diff --git a/contrib/gitian-signing/check-keys.sh b/contrib/gitian-signing/check-keys.sh new file mode 100755 --- /dev/null +++ b/contrib/gitian-signing/check-keys.sh @@ -0,0 +1,5 @@ +# Fetch latest signers' keys. We do this in order to check if a key was revoked. +while read fingerprint keyholder +do + gpg --keyserver hkp://subset.pool.sks-keyservers.net --recv-keys ${fingerprint} +done < ./keys.txt diff --git a/contrib/gitian-signing/keys.txt b/contrib/gitian-signing/keys.txt new file mode 100644 --- /dev/null +++ b/contrib/gitian-signing/keys.txt @@ -0,0 +1,3 @@ +629D7E5DDDA0512BD5860F2C5D7922BBD649C4A7 deadalnix@bitcoinabc.org +3BB16D00D9A6D281591BDC76E4486356E7A81D2C jasonbcox@bitcoinabc.org +7A55A44F3A3239827C8A594E7D3958C44427674A shammah.chancellor@bitcoinabc.org diff --git a/doc/gitian-signing.md b/doc/gitian-signing.md new file mode 100644 --- /dev/null +++ b/doc/gitian-signing.md @@ -0,0 +1,20 @@ +# Gitian signing + +Once you've followed the instructions in gitian-building.md and verified that +you have the same hashes as other developers, it's time to sign the gitian +builds. + +## PGP fingerprints of gitian build signers + +The `contrib/gitian-signing/keys.txt` file contains the PGP fingerprints of +gitian build signers. If you plan on signing gitian builds on a regular basis, +please add you fingerprint here. + +TODO: Add reference to gitian keys process instructions once that document is +written. It should be clear to signers that there are expectations associated +with the siginging process and that it's unacceptable to blindly sign builds. + +## Sign your gitian builds + +TODO: Add scripts and instructions for checking for revoked keys and signing builds. +For now, refer to `contrib/check-keys.sh` for retrieving all signing keys.