Adding upstream version 2023.12.24.upstream/2023.12.24

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 109 insertions, 0 deletions

diff --git a/cheatsheets/keyring/updating_dd_key.txt b/cheatsheets/keyring/updating_dd_key.txt
new file mode 100644
index 0000000..46f4456
--- /dev/null
+++ b/cheatsheets/keyring/updating_dd_key.txt
@@ -0,0 +1,109 @@
+Updating a DD key
+=================
+
+- Key updates should be for a reason (i.e. lost control of earlier
+  key, or moving to stronger key).
+
+- Request must include:
+  - Old key (full fingerprint)
+  - New key (full fingerprint)
+  - Inline signature with OLD key
+
+- New key must be signed by at least two DDs (and more if possible);
+  if the old key is particularly well connected, we have requested the
+  person to get more signatures in order to avoid weakening the
+  overall web of trust. The new key must also be signed with the old
+  one (except in cases, say, where the old one was lost).
+
+- Procedure
+
+  I am following the request for Giovanni Mascellani (RT #2473). Of
+  course, replace keys with adequate values. As you can see, this
+  request mentioned only the key IDs, so full fingerprint was
+  requested. 
+
+      # Before anything else, retrieve both keys, to be able to do the
+      # following checks
+  $ gpg --keyserver $KEYSERVER --recv-key \
+      1EB63D43E2014DDF67BD003FFCB0BB5C5F1FBF70 \
+      82D119A840C6EFCA6F5AF9459EDCC991D9AB457E
+  gpg: requesting key 5F1FBF70 from hkp server nisamox.fciencias.unam.mx
+  gpg: requesting key D9AB457E from hkp server nisamox.fciencias.unam.mx
+  gpg: key 5F1FBF70: public key "Giovanni Mascellani (Poisson)
+        # <mascellani@poisson.phc.unipi.it>" imported
+  gpg: key D9AB457E: public key "Giovanni Mascellani
+        # <mascellani@poisson.phc.unipi.it>" imported
+  gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
+  gpg: depth: 0  valid:   3  signed: 163  trust: 0-, 0q, 0n, 0m, 0f, 3u
+  gpg: depth: 1  valid: 163  signed: 409  trust: 154-, 0q, 0n, 5m, 4f,
+        # 0u
+  gpg: depth: 2  valid:  12  signed:  99  trust: 12-, 0q, 0n, 0m, 0f, 0u
+  gpg: next trustdb check due at 2010-09-10
+  gpg: Total number processed: 2
+  gpg:               imported: 2  (RSA: 1)
+
+  $ gpg --verify < (copy of RT message)
+  (...)
+  gpg: Signature made Sun 29 Aug 2010 07:30:03 AM CDT using RSA key ID E1889B00
+  gpg: Good signature from "Giovanni Mascellani (Poisson) <mascellani@poisson.phc.unipi.it>"
+  gpg:                 aka "Giovanni Mascellani <gio@debian.org>"
+  gpg:                 aka "Giovanni Mascellani <g.mascellani@gmail.com>"
+  gpg:                 aka "Giovanni Mascellani <g.mascellani@tiscali.it>"
+  gpg:                 aka "Giovanni Mascellani (DM) <mascellani@mail.dm.unipi.it>"
+  gpg:                 aka "Giovanni Mascellani (SNS) <giovanni.mascellani@sns.it>"
+  gpg:                 aka "[jpeg image of size 8171]"
+  gpg: WARNING: This key is not certified with a trusted signature!
+  gpg:          There is no indication that the signature belongs to the owner.
+  Primary key fingerprint: 1EB6 3D43 E201 4DDF 67BD  003F FCB0 BB5C 5F1F BF70
+       Subkey fingerprint: 409F 2383 802D B40C CA04  9AF9 810A 9F69 E188 9B00
+
+  - Helper script
+
+    We have a script called "replace-key". When called, it takes care to
+    do all of the steps described from here until the commit step.
+
+    You should call it using both keys' long (64 bit) keyids:
+
+    $ ./script/replace-key FCB0BB5C5F1FBF70 9EDCC991D9AB457E
+
+
+  $ gpg --export D9AB457E > /tmp/key
+      # DD keys (past and present), names and identities are kept in
+      # the plaintext file 'keyids' - Confirm and get the requester's
+      # Debian account name in case it's not listed as one of the
+      # identities 
+
+  $ grep 5F1FBF70 keyids 
+  0xFCB0BB5C5F1FBF70 Giovanni Mascellani <gio>
+      # Old keys are removed from the repository.
+
+  $ git rm debian-keyring-gpg/0xFCB0BB5C5F1FBF70
+  rm 'debian-keyring-gpg/0xFCB0BB5C5F1FBF70'
+
+  $ ./scripts/add-key /tmp/key debian-keyring-gpg/
+      # A screen listing all of the requester's signatures which are
+      # in the Debian keyring appears. At very least, two DD should
+      # have signed his key, unless specific reasons
+      # (i.e. geographical) have been already discussed. Take note of
+      # the respective key IDs. If they are too many, just note the
+      # first four or five, in this case: F2C423BC 33FC40A4.
+      # Also take note that the old key (5F1FBF70) has also signed
+      # it. 
+  Are you sure you want to update this key? (y/n)
+  y
+  adding debian-keyring-gpg/0x9EDCC991D9AB457E
+  Enter full name of new key: Giovanni Mascellani
+  Enter Debian login of new key: gio
+
+      # Note this addition in debian/changelog - Just make sure before
+      # doing this you are not modifying an already uploaded changelog
+      # entry! 
+  $ dch -a 'Replace 0xFCB0BB5C5F1FBF70 with 0x9EDCC991D9AB457E (Giovanni Mascellani) (RT #2473)'
+
+- Git commit
+
+  In order for the parse-git-changelog script to work, we adhere to
+  machine-parsable information in the changelog. If you used the
+  replace-key script, you will find it creates a git-commit-template
+  file. It just needs you to fill in the Debian user IDs for the
+  New-key-certified-by field.