feat: the public keys of the 4 signing roles and keel-archive-keyring

marcos-mendez commented

2026-10-14 14:41:32 -03:00

(Migrated from github.com)

This pull request implements step 3 of handbook decision 0055 for all 4 roles.

What changes

keys/keel-trixie-{main,images,security,testing}.asc: the public keys. keys/keel-trixie-main.asc is the same file as keys/keel-archive-keyring.asc in Keel-Linux/apt, keel-transition and common.
FINGERPRINTS: the primary key fingerprint of each role.
bin/check-keys: each key file must hold exactly 1 primary key, no secret key material, a valid signing subkey, and the fingerprint in FINGERPRINTS.
debian/: the keel-archive-keyring package moves here from keel-transition. Source keel-keys, version 0.3.0. The highest published version is 0.2.0.
The package installs 1 keyring file for each role. The keys are not merged.
- /usr/share/keyrings/keel-archive-keyring.gpg (main). Its bytes are the same as in 0.2.0.
- /usr/share/keyrings/keel-{images,security,testing}-keyring.gpg.
- /usr/share/keyrings/keel-archive-keyring.asc (main, armored, as in 0.2.0).
- /usr/share/keel-archive-keyring/fingerprint: the main fingerprint only, as in 0.2.0. keel-transition reads this file.
- /usr/share/keel-archive-keyring/FINGERPRINTS: 1 line for each role.
The build checks each fingerprint 3 ways: the key file, FINGERPRINTS and debian/rules.
CI: tests / coverage (bats under kcov, 95 percent, throwaway keys), package / changelog, build / trixie (dpkg-buildpackage, lintian, a check of the keyring files) and security.

What does not change

No secret key material is in this repository. No CI job has a signing key.
This pull request publishes nothing. The package goes to the archive only through the normal publish on the build host.

Order

Keel-Linux/keel-transition stops to build keel-archive-keyring in a separate pull request. Until 0.3.0 is published, the archive keeps 0.2.0.

This pull request implements step 3 of handbook decision 0055 for all 4 roles. ## What changes - `keys/keel-trixie-{main,images,security,testing}.asc`: the public keys. `keys/keel-trixie-main.asc` is the same file as `keys/keel-archive-keyring.asc` in Keel-Linux/apt, keel-transition and common. - `FINGERPRINTS`: the primary key fingerprint of each role. - `bin/check-keys`: each key file must hold exactly 1 primary key, no secret key material, a valid signing subkey, and the fingerprint in `FINGERPRINTS`. - `debian/`: the `keel-archive-keyring` package moves here from keel-transition. Source `keel-keys`, version 0.3.0. The highest published version is 0.2.0. - The package installs 1 keyring file for each role. The keys are not merged. - `/usr/share/keyrings/keel-archive-keyring.gpg` (main). Its bytes are the same as in 0.2.0. - `/usr/share/keyrings/keel-{images,security,testing}-keyring.gpg`. - `/usr/share/keyrings/keel-archive-keyring.asc` (main, armored, as in 0.2.0). - `/usr/share/keel-archive-keyring/fingerprint`: the main fingerprint only, as in 0.2.0. keel-transition reads this file. - `/usr/share/keel-archive-keyring/FINGERPRINTS`: 1 line for each role. - The build checks each fingerprint 3 ways: the key file, `FINGERPRINTS` and `debian/rules`. - CI: `tests / coverage` (bats under kcov, 95 percent, throwaway keys), `package / changelog`, `build / trixie` (dpkg-buildpackage, lintian, a check of the keyring files) and `security`. ## What does not change - No secret key material is in this repository. No CI job has a signing key. - This pull request publishes nothing. The package goes to the archive only through the normal publish on the build host. ## Order Keel-Linux/keel-transition stops to build `keel-archive-keyring` in a separate pull request. Until 0.3.0 is published, the archive keeps 0.2.0.

github-advanced-security[bot] commented

2026-10-14 14:42:16 -03:00

(Migrated from github.com)

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. ### What Enabling Code Scanning Means: - The 'Security' tab will display more code scanning analysis results (e.g., for the default branch). - Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. - You will be able to see the analysis results for the pull request's branch on this [overview](/Keel-Linux/keel-keys/security/code-scanning?query=pr%3A1+is%3Aopen) once the scans have completed and the checks have passed. For more information about GitHub Code Scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning).

github-advanced-security[bot] commented

2026-10-14 14:42:17 -03:00

(Migrated from github.com)

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. ### What Enabling Code Scanning Means: - The 'Security' tab will display more code scanning analysis results (e.g., for the default branch). - Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. - You will be able to see the analysis results for the pull request's branch on this [overview](/Keel-Linux/keel-keys/security/code-scanning?query=pr%3A1+is%3Aopen) once the scans have completed and the checks have passed. For more information about GitHub Code Scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning).

Rows
Columns

feat: the public keys of the 4 signing roles and keel-archive-keyring #1

What changes

What does not change

Order

What Enabling Code Scanning Means:

What Enabling Code Scanning Means: