Reduce the number of places that record pgp.trustedPublicKeys

[merks]

Currently there appear to be three places that are somehow related to specifying trusted keys:

• https://github.com/eclipse-platform/eclipse.platform.releng.aggregator/blob/master/eclipse.platform.releng/features/org.eclipse.sdk/p2.inf

• eclipse.platform.releng.aggregator/eclipse.platform.releng.tychoeclipsebuilder/eclipse.platform.repository/pom.xml

  Lines 299 to 376 in cd6037b

  	<profileProperties>
  	<pgp.trustedPublicKeys><![CDATA[----BEGIN PGP PUBLIC KEY BLOCK-----
  	xsFNBFhaXO0BEAC8WCdwrJNF/W+C8m9FYwAhEvKBvQ7xmoGYZqgcYe2ntT8udvgZ
  	k+dRwZJnu1VI3a8feOLrAmeNI2MxPP0+l2kGeC55c10duXPzLvW9oHONm39FZpCM
  	X1m66TYkUBeu/DIttNf5l0nv54dmm4VAWjutnVmlKGf5MVmmAH4mrkmgs7UTyQRK
  	JKJ8B7tAt6CI1tXq2ULjzUpz9iyD1IkWal4K2gYfooSuGLayNY+SCdcT9uZkpS4B
  	rnHy2QeJqPSnJv+5G1SkX1fzavWelrf72vx+su8L8QzUa6JtGJatFbAHzEdXGJ98
  	JnK7TAQvR3hCyzj+TnVCY1hiRO6B+4zI3j/vSJVdc5wmLejvfZRqhiaQ8Vr4xDbu
  	w7/i+raAKwr//zVGAqp/zN6zQmyoLks+cfuI4yqHuXKGaNs5RapKCxfukC/TRB2e
  	fLhqCpXAbRQ8a+R+0CCBP2WYDYNQoh4FnwuqtZefnm8NVKW+2we5y3llIrXV5PQb
  	FFN5WOLuNvO/JOtRQSjNd4WYttwNCDP7ATpRK6ixz7qveztGNhuiCRx01HbZ2uUE
  	DKV0DW8mWRjALl9/akMRcdIeTayKHDVjeNq5amnWT0vZ2F422BJW6sQryTs/NIBK
  	XGoVVZeXms3fzL9IpztcVFZTuwmk5kk1FXXaBDMwVHlR5hC5gIuLIfLVEwARAQAB
  	zTpFY2xpcHNlIFBsYXRmb3JtIFByb2plY3QgPHBsYXRmb3JtLXJlbGVuZy1kZXZA
  	ZWNsaXBzZS5vcmc+wsF9BBMBCAAnBQJYWlztAhsvBQkJZgGABQsJCAcDBRUKCQgL
  	BRYCAwEAAh4BAheAAAoJELbTq5vMZBKC8SsP/3csTQk6nxtGtQ5Q5HDBZ/5yeQe1
  	uVMl4DXJMxjYMRI29Uzrb+uMzP7zfs8xTBXktPB+bC5CqVE7QsnBEAMdXWvqk6pw
  	pmbC/felj+dyoy8FAHA+f52W94PYjci0TyDYgEeWAvtnnzJ8tMTZQT5qxhYM/Kt5
  	9XIrRqVCXw/kh7wlW4MF5MQAI8SK2j9W4WY9wMQbW5xfaYHo23Xi/NZ6nuYOoRKb
  	ejtlHXa4FSHOVYSg9sqNNnSI3mEvHrGbtlSli6ApwCSG8lcLNqjtgf2/kZncB9yg
  	DmTNq7ivFE9CxW6w8CGl3fpCZiT4DWXNj81P/lqpNjIwjEcbrZVbvXw5pjFKi0sJ
  	rpbc1ClhTKXKv+/Sn5cxMHYmzrrBoQBlLXLe+ETRZNbOpY5pSBis9ALBwXp4ARq+
  	YydwV1L2jntUPi3rYsR6PPnDNNfi2XNOSPF3ms5opGcR6jd+DzxzAN0Q1VTgKaHk
  	GpR2PqPu5RTelDObzYi28y8+URyys8JoKPpTsyJqYcJtW4X0JPgd/mRS7y53n6MQ
  	Quy2/yDJKomEe+Nnag16eqGDIie7RrSx82TKF9cT4Wr8qEwD22UnLEuiy02TXzsR
  	tWyVDCZE2mDbHbOMz0uuMqcA3WCEyZrzR1vmH7TnQ1NA9K9oxzzaayNOUw7IgE02
  	HNwdca2ZV+Wgurj4wsFcBBABCAAGBQJYWl1CAAoJEJ+itymfUeVDJhkQAJEHg3s+
  	iDs1GXoh85pcAWHdrl+PXCLz/gMAYrGvj1kKtW63atTpBvu+BnELVj7eKTUnCgRM
  	W2w8eKfDgQo8J6bQtHRpHnYSb7bAOKpiBgz13aZJjSvz14vabzP4zWdHtJEOmoH0
  	U8I0xIyFmBovelQAN9tSRaD6gWcbsAqJJPCgpn43QGSueSWuFND0Zk0rnwoc/1a8
  	JUKf6zEjHqBRfEVe+itvigIr9fy+xdX6fA6OE6OnBl7VZlVVKO8/EVdx3aehzHLc
  	WxykAVmNe2iSOW1D7UvZQvYds8f1OUHQiKc+jkA3Na/xVQ0Gwuu0L7nIi7JkAWNY
  	dOxPk+K9kWSa4ReXlOKjhC0hmNMtohKuZ2TSOsAqaWZtpJoPZpDOqDhOvx/lwBck
