nicweyand/argand-site-registry
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

security: harden registry trust and ingestion
All checks were successful
Standalone registry checks / check (push) Successful in 3m47s
Details

Browse source
This commit is contained in:
Nic Weyand 2026-09-13 02:31:51 -04:00
commit 9705b01fe4
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
25 changed files with 846 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/PUBLISHING.md
View file

@ -14,6 +14,12 @@ one accepted principal and public key per line:
operator@example.org ssh-ed25519 REVIEWER_PUBLIC_KEY
```
For rotation, retain an old public key with an OpenSSH `valid-before` option
covering its signed decision times. New decisions are checked at append time, so
an expired key cannot submit backdated reviews; historical release verification
uses each authenticated `reviewed_at`. Remove a retired key only after no retained
generation or review log depends on it.
Distribute the release publisher public key to consumers through an independent
authenticated channel. Do not put private keys, production trust files or source
datasets in Git or CI. The isolated source CI runner has none of these files.
@ -62,6 +68,7 @@ argand-site-registry sign --generation /data/registry/reviewed \
argand-site-registry activate --generation /data/registry/reviewed \
--current /data/registry/current.json \
--allowed-signers /secure/release-allowed-signers \
--allowed-reviewers /secure/reviewer-allowed-signers \
--identity registry-publisher
```