feat: Setup code signing for all packages using opgenpgp

[dignifiedquire]

Update: Added process references
Update: Added sha512 checksums

I've setup a pgp on my yubikey that is used for the code signing process. This process generates pgp signatures for every single tar/zip file and adds them to directory. As in the description explained they can be verified by running

$ gpg --verify file.tar.gz.asc file.tar.gz

if the key is present.

Ref ipfs/kubo#957

References

• The distribution of keys is modeled after https://developers.yubico.com/Software_Projects/Software_Signing.html
• The signature generation is modeled after the release signing process of the apache foundation: https://www.apache.org/dev/release-signing.html

Key Management

Setup

• Every developer (currently me) who has the right to sign releases generates a pgp key, stored on dedicated hardware like a yubikey
• The fingerprint is added to dist.ipfs.io
• The public key is uploaded to https://pgp.mit.edu/ for ease of distribution

Verification

• The user who downloads from dist.ipfs.io can fetch the listed public keys listed from https://pgp.mit.edu/ and add them to their keyring
• The user downloads the signature + file
• The user uses pgp + signature to verify the file

Checksums

In addition to the signatures there are also file.sha files containing the sha512 checksum of the packages.

[dignifiedquire]

cc @jbenet @whyrusleeping

[Kubuxu]

It would be better to have full fingerprint here. Short ones are not so good any more.

[dignifiedquire]

sure, curious why are they not good anymore?

[Kubuxu]

There is a list of keys for all short fingerprints generated, if someone will not look at the name and email there is a chance he will download a wrong one from the keyserver.

[dignifiedquire]

thanks @Kubuxu will update with this in mind

[jbenet]

Would be nice to have multiple sigs here (like say @whyrusleeping and i both signing off to a release)

[jbenet]

@dignifiedquire thank you for leading the charge here! 👍 ❤️

[dignifiedquire]

@jbenet yes need more sigs for sure, but I don't have yours lying around ;) So @jbenet @whyrusleeping please make a PR adding your sigs in here, preferably from a key on your yubikey

[whyrusleeping]

guide: https://www.yubico.com/2012/12/yubikey-neo-openpgp/

[dignifiedquire]

TODO from my side, write up general strategy for review

[dignifiedquire]

@jbenet added first draft of a security doc describing the different parts.

[dignifiedquire]

I know that generally keys above 4096 should be used, but right now I haven't found a way to generate those keys on my yubikey. So if someone knows how please let me know and we can increase this.

[Kubuxu]

Only Yubikey 4 and 4 Nano support RSA 4096 and even not all of them IIRC.

[Kubuxu]

We use Neo which supports only 2048.

[RichardLitt]

LGTM.

[jbenet]

use "archive"

[djdv]

Recently, there has been discussion in other repos about creating source tarballs that could be built offline due to various connection issues (lost hash, geographic censorship).
ipfs/ipget#48 (comment)
ipfs/kubo#4765 (comment)

These releases will have to be signed for user saftey if they are to be ferried by third parties across various boundaries. As such, I simply want to pulse an alert on this issue due to its age and significance.
@whyrusleeping @Kubuxu

[hsanjuan]

@Stebalien should we pick this up?

[Stebalien]

That would be awesome! Note: I think a higher priority is a way to update dists without having to fetch and re-add everything if you're looking to improve dists.

[Stebalien]

Closing as stale.