Update tails.key #1631
Merged
Update tails.key #1631
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The new key expires: 2025-01-25, maybe some bot or gh tool can set a reminder for the next time. |
|
Replication notes reduced from last year update (this is not key change: this is public key expiration date which is not as dramatic as in the past. Newer images should still boot but saying the public key expired (while still in use). Anyway! Thank you for this. Tried to replicate key in this PR with notes of last year:#1296 (comment) Doing so results in the following diff: Where if I replace last command by Most is different: May I ask what commands you used to generate the public key pushed in this PR @0xF4CED ? This PR: With replicated minimize instructions (same size but not exact content, which is why i'm curious): With added export-minimal export-options:: Thanks! |
|
@0xF4CED Modified past comment (in case you reply to emails) |
|
Sure. I wanted to use gpg --armor --export-options export-clean --export A490D0F4D311A4153E2BB7CADBB802B258ACD84F > tails.keyis what I used. |
Combination of miniziming within gpg + exporting export-minimal smalls it down even more. |
Key expired: 2024-01-04 Replace with clean export of updated [Tails](https://tails.net/tails-signing.key) signing key. Signed-off-by: 0xF4CED <[email protected]>
|
Should be fine now. Can you confirm? |
I think this is currently not the case for the latest releases as they added a new subkey |
|
Not sure why I get different output as if it was not reproducible... @0xF4CED maybe going further then minimizing is not reproducible? |
|
Not sure tbh. The key in your fork is identical to the one in this pr though. |
Confirmed matching. Testing. With this PR, latest iso+detached signature on qemu FD drive: Without this PR: So took the freedom to modify OP with reproducibility step so that can be reused in a year. |
tlaurion
approved these changes
Apr 4, 2024
|
@0xF4CED Thanks for your contribution! |
|
Nice, thanks! |
4 tasks
tlaurion
added a commit
to tlaurion/heads
that referenced
this pull request
Sep 7, 2024
Repro notes per last update at linuxboot#1631 (comment) rm -rf /tmp/tails-signing/ wget -q https://tails.boum.org/tails-signing.key -O tails-signing.key mkdir -p /tmp/tails-signing/ gpg --home /tmp/tails-signing/ --import tails-signing.key gpg --home /tmp/tails-signing/ --export --armor --export-options export-minimal,export-clean [email protected] > ~/heads/initrd/etc/distro/keys/tails.key Signed-off-by: Thierry Laurion <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Key expired: 2024-01-04
Replace with clean export of updated Tails signing key.
EDITS (tlaurion) prior of merging.
Reproduction notes:
Confirmation PR needed at #1631 (comment)