freedomofpress / freedomofpress/securedrop-https-everywhere-ruleset
Switch signing to standalone ed25519 key
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 11
- Forks
- 4
- Avg merge
- 8m
- Merged PRs (30d)
- 7
Description
Currently we sign this repository using a RSA key in PEM format that just so happens to use the same set of random bytes as our 2021 Release Signing Key, which is an rsa4096 PGP key.
We're rotating our PGP signing key (https://securedrop.org/news/new-release-signing-key/), so we should move away from the current RSA key. We've also separately generated a standalone ed25519 key that we could end up using for this signing process.
We need to figure out the exact signing story, but once we're ready we should sign the current ruleset in parallel and work upstream with Tor Browser to get the configuration updated.
Possibly linked to #269.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by tracing how the current RSA PEM key signs the ruleset, then review #269 and Tor Browser's configuration requirements; done means selecting the signing approach, signing the current ruleset in parallel, and coordinating the upstream configuration update.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100