mirror of
https://github.com/dashpay/dash.git
synced 2024-12-25 12:02:48 +01:00
Merge #12822: Revert 7deba93bdc
and fix expired-key-sigs properly
9471576
[verify-commits] Add some additional useful documentation. (Matt Corallo)de7e931
Add Marco-expired-key-signed-commits to allow-revsig-commits (Matt Corallo)99f6d48
Revert "test: Update trust git root". (Matt Corallo) Pull request description:7deba93bdc
was took the wrong approach to updating verify-commits for a key expiration. Namely, adding each commit to allow-revsig-commits should have been done instead, allowing them to still be validated, but with the expired key. Tree-SHA512: 9fdc67eda8f6daa95082f6c1a2af81beb730a9ff3f8cf930bb2311fe29b5f05e1f89259aba5f112153ca2e9c62577cf60d31b4c8e9ac1bf3f5506e78f8401378 Signed-off-by: pasta <pasta@dashboost.org> # Conflicts: # contrib/verify-commits/allow-revsig-commits
This commit is contained in:
parent
188bb7b628
commit
568b7e1c0c
@ -24,3 +24,24 @@ keys:
|
||||
Note that the above isn't a good UI/UX yet, and needs significant improvements
|
||||
to make it more convenient and reduce the chance of errors; pull-reqs
|
||||
improving this process would be much appreciated.
|
||||
|
||||
Configuration files
|
||||
-------------------
|
||||
|
||||
* `trusted-git-root`: This file should contain a single git commit hash which is the first unsigned git commit (hence it is the "root of trust").
|
||||
* `trusted-sha512-root-commit`: This file should contain a single git commit hash which is the first commit without a SHA512 root commitment.
|
||||
* `trusted-keys`: This file should contain a \n-delimited list of all PGP fingerprints of authorized commit signers (primary, not subkeys).
|
||||
* `allow-revsig-commits`: This file should contain a \n-delimited list of git commit hashes. See next section for more info.
|
||||
|
||||
Key expiry/revocation
|
||||
---------------------
|
||||
|
||||
When a key (or subkey) which has signed old commits expires or is revoked,
|
||||
verify-commits will start failing to verify all commits which were signed by
|
||||
said key. In order to avoid bumping the root-of-trust `trusted-git-root`
|
||||
file, individual commits which were signed by such a key can be added to the
|
||||
`allow-revsig-commits` file. That way, the PGP signatures are still verified
|
||||
but no new commits can be signed by any expired/revoked key. To easily build a
|
||||
list of commits which need to be added, verify-commits.sh can be edited to test
|
||||
each commit with BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG set to both 1 and 0, and
|
||||
those which need it set to 1 printed.
|
||||
|
Loading…
Reference in New Issue
Block a user