Techaro signing keys

[Xe]

Hey all,

I'm working on package signing for Anubis, Yeet, and other Techaro products. This is a pre-announcement of what keys you should add to your GPG keyrings.

Key type	Fingerprint
Root key	89AD2E5A635AB819694005E6538D4D2309CCC2EC
Package signing (CI)	833F64161167B501058C394756375DA2DF02ABFF

The keysigning table may be found here with signature here.

In general, you will see the packages signing key the most often. The root signing key is stored on a hardware two factor token in a locked box in my office.

I have signed all of the assets generated in v1.17.0 so that interested parties can test validating the signatures.

Please let me know if there are any issues with these keys.

[Foxboron]

If you don't intend to cross-sign the keys, you should probably sign the table with your root key, and any changes to these keys needs to be signed by that root key. That would give you some form of transitive trust between the keys.

[heftig]

FYI we're consuming the Git tag at https://gitlab.archlinux.org/archlinux/packaging/packages/anubis/-/blob/main/PKGBUILD and that's not signed.

[Xe]

It will be signed next release using the "packages" signing key.

[flamboyantpenguin]

Is there a repo for Debian and Fedora? I would love to get updates automatically for native packages