diff --git a/.gitlab/issue_templates/New Main Key.md b/.gitlab/issue_templates/New Main Key.md index 650a968..40fc0f2 100644 --- a/.gitlab/issue_templates/New Main Key.md +++ b/.gitlab/issue_templates/New Main Key.md @@ -2,8 +2,12 @@ This template is used when a new main PGP public key needs to be added to the distribution's keyring. It is used by users with a valid packager key. + +NOTE: All comment sections with a MODIFY note need to be edited. All checkboxes +in the "Checks" section labeled as "Owner of new key" need to be checked by the +owner of the new key. --> -/assign @allan @anthraxx @bluewind @dvzrv @pierre +/assign @anthraxx @bluewind @dvzrv @grazzolini @pierre /label ~"new main key" /title New main key of -- PGP key ID: +- PGP key ID: - Revocation Certificate Holder: ## Checks -### New key owner +**NOTE**: The below check boxes **must be** checked before the accompanying +merge request to add the new main key can be merged. + +### Owner of new key - [ ] The [workflow for adding a new main key](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/add-a-new-main-key) @@ -38,18 +51,17 @@ https://www.gnupg.org/gph/en/manual/x135.html a clearsigned document - [ ] The revocation certificate has been sent in an encrypted message to the revocation certificate holder -- [ ] The public key has been uploaded to the SKS infrastructure - -### Keyring maintainer - -- [ ] The key pair has been validated according to the [best - practices](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/best-practices#validating-a-key-pair) -- [ ] The data in the [Details](#details) section is correct and signed with a - valid and trusted packager key, which is part of `pacman-key` +- [ ] The public key has been uploaded to the pgp.mit.edu and keyserver.ubuntu.com +- [ ] A merge request to add the new public key has been created ### Revocation Certificate Holder - [ ] The revocation certificate has been [verified as working](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/verify-a-revocation-certificate) and confirmed in a comment to this issue -- [ ] The revocation certificate has been backed up in a dedicated encrypted backup storage +- [ ] The revocation certificate has been backed up on a dedicated encrypted backup storage medium + +### Main key holders + +- [ ] The data in the [Details](#details) section is correct and signed with a + valid and trusted packager key, which is already part of `archlinux-keyring` diff --git a/.gitlab/issue_templates/New Packager Key.md b/.gitlab/issue_templates/New Packager Key.md index 20a7900..f303c5a 100644 --- a/.gitlab/issue_templates/New Packager Key.md +++ b/.gitlab/issue_templates/New Packager Key.md @@ -3,8 +3,12 @@ This template is used when a new packager PGP public key needs to be added to the distribution's keyring. It is either used by the sponsor of a new packager or by an existing packager when adding a new key for themself. + +NOTE: All comment sections with a MODIFY note need to be edited. All checkboxes +in the "Checks" section labeled as "Owner of new key" need to be checked by the +owner of the new key or by a sponsor of a new packager. --> -/assign @allan @anthraxx @bluewind @dvzrv @pierre +/assign @anthraxx @bluewind @dvzrv @grazzolini @pierre /label ~"new packager key" /title New packager key of -- PGP key ID: +- PGP key ID: - Sponsors: - Application: - Results: +- Previous Key: ## Checks -### New key owner +### Owner of new key - [ ] The [workflow for adding a new packager key](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/add-a-new-packager-key) @@ -45,24 +58,18 @@ needs to do the signature. practices](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/best-practices#validating-a-key-pair) - [ ] The data in the [Details](#details) section is attached to this issue as a clearsigned document -- [ ] The public key has been uploaded to the SKS infrastructure +- [ ] The public key has been uploaded to the pgp.mit.edu and keyserver.ubuntu.com +- [ ] A merge request to add the new public key has been created ### Main key holders -- [ ] The public key has been validated according to the [best - practices](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/best-practices#validating-a-key-pair) - [ ] The public key has been signed by all main key holders - - [ ] @allan - [ ] @anthraxx - [ ] @bluewind - [ ] @dvzrv + - [ ] @grazzolini - [ ] @pierre -### Keyring maintainer - -- [ ] The public key contains one user ID with a valid - `@archlinux.org` email address used for signing -- [ ] The public key has been validated according to the [best - practices](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/best-practices#validating-a-key-pair) +### Developers of the archlinux-keyring project - [ ] The data in the [Details](#details) section is correct and signed with a - valid and trusted packager key, which is part of `pacman-key` + valid and trusted packager key, which is already part of `archlinux-keyring` diff --git a/.gitlab/issue_templates/Remove Main Key.md b/.gitlab/issue_templates/Remove Main Key.md index 1435e30..b1fae1d 100644 --- a/.gitlab/issue_templates/Remove Main Key.md +++ b/.gitlab/issue_templates/Remove Main Key.md @@ -1,9 +1,14 @@ -/assign @allan @anthraxx @bluewind @dvzrv @pierre +/assign @anthraxx @bluewind @dvzrv @grazzolini @pierre /label ~"remove main key" /title Remove main key of -- PGP key ID: +- PGP key ID: - Resignation: ## Checks @@ -27,8 +32,6 @@ issue and assign relevant users. removal of this key. - [ ] All packagers have at least three valid main key signatures for their packager key after removal of this key. - -### Keyring maintainer - -- [ ] The key has been revoked by either the revocation certificate holder or - the main key holder. +- [ ] A merge request to [remove the main public + key](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/remove-a-main-key) + has been created diff --git a/.gitlab/issue_templates/Remove Packager Key.md b/.gitlab/issue_templates/Remove Packager Key.md index f95170a..7b78df8 100644 --- a/.gitlab/issue_templates/Remove Packager Key.md +++ b/.gitlab/issue_templates/Remove Packager Key.md @@ -2,8 +2,10 @@ This template is used when an existing packager PGP public key needs to be removed from the distribution's keyring. It is used by users with a valid main key or a valid packager key. + +NOTE: All comment sections with a MODIFY note need to be edited. --> -/assign @allan @anthraxx @bluewind @dvzrv @pierre +/assign @anthraxx @bluewind @dvzrv @grazzolini @pierre /label ~"remove packager key" /title Remove packager key of -- PGP key ID: +- PGP key ID: - Resignation: ## Checks -- [ ] There are no packages left in any of the official repositories, that are - signed by the key, that is about to be removed. +**NOTE**: The below check box **must be** checked before the main key holders +can start to revoke the key. + +- [ ] There are [no packages left in any of the official + repositories](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/Find-packages-signed-by-a-key), + that are signed by the key or any of its subkeys, which is about to be + removed. ### Main key holders -- [ ] All main key holders have revoked their signature for the key and - published the result on the SKS infrastructure - - [ ] @allan - - [ ] @anthraxx - - [ ] @bluewind - - [ ] @dvzrv - - [ ] @pierre +All main key holders should revoke their signature(s) for the given key in a +merge request to this repository using `keyringctl`. + +- [ ] @anthraxx +- [ ] @bluewind +- [ ] @dvzrv +- [ ] @grazzolini +- [ ] @pierre