Add openpgp-tools: lifecycle for the release signing key - #249
Open
quarckster wants to merge 4 commits into
Open
Add openpgp-tools: lifecycle for the release signing key#249quarckster wants to merge 4 commits into
quarckster wants to merge 4 commits into
Conversation
Drives sq-pkcs11 and the HSM tooling to generate the release signing keys, issue and rotate the published certificate, and produce revocation certificates. Never touches private key material. Assisted-by: Claude:claude-opus-5
Runs an attended ceremony in a shared tmux session, so custodians type OCS passphrases into a terminal rather than through CI parameters. The automation server orchestrates and collects the log and exit status only. Assisted-by: Claude:claude-opus-5
Validates and bundles the certificates authorised to decrypt the offline primary-key revocation certificate, so a bundle cannot be produced with a recipient key that has expired or been withdrawn. Assisted-by: Claude:claude-opus-5
Describes what each script is for, the policy openssl-pgp enforces, and the external tooling they depend on. Assisted-by: Claude:claude-opus-5
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OpenPGP key that signs release artifacts lives in a hardware security module. These are the scripts that manage its lifecycle — generating the keys, issuing and rotating the published certificate, and producing revocation certificates. They drive sq-pkcs11 and the HSM utilities and never touch private key material.
openssl-pgp— the driver:primary-generate,subkey-generate,cert-init,subkey-rotate,cert-revoke,subkey-revoke. Enforces the artifact signing policy: RSA-4096, a Certify-only primary under an operator-card quorum, and a module-protected signing subkey.openssl-pgp-ceremony-run— runs an attended ceremony in a sharedtmuxsession, so custodians type passphrases into a terminal rather than through CI parameters. The automation server orchestrates and collects the log and exit status only.openssl-pgp-revocation-recipients— validates and bundles the certificates authorised to decrypt the offline primary-key revocation certificate, so a bundle cannot be built with a key that has expired or been withdrawn.Additions only. Split out of #240, which this and the release-tools Python rewrite together supersede.