From 6e23b7867171ca46518cc95108a1d48ea440676c Mon Sep 17 00:00:00 2001
From: David Runge <dvzrv@archlinux.org>
Date: Thu, 24 Feb 2022 23:48:25 +0100
Subject: [PATCH] Update issue templates

.gitlab/issue_templates/*:
Replace allan with grazzolini when assigning tickets or when addressing
main key holders.
Streamline the checkbox system, by relying on less interaction from the
main key holders side if possible (e.g. checks on new keys are done
automatically in a merge request, so have contributors open the merge
request).
Add more documentation on what needs to be edited and how to provide
data exactly (e.g. keyid format, clearsigned document).
---
 .gitlab/issue_templates/New Main Key.md       | 42 +++++++++++------
 .gitlab/issue_templates/New Packager Key.md   | 47 +++++++++++--------
 .gitlab/issue_templates/Remove Main Key.md    | 19 ++++----
 .../issue_templates/Remove Packager Key.md    | 30 +++++++-----
 4 files changed, 84 insertions(+), 54 deletions(-)

diff --git a/.gitlab/issue_templates/New Main Key.md b/.gitlab/issue_templates/New Main Key.md
index 650a968..40fc0f2 100644
--- a/.gitlab/issue_templates/New Main Key.md	
+++ b/.gitlab/issue_templates/New Main Key.md	
@@ -2,8 +2,12 @@
 This template is used when a new main PGP public key needs to be added to the
 distribution's keyring.
 It is used by users with a valid packager key.
+
+NOTE: All comment sections with a MODIFY note need to be edited. All checkboxes
+in the "Checks" section labeled as "Owner of new key" need to be checked by the
+owner of the new key.
 -->
-/assign @allan @anthraxx @bluewind @dvzrv @pierre
+/assign @anthraxx @bluewind @dvzrv @grazzolini @pierre
 /label ~"new main key"
 /title New main key of <!-- MODIFY: Add new main key holder's username -->
 <!--
@@ -16,18 +20,27 @@ issue and assign relevant users.
 ## Details
 
 - Username: <!-- MODIFY: Add the @-prefixed username -->
-- PGP key ID: <!-- MODIFY: Add the "long format" key ID of the new PGP public key here -->
+- PGP key ID: <!-- MODIFY: Add the output of `gpg --keyid-format long --list-key <MY UID> | sed -n '2p' | tr -d ' '` here -->
 - Revocation Certificate Holder: <!-- MODIFY: Add the @-prefixed username of the revocation certificate holder -->
 
 <!--
-NOTE: Attach the above information as a clearsigned document to this ticket
-using a valid packager key of the user.
-https://www.gnupg.org/gph/en/manual/x135.html
+MODIFY: Attach the above information of the details section as a clearsigned
+document (see https://www.gnupg.org/gph/en/manual/x135.html) to this ticket
+using a valid packager key of the user:
+
+* Select the above text, copy/paste it into a file (e.g. `details.txt`).
+* Make sure to sign with the root certificate of the packager key (not any of
+  the subkeys!):
+  `gpg --armor --default-key <fingerprint_of_root>! --clearsign details.txt`
+* Upload `details.txt` as attachment to this ticket.
 -->
 
 ## Checks
 
-### New key owner
+**NOTE**: The below check boxes **must be** checked before the accompanying
+merge request to add the new main key can be merged.
+
+### Owner of new key
 
 - [ ] The [workflow for adding a new main
   key](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/add-a-new-main-key)
@@ -38,18 +51,17 @@ https://www.gnupg.org/gph/en/manual/x135.html
   a clearsigned document
 - [ ] The revocation certificate has been sent in an encrypted message to the
   revocation certificate holder
-- [ ] The public key has been uploaded to the SKS infrastructure
-
-### Keyring maintainer
-
-- [ ] The key pair has been validated according to the [best
-  practices](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/best-practices#validating-a-key-pair)
-- [ ] The data in the [Details](#details) section is correct and signed with a
-  valid and trusted packager key, which is part of `pacman-key`
+- [ ] The public key has been uploaded to the pgp.mit.edu and keyserver.ubuntu.com
+- [ ] A merge request to add the new public key has been created
 