  	cxPSUZEJB88fdHTzR9PFD07Zh8EE+oRqVp7xauIgoTLk8wrUSnnJ4dwx+Zzp2OLB
  	mC0vAI+gSQXHkbG06jRDsPlXXMpS5/nEb2FhcEC3M4ytP6z+u1R2KM0c3jH9WRLB
  	ALqSWNM3cR5TJjUeTyN8O70s13+1tKnZNm08C0XHphxGC4SMMCaKqJ0hEqGr0WCA
  	qLrarSprDJ44ZFf8TcURHeKV2SuFXKUGyjgF22wAGepuKZ4whUuwBBxtDNXrpIdQ
  	/qAjTdr9LQcjGwZD6nH45HD+eiUaFZOlANQ8zsFNBFhaXPsBEAC3bR7f5euHbpID
  	DTuFYHPI0+S5X0DhuqcGBUL2HSFhWMwIlfsAaO+pt7GyfXLUkTmzugwmwO+sOW2Q
  	mwEZQcK2z3BrcjytZophZ9AUajbAjnadSH6UXCMmfExVVnaYSfl/+Uub42szQE/r
  	3gCRIz6M6clVVAjpFv4G/mumfQUV/XzLoUEYXTgwTokFJ97R+hDbHvBEBrUT8M6z
  	HP5DhN3EBug3qb6wZVOa/+HEX3M+7k4jVT/ppNumw0acg0DDoSNQ13VsRV6sV0XE
  	4zr3Zfs84f8xCgXpEMs4U6DZGqs3iJVVtbRf0oL0fgcxNgRrmbCrBfbXYfrS4u+f
  	J0vB+Wrflv9eNA3i6TtVL6uYpZy9uO2B1olKVzfEhsgB3QrULB4jVHZjIXGe4ILn
  	45ndMtAeY4M91wyobgG99Xl+1vPHrxV0+2zRP66J3puyxiKE2B7gd7hib54CB3lY
  	yrG1S+K1kZGCI1IFKCnqmTJXY0tKoLAASS3vtDcknXenzR5RVSpWTDuxtusekfL0
  	Bw8pCBoz9L4Hex8Q1j//D5CZlqcg1NKFfmBZ7ta9PTuJcpOsz/LaPG/0VHYt/QAv
  	5o4eeZESl7iZyM4/0NFh2s/rq0R8Z9yVSSkIvvO8d8XGZ65NTm3T4NFuEihn+AEm
  	+zg4KiGdYBEZvs8QQoW9e1+MMN8xnwARAQABwsOEBBgBCAAPBQJYWlz7AhsCBQkJ
  	ZgGAAikJELbTq5vMZBKCwV0gBBkBCAAGBQJYWlz7AAoJEHAOTzm8BTZLp0sP/0kU
  	dbRktaQ49o6Jy6UdMD4pQqYUugDb/Pecr5YOqxxuJyouIUNCc2cYRgsJIMRJEWio
  	si3xIk4oRE5BdetQKiz4crxPC7kNQBvgPrVJ0fP094ChPLf5tv1LUnGcDdUBEFXP
  	7huzE622dp4F3x+uZN384Y8veQJyRwLMLtr4nNYcw4u+x5UKTdDt2nSblP433btU
  	cTRNDEbfDBRI7ExcEgVZupQ8YHGVfqo0SxkM508ixefwMgiO2eM/cR2TyhatXh86
  	nr4nzYqn2/Cl9trByjknZ1Qcwav1MW0+YyGzUkYQ/dRY7WQ+2esItzzrAf/UVmQZ
  	XQqL+GRGo5sRc8aceEQKmDkiJBKK/WbURm2blr04nuLxSLq+03+eN5hOp8SnIIBM
  	TaeDE8jndbHDHPaMnMx+etTk3RzgmBMqAsKRvTdh29fzA51kohyhuOdQr3axORR3
  	D2So6f5x1HEcP1kAt24I+knAGsuuBCguUvbVvlqfOTssr4/jO5QczsadfZxEqXwv
  	vn8wQEDzMbQ/BL62U8ahUicTDh/W4cwfPjBbdPLZmG+UsKGIuAvCSfsGYDXrSSiv
  	o9O378jFAoR/0m5AlbMzIokhIxwNipNCzFWCkvziyVO4u7WV1WidO/EBHkw8uYUs
  	7LrXfqK5RZEffpoK9R1IdFIGJaH03xIu2yw3kq9HqGYQAISqS95RSMGAmqLlfOM1
  	O81PVVisf2hx0siboimdAZYwfAGqNm48Rht9oXHRn4oobuwlVEGZiTWkYgi8gnPe
  	xTKjZe6rmYZT79nL6pyhLimUa44lxA6mgtJ4D9ftqNnMEqIntaLHbBkR0itXNNlS
  	qvMv1WsoVS19i4kVseLr4dFMnjtesYOhJg/sl7T/IQHzflqjSyCNo5dffffAQB3K
  	rdaq8cz7qTW6PXM4EAFQH5uTaYJ8oDI3t7XsGyxBWX0+xVYHXXSU5Iq2CrB34Ipc
  	ygoXyTFOoZeXHDguPMXX2LnV+R7lNc0EeJ0oTyRSzmw0ao/5bgfiY14GfN0hvUFt
  	HIQ/Utlm2MUB108uOMeQ4EnM2xCiGtxjvHCc9IvS9OuR0zGpT6aSxXrrMMVC0QHA
  	Z+ntRHqo4mFuXrPth7+arUOW/PYmm3iLAaKqsXPhkjUrM3Ryp5v/J809tRyDmSX2
  	YOQQysGGkayKI2GyiilZ8MULM02MANot9m+QlOo1lLpmOUJDtzCHylg4M+kHpGPL
  	AW5Oi8j/f/7YH/S47HmSdgw3sHZl69WHIprKXtD8103BdNqrPJev2azwqWwxFpN8
  	3tEPbK4SwWPgk1nSELXZZ5ClcDgqatg+/nv7orxRAQZ+sBQdLn/Ztf0y2NKwqFh5
  	UNmHBQdtflW5G1L5fQggWG7V
  	=/Asu
  	-----END PGP PUBLIC KEY BLOCK-----
  	]]>
  	</pgp.trustedPublicKeys>
  	</profileProperties>

