OpenSAML v4.0.1 Artifacts in Central Repository

[Cantor, Scott]

On 4/23/21, 5:54 PM, "dev on behalf of Cris Rockwell" <dev-bounces at shibboleth.net on behalf of cmrockwe at umich.edu> wrote:

>    After adding a plugin (pgpverify-maven-plugin) which checks dependency signatures, I have to agree. 

I really don't know how "close" it is to a working solution, but last I knew we were looking into forking it and adding some features to reach a state where it might be viable.

>    The plugin provides a warning...

Right. Checking a signature means nothing unless you trust the key, which can't be "in band". And with the lack of discipline around use of PGP with software, it's a difficult thing to really rely on. Our plan was to allow this with artifacts that seemed to have disciplined key practices and probably handle the rest ourselves as we have been, but we just haven't picked it back up.

>    So, I would actually like to provide a key mapping for the OpenSAML library and clear that warning. 
>    Do you have a list of public key fingerprints for devs that sign your artifacts?

We have *a* file, but I think we would probably be willing to go a bit farther and actually maintain such a file going forward if you're willing to give a leg up and get an initial one built.

Our keys file is here:
https://shibboleth.net/downloads/PGP_KEYS

Other than the OBS security:shibboleth RPM repository key, which wouldn't ever apply to this, that's pretty much the set.

We have a new process that generates that file now based on a git repo with the keys. If we can get a keymap to look at, I would think maybe we could extend that process to produce it. Maybe not tomorrow, but we can at least put it in the queue. The least we can do is facilitate the right practices.

-- Scott