 ### Revocation Certificate Holder
 
 - [ ] The revocation certificate has been [verified
   as working](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/verify-a-revocation-certificate)
   and confirmed in a comment to this issue
-- [ ] The revocation certificate has been backed up in a dedicated encrypted backup storage
+- [ ] The revocation certificate has been backed up on a dedicated encrypted backup storage medium
+
+### Main key holders
+
+- [ ] The data in the [Details](#details) section is correct and signed with a
+  valid and trusted packager key, which is already part of `archlinux-keyring`
diff --git a/.gitlab/issue_templates/New Packager Key.md b/.gitlab/issue_templates/New Packager Key.md
index 20a7900..f303c5a 100644
--- a/.gitlab/issue_templates/New Packager Key.md	
+++ b/.gitlab/issue_templates/New Packager Key.md	
@@ -3,8 +3,12 @@ This template is used when a new packager PGP public key needs to be added to
 the distribution's keyring.
 It is either used by the sponsor of a new packager or by an existing packager
 when adding a new key for themself.
+
+NOTE: All comment sections with a MODIFY note need to be edited. All checkboxes
+in the "Checks" section labeled as "Owner of new key" need to be checked by the
+owner of the new key or by a sponsor of a new packager.
 -->
-/assign @allan @anthraxx @bluewind @dvzrv @pierre
+/assign @anthraxx @bluewind @dvzrv @grazzolini @pierre
 /label ~"new packager key"
 /title New packager key of <!-- MODIFY: Add new packager key holder's username -->
 <!--
@@ -17,24 +21,33 @@ issue and assign relevant users.
 ## Details
 
 - Username: <!-- MODIFY: Add the @-prefixed username -->
-- PGP key ID: <!-- MODIFY: Add the "long format" key ID of the new PGP public key here -->
+- PGP key ID: <!-- MODIFY: Add the output of `gpg --keyid-format long --list-key <MY UID> | sed -n '2p' | tr -d ' '` here -->
 - Sponsors: <!-- MODIFY: Add the @-prefixed usernames of the sponsors -->
 - Application: <!-- MODIFY: Add link to application, if this is the key of a new packager, else remove -->
 - Results: <!-- MODIFY: Add link to results of application, if this is the key of a new packager, else remove -->
+- Previous Key: <!--
+  MODIFY: Add the output of `gpg --keyid-format long --list-key <MY PREVIOUS ID> | sed -n '2p' | tr -d ' '` here
+  if another packager key exists already, else remove
+  -->
 
 <!--
-NOTE: Attach the above information as a clearsigned document to this ticket.
-https://www.gnupg.org/gph/en/manual/x135.html
+MODIFY: Attach the above information of the details section as a clearsigned
+document (see https://www.gnupg.org/gph/en/manual/x135.html) to this ticket.
+If a previous (valid and trusted) packager key of the user exists, it needs to
+be used for clearsigning the document.
+If the key of a new packager is added, one of their sponsors needs to clearsign
+the details section.
 
-If this is the key of a new packager, one of their sponsors needs to do the
-signature.
-If this is a new key of an already existing packager, the packager themself
-needs to do the signature.
+* Select the above text, copy/paste it into a file (e.g. `details.txt`).
+* Make sure to sign with the root certificate of the packager key (not any of
+  the subkeys!):
+  `gpg --armor --default-key <fingerprint_of_root>! --clearsign details.txt`
+* Upload `details.txt` as attachment to this ticket.
 -->
 
 ## Checks
 
-### New key owner
+### Owner of new key
 
 - [ ] The [workflow for adding a new packager
   key](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/add-a-new-packager-key)
@@ -45,24 +58,18 @@ needs to do the signature.
   practices](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/best-practices#validating-a-key-pair)
 - [ ] The data in the [Details](#details) section is attached to this issue as
   a clearsigned document
-- [ ] The public key has been uploaded to the SKS infrastructure
+- [ ] The public key has been uploaded to the pgp.mit.edu and keyserver.ubuntu.com
+- [ ] A merge request to add the new public key has been created
 
 ### Main key holders
 
-- [ ] The public key has been validated according to the [best
-  practices](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/best-practices#validating-a-key-pair)
 - [ ] The public key has been signed by all main key holders
-  - [ ] @allan
   - [ ] @anthraxx
   - [ ] @bluewind
   - [ ] @dvzrv
+  - [ ] @grazzolini
   - [ ] @pierre
 
