feat: BT_GPGKEY_ALSO adds a second signature (decision 0055) #24

Merged

navigator merged 1 commit from feat/images-key-dual-sign into 19.x

2026-10-15 14:48:59 -03:00

navigator commented

2026-10-15 13:57:10 -03:00

Owner

Step 4 of Keel Linux handbook decision 0055 (images key). Every verifier must trust the images key before an image artifact is signed with it alone. Until then main and images both sign, in 1 file.

What changes

bt-aplinfo and aplinfo_sign: each key in BT_GPGKEY_ALSO (split by spaces) adds its signature to aplinfo.dat.asc.
generate-signature, and so bt-layer: each key in BT_GPGKEY_ALSO adds its signature to the .hash file. The signed text names each extra key by fingerprint and user id. After signing, each key must have a VALIDSIG (sig_validsig_primaries), or the hash file is removed.
Without BT_GPGKEY_ALSO, the output does not change. The TurnKey reference text stays byte for byte (test 12).

keel-release (Keel-Linux/apt) gives bt-aplinfo no key and clears BT_GPGKEY, and signs the published files itself (Keel-Linux/apt#30). This change covers a build that signs with buildtasks directly.

Tests

tests/aplinfo: 2 keys give 1 .asc with 2 signature packets; gpgv and sqv with each public key alone accept it; a bad second key fails; bt-aplinfo with BT_GPGKEY_ALSO. tests/signature: the hash file names the second key; 2 VALIDSIG lines; each key alone verifies; an unknown or public-only extra key leaves no hash file.

Step 4 of Keel Linux handbook decision 0055 (images key). Every verifier must trust the images key before an image artifact is signed with it alone. Until then main and images both sign, in 1 file. ## What changes - `bt-aplinfo` and `aplinfo_sign`: each key in `BT_GPGKEY_ALSO` (split by spaces) adds its signature to `aplinfo.dat.asc`. - `generate-signature`, and so `bt-layer`: each key in `BT_GPGKEY_ALSO` adds its signature to the `.hash` file. The signed text names each extra key by fingerprint and user id. After signing, each key must have a VALIDSIG (`sig_validsig_primaries`), or the hash file is removed. - Without `BT_GPGKEY_ALSO`, the output does not change. The TurnKey reference text stays byte for byte (test 12). `keel-release` (Keel-Linux/apt) gives `bt-aplinfo` no key and clears `BT_GPGKEY`, and signs the published files itself (Keel-Linux/apt#30). This change covers a build that signs with buildtasks directly. ## Tests `tests/aplinfo`: 2 keys give 1 `.asc` with 2 signature packets; gpgv and sqv with each public key alone accept it; a bad second key fails; `bt-aplinfo` with `BT_GPGKEY_ALSO`. `tests/signature`: the hash file names the second key; 2 VALIDSIG lines; each key alone verifies; an unknown or public-only extra key leaves no hash file.

navigator added 1 commit

2026-10-15 13:57:10 -03:00

feat: BT_GPGKEY_ALSO adds a second signature (decision 0055)

security / security (pull_request) Successful in 1m48s

Details

tests / tests (pull_request) Failing after 2m58s

Details

a171806ec4

Step 4 of Keel Linux decision 0055. Every verifier must trust the images
key before an image artifact is signed with it alone. Until then main
and images both sign, in 1 file.

- bt-aplinfo and aplinfo_sign: each key in BT_GPGKEY_ALSO adds its
  signature to aplinfo.dat.asc. sqv with any one of the keys accepts it.
- generate-signature, and so bt-layer: each key in BT_GPGKEY_ALSO adds
  its signature to the .hash file. The signed text names each extra key
  by fingerprint and user id. After the signature, each key must have a
  VALIDSIG, or the hash file is removed.
- Without BT_GPGKEY_ALSO, the output does not change. The TurnKey
  reference text stays byte for byte.

keel-release in Keel-Linux/apt gives bt-aplinfo no key and clears
BT_GPGKEY. It signs the published files itself. This change is for a
build that signs with buildtasks directly.

navigator force-pushed feat/images-key-dual-sign from a171806ec4

security / security (pull_request) Successful in 1m48s

Details

tests / tests (pull_request) Failing after 2m58s

Details

to c8b2aa681f

security / security (pull_request) Successful in 1m19s

Details

tests / tests (pull_request) Successful in 3m22s

Details

2026-10-15 14:36:15 -03:00

Compare