Add security.txt

- Add scripts/security-txt.sh
  to generate a security.txt file
- Add the current security.txt
- Extend verify.sh to verify security.txt by default
  and cross-check that it expires together with the signing key
- Describe security.txt in OPENPGP.md and README.md

scripts/verify.sh

@@ -4,17 +4,18 @@
 #
 # Usage:  ./scripts/verify.sh [FILE...]
 #
-# FILE defaults to KEYS.md OPENPGP.md ceremonies/*.md AGE.md
+# FILE defaults to KEYS.md OPENPGP.md ceremonies/*.md AGE.md security.txt
 #
 # A FILE with a FILE.asc next to it is checked as a detached signature,
 # any other FILE as a clearsigned document
 #
 # Also checks the key's expiry, and,
 # if KEYS.md or AGE.md is among the FILEs,
-# that age-recipient.txt matches the recipient in them
+# that age-recipient.txt matches the recipient in them, and,
+# if security.txt is among the FILEs, that it expires with the key
 #
 # Exits non-zero if any file lacks a valid signature from the pinned key,
-# or if the key has expired, or if a cross-check fails
+# or if the key or security.txt has expired, or if a cross-check fails
 
 set -eu
 
@@ -36,6 +37,7 @@ if [ $# -eq 0 ]; then
         "$REPO/OPENPGP.md" \
         "$REPO"/ceremonies/*.md \
         "$REPO/AGE.md" \
+        "$REPO/security.txt" \
         # Keep this list aligned with the documentation at the top
 fi
 
@@ -104,10 +106,13 @@ fi
 
 
 # age-recipient.txt is the only unsigned artifact,
-# so it must match the recipient in the signed documents
+# so it must match the recipient in the signed documents;
+# security.txt must expire together with the signing key,
+# but only cross-check it when it was among the verified files
 for FILE; do
 
     case "$FILE" in
+
         */KEYS.md | KEYS.md | */AGE.md | AGE.md)
             # shellcheck disable=SC2016  # The backticks are literal Markdown
             EXPECTED=$(sed -n 's/^> `\(age1[0-9a-z]*\)`$/\1/p' "$FILE")
@@ -120,6 +125,16 @@ for FILE; do
                 FAILED=1
             fi
             ;;
+
+        */security.txt | security.txt)
+            EXPECTED=$(date -u -d "@$EXPIRY" +%Y-%m-%dT%H:%M:%SZ)
+            ACTUAL=$(sed -n 's/^Expires: //p' "$FILE")
+            if [ "$ACTUAL" != "$EXPECTED" ]; then
+                echo "FAIL  security.txt expires $ACTUAL, key expires $EXPECTED" >&2
+                FAILED=1
+            fi
+            ;;
+
     esac
 
 done