-### Keyring maintainer
-
-- [ ] The public key contains one user ID with a valid
-  `<username>@archlinux.org` email address used for signing
-- [ ] The public key has been validated according to the [best
-  practices](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/best-practices#validating-a-key-pair)
+### Developers of the archlinux-keyring project
 - [ ] The data in the [Details](#details) section is correct and signed with a
-  valid and trusted packager key, which is part of `pacman-key`
+  valid and trusted packager key, which is already part of `archlinux-keyring`
diff --git a/.gitlab/issue_templates/Remove Main Key.md b/.gitlab/issue_templates/Remove Main Key.md
index 1435e30..b1fae1d 100644
--- a/.gitlab/issue_templates/Remove Main Key.md	
+++ b/.gitlab/issue_templates/Remove Main Key.md	
@@ -1,9 +1,14 @@
 <!--
 This template is used when an existing main PGP public key needs to be removed
 from the distribution's keyring.
-It is used by users with a valid main key.
+It is used by users with a valid main key or the holder of the revocation
+certificate of the main key that is about to be removed.
+
+NOTE: All comment sections with a MODIFY note need to be edited. All checkboxes
+in the "Check" section labeled as "Main key holders" need to be checked for the
+accompanying merge request to be merged.
 -->
-/assign @allan @anthraxx @bluewind @dvzrv @pierre
+/assign @anthraxx @bluewind @dvzrv @grazzolini @pierre
 /label ~"remove main key"
 /title Remove main key of <!-- MODIFY: Add main key holder's username -->
 <!--
@@ -16,7 +21,7 @@ issue and assign relevant users.
 ## Details
 
 - Username: <!-- MODIFY: Add the @-prefixed username -->
-- PGP key ID: <!-- MODIFY: Add the "long format" key ID of the PGP public key here -->
+- PGP key ID: <!-- MODIFY: Add the output of `gpg --keyid-format long --list-key <MAIN KEY UID> | sed -n '2p' | tr -d ' '` here -->
 - Resignation: <!-- MODIFY: Link to resignation of key holder -->
 
 ## Checks
@@ -27,8 +32,6 @@ issue and assign relevant users.
   removal of this key.
 - [ ] All packagers have at least three valid main key signatures for their
   packager key after removal of this key.
-
-### Keyring maintainer
-
-- [ ] The key has been revoked by either the revocation certificate holder or
-  the main key holder.
+- [ ] A merge request to [remove the main public
+  key](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/remove-a-main-key)
+  has been created
diff --git a/.gitlab/issue_templates/Remove Packager Key.md b/.gitlab/issue_templates/Remove Packager Key.md
index f95170a..7b78df8 100644
--- a/.gitlab/issue_templates/Remove Packager Key.md	
+++ b/.gitlab/issue_templates/Remove Packager Key.md	
@@ -2,8 +2,10 @@
 This template is used when an existing packager PGP public key needs to be
 removed from the distribution's keyring.
 It is used by users with a valid main key or a valid packager key.
+
+NOTE: All comment sections with a MODIFY note need to be edited.
 -->
-/assign @allan @anthraxx @bluewind @dvzrv @pierre
+/assign @anthraxx @bluewind @dvzrv @grazzolini @pierre
 /label ~"remove packager key"
 /title Remove packager key of <!-- MODIFY: Add packager key holder's username -->
 <!--
@@ -16,20 +18,26 @@ issue and assign relevant users.
 ## Details
 
 - Username: <!-- MODIFY: Add the @-prefixed username -->
-- PGP key ID: <!-- MODIFY: Add the "long format" key ID of the PGP public key here -->
+- PGP key ID: <!-- MODIFY: Add the output of `gpg --keyid-format long --list-key <PACKAGER KEY UID> | sed -n '2p' | tr -d ' '` here -->
 - Resignation: <!-- MODIFY: Link to resignation of key holder -->
 
 ## Checks
 
-- [ ] There are no packages left in any of the official repositories, that are
-  signed by the key, that is about to be removed.
+**NOTE**: The below check box **must be** checked before the main key holders
+can start to revoke the key.
+
+- [ ] There are [no packages left in any of the official
+  repositories](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/Find-packages-signed-by-a-key),
+  that are signed by the key or any of its subkeys, which is about to be
+  removed.
 
 ### Main key holders
 
-- [ ] All main key holders have revoked their signature for the key and
-  published the result on the SKS infrastructure
-  - [ ] @allan
-  - [ ] @anthraxx
-  - [ ] @bluewind
-  - [ ] @dvzrv
-  - [ ] @pierre
+All main key holders should revoke their signature(s) for the given key in a
+merge request to this repository using `keyringctl`.
+
+- [ ] @anthraxx
+- [ ] @bluewind
+- [ ] @dvzrv
+- [ ] @grazzolini
+- [ ] @pierre