Arch Linux CondorCore repo PGP keyring
Go to file
David Runge c1f59488e5
Add unit tests for code calling sequoia
tests/test_sequoia.py:
Add unit tests for `keyring_split()`, `keyring_merge()`,
`packet_split()`, `packet_join()`, `inspect()`, `packet_dump()`,
`packet_dump_field()`, `packet_signature_creation_time()`, and
`latest_certification()`.
2021-11-30 22:54:14 +01:00
.gitlab Update merge request templates 2021-08-18 17:00:51 +00:00
libkeyringctl Write bytes to stderr when raising during system call 2021-11-30 22:54:13 +01:00
master Update keyring 2021-09-02 22:07:09 +02:00
master-revoked Update keyring 2020-01-08 14:44:28 +01:00
packager Update keyring 2021-11-30 00:18:53 +01:00
packager-revoked Update keyring 2021-11-30 00:18:53 +01:00
tests Add unit tests for code calling sequoia 2021-11-30 22:54:14 +01:00
.editorconfig chore(editorconfig): sync line length with flake8 config to 120 chars 2021-11-30 22:54:10 +01:00
.flake8 Add flake8 configuration 2021-11-30 22:54:06 +01:00
.gitattributes Remove unused files from source package 2017-05-26 08:51:44 +02:00
.gitignore feature(keyringctl): use build command to create final artifacts 2021-11-30 22:54:10 +01:00
.gitlab-ci.yml Add python-coverage to test target 2021-11-30 22:54:13 +01:00
archlinux-revoked Update keyring 2021-08-18 23:52:26 +02:00
archlinux-trusted Update keyring 2021-06-11 08:52:53 +02:00
archlinux.gpg Update keyring 2021-11-30 00:18:53 +01:00
CONTRIBUTING.md Add python-coverage as dependency for contributing 2021-11-30 22:54:13 +01:00
keyringctl chore(keyringctl): modularize the code for overview and testing 2021-11-30 22:54:12 +01:00
LICENSE Add GPL-3.0-or-later license file 2021-07-29 07:48:34 +02:00
Makefile Makefile: Use coverage instead of pytest 2021-11-30 22:54:13 +01:00
master-keyids Add main key dvzrv 2021-05-08 20:35:53 +02:00
master-revoked-keyids Revoke thomas' master key 2019-10-11 21:49:49 +02:00
packager-keyids Add new packager key of Massimiliano Torromeo (mtorromeo) 2021-11-30 00:07:40 +01:00
packager-revoked-keyids removal of Alad Wenter (alad) 2021-08-18 23:39:08 +02:00
pyproject.toml isort: Configure to use single lines 2021-11-30 22:54:08 +01:00
README.md feature(keyringctl): adding ci command to verify newly added certs 2021-11-30 22:54:12 +01:00
update-keys update-keys: switch to keyserver keyserver.ubuntu.com 2021-08-02 13:23:39 +02:00

archlinux-keyring

The archlinux-keyring project holds PGP packet material and tooling (keyringctl) to create the distribution keyring for Arch Linux. The keyring is used by pacman to establish the web of trust for the packagers of the distribution.

The PGP packets describing the main signing keys can be found below the keyring/main directory, while those of the packagers are located below the keyring/packager directory.

Requirements

The following packages need to be installed to be able to create a PGP keyring from the provided data structure and to install it:

  • make
  • python
  • sequoia-sq

Optional:

  • hopenpgp-tools (verify)
  • sq-keyring-linter (verify)
  • git (ci)

Usage

Build

Build all PGP artifacts (keyring, ownertrust, revoked files) to the build directory

./keyringctl build

Import

Import a new packager key by deriving the username from the filename.

./keyringctl import <username>.asc

Alternatively import a file or directory and override the username

./keyringctl import --name <username> <file_or_directory...>

Updates to existing keys will automatically derive the username from the known fingerprint.

./keyringctl import <file_or_directory...>

Main key imports support the same options plus a mandatory --main

./keyringctl import --main <username>.asc

Export

Export the whole keyring including main and packager to stdout

./keyringctl export

Limit to specific certs using an output file

./keyringctl export <username_or_fingerprint_or_directory...> --output <filename>

List

List all certificates in the keyring

./keyringctl list

Only show a specific main key

./keyringctl list --main <username_or_fingerprint...>

Inspect

Inspect all certificates in the keyring

./keyringctl inspect

Only inspect a specific main key

./keyringctl inspect --main <username_or_fingerprint_or_directory...>

Verify

Verify certificates against modern expectations and assumptions

./keyringctl verify <username_or_fingerprint_or_directory...>

Installation

To install archlinux-keyring system-wide use the included Makefile:

make install

Contribute

Read our contributing guide to learn more about guidelines and how to provide fixes or improvements for the code base.

Releases

Releases of archlinux-keyring are created by its current maintainer Christian Hesse. Tags are signed using the PGP key with the ID 02FD1C7A934E614545849F19A6234074498E9CEE.

To verify a tag, first import the relevant PGP key:

gpg --auto-key-locate wkd --search-keys eworm@archlinux.org

Afterwards a tag can be verified from a clone of this repository:

git verify-tag <tag>

License

Archlinux-keyring is licensed under the terms of the GPL-3.0-or-later (see LICENSE).