Restructure the repository
- Make OpenPGP only one of many protocols + KEYS.md only holds the current keys + OPENPGP.md describes all OpenPGP details - Make the current public key available at the root - Add scripts/ to automate the various steps: + bootstrap.sh + publish.sh + sign.sh + snapshot.sh + verify.sh
This commit is contained in:
parent
a4f48a61a3
commit
8ece401276
GPG key ID:
B46EDB4DFC26805D
11 changed files with 861 additions and 239 deletions
111
README.md
111
README.md
|
|
@ -1,19 +1,114 @@
|
|||
# OpenPGP Keys
|
||||
# Keys
|
||||
|
||||
This repository documents my OpenPGP keys: Policies, ceremonies, and history.
|
||||
Public record of the cryptographic keys of Alexander Hess
|
||||
(i.e., "me" in this repository):
|
||||
What they are, how they are handled, and how to verify them.
|
||||
|
||||
There are two audiences for this repository:
|
||||
|
||||
## Contents
|
||||
- **I** want a how-to:
|
||||
[`OPENPGP.md`](OPENPGP.md) and [`AGE.md`](AGE.md) hold the policies and ceremonies,
|
||||
and the [`scripts/`](scripts/) run them.
|
||||
- **Readers** want to confirm my keys and my identity:
|
||||
Everything needed for that is in the [Verify](#verify) section below.
|
||||
|
||||
- [`KEYS.md`](KEYS.md): current key, policies, and all ceremonies
|
||||
- [`KEYS.md.asc`](KEYS.md.asc): detached signature, renewed at every ceremony
|
||||
- [`snapshots/`](snapshots/): yearly exports of the current key
|
||||
- [`ceremonies/`](ceremonies/): signed records of exceptional events (e.g., key supersessions)
|
||||
- [`history/`](history/): armored public keys of all keys ever published
|
||||
|
||||
|
||||
## Verify
|
||||
|
||||
The fingerprint of my [current PGP key](public-key.asc) is in [`KEYS.md`](KEYS.md),
|
||||
which is signed.
|
||||
|
||||
Compare the fingerprint with at least one source outside this repository
|
||||
to confirm my identity:
|
||||
|
||||
- [WKD](https://wiki.gnupg.org/WKD),
|
||||
for example, via `gpg --locate-keys ah@alexander-hess.com`
|
||||
- The keyservers listed in [`OPENPGP.md`](OPENPGP.md),
|
||||
for example, `gpg --keyserver hkps://keys.openpgp.org --search-keys alexander@webartifex.de`
|
||||
- [`KEYS.md`](KEYS.md) obtained from my websites:
|
||||
- [alexander-hess.com](https://www.alexander-hess.com/KEYS.md)
|
||||
- [webartifex.de](https://www.webartifex.de/KEYS.md)
|
||||
|
||||
|
||||
Then:
|
||||
|
||||
```bash
|
||||
gpg --import public-key.asc
|
||||
|
||||
gpg --verify KEYS.md.asc KEYS.md
|
||||
gpg --verify OPENPGP.md.asc OPENPGP.md
|
||||
```
|
||||
|
||||
Each `gpg --verify` will print two things:
|
||||
|
||||
1. `Good signature from "Alexander Hess <...>"`:
|
||||
The file is intact and was signed by this key.
|
||||
2. `WARNING: This key is not certified with a trusted signature!`:
|
||||
Because `gpg` likely has no record that this key is mine.
|
||||
|
||||
So, a good signature plus a matching `Primary key fingerprint` line is the full result.
|
||||
|
||||
To silence the warning on your machine,
|
||||
tell `gpg` about your check:
|
||||
|
||||
```bash
|
||||
gpg --lsign-key <FPR> # after comparing the fingerprint yourself
|
||||
```
|
||||
|
||||
|
||||
If you trusted one of the two keys I retired in 2026,
|
||||
they certified the current one,
|
||||
and the supersession is recorded in [`ceremonies/`](ceremonies/):
|
||||
|
||||
```bash
|
||||
gpg --import history/344EA5AB10D868E0-public.asc history/6D11C1E91D3B0265-public.asc
|
||||
gpg --check-signatures 8B1140ADB5185334E9FA513B75681C8167312680
|
||||
gpg --verify ceremonies/2026-07-08_supersession.md.asc ceremonies/2026-07-08_supersession.md
|
||||
```
|
||||
|
||||
|
||||
|
||||
## Contents
|
||||
|
||||
The files in this repository are described below.
|
||||
|
||||
|
||||
### OpenPGP
|
||||
|
||||
How I implement [OpenPGP](https://www.openpgp.org/):
|
||||
|
||||
- [`KEYS.md`](KEYS.md):
|
||||
Current keys, signed
|
||||
- [`KEYS.md.asc`](KEYS.md.asc):
|
||||
Detached signature, renewed at every ceremony
|
||||
- [`OPENPGP.md`](OPENPGP.md):
|
||||
OpenPGP policies, ceremonies, and history
|
||||
- [`OPENPGP.md.asc`](OPENPGP.md.asc):
|
||||
Detached signature, renewed at every ceremony
|
||||
- [`public-key.asc`](public-key.asc):
|
||||
Armored export of the current OpenPGP key
|
||||
- [`snapshots/`](snapshots/):
|
||||
Yearly exports of the current OpenPGP key
|
||||
- [`ceremonies/`](ceremonies/):
|
||||
Signed records of exceptional events
|
||||
- [`history/`](history/):
|
||||
Armored public keys of all previous OpenPGP keys
|
||||
|
||||
|
||||
### Scripts
|
||||
|
||||
`sh` scripts for my own use:
|
||||
|
||||
- [`bootstrap.sh`](scripts/bootstrap.sh):
|
||||
Imports and trusts all keys on a new machine,
|
||||
then verifies all files
|
||||
- [`sign.sh`](scripts/sign.sh):
|
||||
Renews the detached signatures
|
||||
- [`verify.sh`](scripts/verify.sh):
|
||||
Verifies all signed files against the pinned signing subkey,
|
||||
and warns when the key is about to expire
|
||||
- [`snapshot.sh`](scripts/snapshot.sh):
|
||||
Exports the current key to `snapshots/` and `public-key.asc`
|
||||
- [`publish.sh`](scripts/publish.sh):
|
||||
Pushes the current key to the keyservers
|
||||
|
|
|
|||
Loading…
Reference in a new issue