There are some other changes with my current key:
* Actually revoke an unused uid
As per RFC 4880 [1], a revocation signature (sigclass 0x30) "should
have a later creation date than that certificate." However, somehow in
my keyring I have certificates newer than the previous revocation
signature. As a result, that uid is not marked as revoked by gpg. I
created a new revocation signature to fix that.
* Make @archlinux.org the primary UID
[1] https://datatracker.ietf.org/doc/html/rfc4880
wkd_sync/archlinux-keyring-wkd-sync.service.in:
Replace use of explicit script location (i.e. /usr/bin) with
SCRIPT_TARGET_DIR placeholder.
Makefile:
Create WKD sync service file from input file, replacing the
SCRIPT_TARGET_DIR placeholder with $SCRIPT_TARGET_DIR.
wkd_sync/archlinux-keyring-wkd-sync.service -> wkd_sync/archlinux-keyring-wkd-sync.service.in:
This allows using the file as input file, where overriding keywords can
be done using sed.
Makefile:
Change Makefile to allow installation of keyring data, systemd units and
scripts more configurable.
This allows user provided overrides via KEYRING_TARGET_DIR,
SCRIPT_TARGET_DIR, SYSTEMD_SYSTEM_UNIT_DIR.
Instead of relying on wildcards, rely on specifically named files, as
this can be reused also in the uninstall target without issue and
provides a clearer overview of what will be installed/uninstalled.
Specifically only make use of DESTDIR in the install and uninstall
targets, which allows easier overrides.
Extend uninstall target to also remove WKD sync related script and
systemd units.
keyring/packager/dvzrv/991F6E3F0765CF6295888586139B09DA5BF0D338/uid/David_Runge__dvzrv@archlinux.org_d2ad250f/certification/D8AFDDA07A5B6EDFA7D8CCDAD6D055F927843F1C.asc:
Add main key signature by anthraxx for dvzrv on key 991F6E3F0765CF6295888586139B09DA5BF0D338.
keyring/packager/muflone/CAA1D2323A05219AA2F01AA4E642299183ED727E/*:
Revoke signature on muflone@archlinux.org for
CAA1D2323A05219AA2F01AA4E642299183ED727E.
.gitlab-ci.yml:
Add pkgconf and systemd to the list of packages, that are installed
before executing the build and install targets. They are required to
retrieve the correct path for systemd's system units.
wkd_sync/archlinux-keyring-wkd-sync.timer:
Add timer which triggers archlinux-keyring-wkd-sync.service to
persistently refresh existing PGP keys of archlinux-keyring weekly with
up to 12h of randomized delay.
wkd_sync/archlinux-keyring-wkd-sync:
Add script to refresh existing keys of archlinux-keyring on user
systems based on the state of the distribution's Web Key Directory
(WKD).
Invalid or revoked keys are ignored.
Instead of simply string matching a line, we now traverse the packet as
a tree and match the path based on a depth first search.
While traversing, we support logical OR and current depth * wildcard
processed as a component based query expression.
Callee's are adjusted to specifically select the appropriate Issuer at
the correct depth.
Fixes#185
