autinerd/keys
1
0
Fork 0
forked from infra/keys
Code Pull requests Activity

simplify meta format and expand documentation

Browse source
This commit is contained in:
kleines Filmröllchen 2025-01-28 22:49:33 +01:00
parent eff2adaafc
commit 699a4fbde2
Signed by: filmroellchen
SSH key fingerprint: SHA256:NarU6J/XgCfEae4rbei0YIdN2pYaYDccarK6R53dnc8
2 changed files with 15 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
README.md
View file

@ -4,7 +4,7 @@ SSH Key verification (Experimental Tests)
## Verified cryptographic keys for use with CTBK infrastructure
This repo holds all SSH keys and wireguard keys for sysadmins of the Chaostreff Backnang infrastructure. It is a simple database of all valid cryptographic keys, with verification (i.e. signatures) that they have been supplied by their owner.
This repo holds all SSH keys and Wireguard keys for sysadmins of the Chaostreff Backnang infrastructure. It is a simple database of all valid cryptographic keys, with verification (i.e. signatures) that they have been supplied by their owner.
The workflow roughly goes like this, with detailed explanations further below:
@ -30,7 +30,7 @@ Add your SSH key(s) to your Forgejo account:
Repeat this for at least every key you plan to use for signing, _not necessarily_ every key you want to commit to the repository.
Make sure every email address you want to use with Git (see below) has been added to your profile. This is possible under the “Account” tab in the settings.
Make sure every email address you want to use with Git (see below) has been added to your profile. This is possible under the “Account” tab in the settings. Note that neither Forgejo nor CI check whether that address actually exists, so feel free to use a made-up noreply address such as `username.noreply@chaostreff-backnang.de`.
### Git setup
@ -65,16 +65,23 @@ The CI will run on your PR and verify the changes have been signed by the correc
Pull requests are merged by Git merge, which preserves the signing status. The CI should check out on main as well; otherwise, some user’s key data in Forgejo may have changed. These users must be notified ASAP so they remove their outdated keys and add new keys if they want to keep their verified data. Worst case, the files can be removed, removing them from the verification.
### Signed user files
## Signed user files
There are only two mandatory files in your user directory: `keys` and `meta.toml`.
### `keys`
`keys` is simply your list of SSH public keys. Any key you use to sign commits in this repository must be part of that key list. This is to provide extra verification that you didn’t commit wrong keys on accident.
### `meta.toml`
`meta.toml` provides metadata in TOML format. Not all of this metadata is currently checked (or required), but please stick to the format in case we decide to automate more parts of it in the future.
| Option | Type | Explanation |
| ------- | ---------------- | ---------------------------------------------------------------------------- |
| `name` | string | User name, must match the committer name and Forgejo name. |
| `email` | string | Email address, must match the committer email address. |
| `teams` | array of strings | All administrative teams (i.e. services) that the user is currently part of. |
| Option | Type | Explanation |
| ------- | ------ | ---------------------------------------------------------- |
| `name` | string | User name, must match the committer name and Forgejo name. |
| `email` | string | Email address, must match the committer email address. |
### `wireguard`
This optional file contains only your Wireguard public key. The public key is used for connecting to the Chaostreff VPN.

2
filmroellchen/meta.toml
View file

@ -1,4 +1,2 @@
name = "filmroellchen"
email = "kleines@filmroellchen.eu"
teams = ["mediawiki", "forgejo-actions"]