From 189bb091649e888deabeb0c287ff15238ecba3ad Mon Sep 17 00:00:00 2001 From: marco-ippolito Date: Thu, 28 Mar 2024 19:16:33 +0100 Subject: [PATCH 1/2] doc: add release key for marco-ippolito --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 5206c7daf40876..ce7ca8cceb43ce 100644 --- a/README.md +++ b/README.md @@ -763,6 +763,8 @@ Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys): `74F12602B6F1C4E913FAA37AD3A89613643B6201` * **Juan José Arboleda** <> `DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7` +* **Marco Ippolito** <> + `CC68F5A3106FF448322E48ED27F5E38D5B0A215F` * **Michaël Zasso** <> `8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600` * **Myles Borins** <> @@ -784,6 +786,7 @@ gpg --keyserver hkps://keys.openpgp.org --recv-keys 4ED778F539E3634C779C87C6D706 gpg --keyserver hkps://keys.openpgp.org --recv-keys 141F07595B7B3FFE74309A937405533BE57C7D57 gpg --keyserver hkps://keys.openpgp.org --recv-keys 74F12602B6F1C4E913FAA37AD3A89613643B6201 gpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 +gpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 gpg --keyserver hkps://keys.openpgp.org --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 From fdb3bd426d91c415263909cce92724ec39953baf Mon Sep 17 00:00:00 2001 From: marco-ippolito Date: Thu, 28 Mar 2024 19:08:48 +0100 Subject: [PATCH 2/2] doc: update release gpg keyserver --- doc/contributing/releases.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md index db0d4552e41ea4..2e4a1d2c1faf93 100644 --- a/doc/contributing/releases.md +++ b/doc/contributing/releases.md @@ -90,10 +90,11 @@ responsible for that release. In order to be able to verify downloaded binaries, the public should be able to check that the `SHASUMS256.txt` file has been signed by someone who has been authorized to create a release. -The GPG keys should be fetchable from a known third-party keyserver. The SKS -Keyservers at are recommended. Use the -[submission](https://pgp.mit.edu/) form to submit a new GPG key. You'll need to -do an ASCII-armored export of your key first: +The public keys should be fetchable from a known third-party keyserver. +The OpenPGP keyserver at is recommended. +Use the [submission](https://keys.openpgp.org/upload) form to submit +a new public key, and make sure to verify the associated email. +You'll need to do an ASCII-armored export of your key first: ```bash gpg --armor --export email@server.com > ~/nodekey.asc @@ -102,7 +103,7 @@ gpg --armor --export email@server.com > ~/nodekey.asc Keys should be fetchable via: ```bash -gpg --keyserver pool.sks-keyservers.net --recv-keys +gpg --keyserver hkps://keys.openpgp.org --recv-keys ``` The key you use may be a child/subkey of an existing key.