifiers into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

accessibility

Barrier affecting people with disabilities

  

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

wontfix

This will not be worked on

No labels

accessibility

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Keel-Linux/keel!176

No description provided.