• https://github.com/eclipse-platform/eclipse.platform/blob/master/platform/org.eclipse.platform/700E4F39BC05364B.asc

The first two look the same:

properties.0.value=-----BEGIN PGP PUBLIC KEY BLOCK-----\n\
\n\
xsFNBFhaXO0BEAC8WCdwrJNF/W+C8m9FYwAhEvKBvQ7xmoGYZqgcYe2ntT8udvgZ\n\

----BEGIN PGP PUBLIC KEY BLOCK----- 
  
 xsFNBFhaXO0BEAC8WCdwrJNF/W+C8m9FYwAhEvKBvQ7xmoGYZqgcYe2ntT8udvgZ 

But the last one is different:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFhaXO0BEAC8WCdwrJNF/W+C8m9FYwAhEvKBvQ7xmoGYZqgcYe2ntT8udvgZ

I believe only the last one is actually used and I believe the first two are from earlier efforts and are now obsolete.

I think it would be best to delete the first two to avoid confusing in the future should the key ever need to be updated.

@mickaelistria

Do you agree with this assessment?

[mickaelistria]

I don't think we should bother much about the slight differences in here: I think despite the few first char changes, those are still the same keys. The 1st chars are probably reflecting different metadata (eg PGP version, or the PGP client that emitted the key...)

The key defined inside the bundle via plugin.xml (3rd one) is definitely important, as it prevents end-users from seeing a popup when installing/updating the Eclipse SDK features.
I believe the 2nd one can also be important: it controls the trusted keys that p2 director will allow. If we don't declare the Eclipse SDK key as trusted there, it's possible that when attempting to create the Eclipse SDK product, p2 complains that the artifacts are signed with such untrusted key.

The 1st one, which is about adding the property to the profile during p2 install, is somehow equivalent to the last one. I think we can get rid of it and prefer the declaration of trusted key in plugin.xml.

[merks]

Thanks for the quick feedback!

---

The only use of the string in the framework (Java code) is here:

And there it's used only as the name of a preference node:

So I really don't think anything looks for this property in the metadata of a repository.

Moreover, the Installer and the EPP products don't define these things either, so again it does appear to be needed for a build to accept content arbitrary content.

And finally, if you think about it, the p2 director will see the content from the target platform which are signed with various PGP keys from Maven Central, probably it sees keys from Orbit PGP signed content, but none of those keys are in the trusted key specified by any of these, which I believe is purely the Platform's own PGP key. I'm not sure how the Platform would see any content signed with its own PGP key during a normal build.

So I think we should delete the first two. We can't be 100% sure they are useless without trying. Of course that would be best to do early in the 4.37 cycle, so I put this on the back burner for now...