]> git.decadent.org.uk Git - dak.git/blob - web/keys.html
Merge commit 'lamby/master' into merge
[dak.git] / web / keys.html
1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
2 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
3     <head>
4         <meta http-equiv="content-type" content="text/xhtml+xml; charset=utf-8"
5         />
6         <title>ftp-master.debian.org Archive Signing Keys</title>
7         <link type="text/css" rel="stylesheet" href="removals-style.css" />
8         <link rel="shortcut icon" href="http://www.debian.org/favicon.ico" />
9     </head>
10     <body>
11         <div id="logo">
12             <a href="http://www.debian.org/">
13                 <img src="http://www.debian.org/logos/openlogo-nd-50.png"
14                 alt="debian logo" /></a>
15             <a href="http://www.debian.org/">
16                 <img src="http://www.debian.org/Pics/debian.png"
17                 alt="Debian Project" /></a>
18         </div>
19
20         <div id="titleblock">
21             <img src="http://www.debian.org/Pics/red-upperleft.png"
22             id="red-upperleft" alt="corner image"/>
23             <img src="http://www.debian.org/Pics/red-lowerleft.png"
24             id="red-lowerleft" alt="corner image"/>
25             <img src="http://www.debian.org/Pics/red-upperright.png"
26             id="red-upperright" alt="corner image"/>
27             <img src="http://www.debian.org/Pics/red-lowerright.png"
28             id="red-lowerright" alt="corner image"/>
29             <span class="title">
30                 Archive Signing Keys
31             </span>
32         </div>
33         <div id="outer">
34         <div id="inner">
35         <div id="leftcol">
36                 <ul>
37                         <li><a href="/index.html">Main FTP Page</a></li>
38                 </ul>
39         </div>
40
41         <div id="maincol">
42         <div id="intro">
43             <p>This page contains information on the current and past archive
44             signing keys.  The release files are signed by an automatic archive
45             signing key in order to allow verification that software being downloaded
46             has not been interfered with.</p>
47
48             <p>Please note that as this page is not available by a secure
49             mechanism (for instance https), you cannot rely on keys or information
50             available here for verification purposes.  The details here are
51             for information only.</p>
52
53             <h2>Which release should be signed with which key?</h2>
54             <p>Stable releases are signed by both the ftp-master automatic archive signing
55             key in use at the time of the release, and a per-release stable key.  Release
56             files for other releases (proposed-updates, testing, testing-proposed-updates,
57             unstable and experimental) are signed only by the ftp-master automatic key.</p>
58
59             <p>The security archive is signed by the normal ftp-master key only.</p>
60
61             <p>The current procedure is that there is one ftp-master key per
62             release (former procedure introduced a new key once per year).</p>
63
64         </div>
65
66         <div id="archivekey">
67             <h1>Archive Keys</h1>
68             <h2>Active Signing Keys</h2>
69
70                   <p>The current (2009/lenny) key can be <a
71             href="/keys/archive-key-5.0.asc">downloaded here</a><br/>
72                   The fingerprint of this key is <tt>150C 8614 919D 8446 E01E  83AF 9AA3 8DCD 55BE 302B</tt>.<br/>
73                   The announcements regarding this key can be read at
74             <a href="http://lists.debian.org/debian-devel-announce/2009/01/msg00008.html">
75                   http://lists.debian.org/debian-devel-announce/2009/01/msg00008.html
76                   </a> and <a href="http://www.debian.org/News/2009/20090523">http://www.debian.org/News/2009/20090523</a>.
77                   </p>
78
79                   <p>The soon-to-be-retired (2007/etch) key can be <a
80             href="/keys/archive-key-4.0.asc">downloaded here</a>.<br/>
81                   The fingerprint of this key is <tt>A999 51DA F9BB 569B DB50  AD90 A70D AF53 6070 D3A1</tt></p>
82
83             <h2>Stable Keys</h2>
84             <h3>etch</h3>
85             <p>The fingerprint of the etch stable release key is <tt>7EA3 91D7 2477 203B 58C0  4FBC B5D0 C804 ADB1 1277</tt></p>
86
87             <h3>lenny</h3>
88             <p>The fingerprint of the lenny stable release key is <tt>7F5A 4445 4C72 4A65 CBCD  4FB1 4D27 0D06 F425 84E6</tt></p>
89
90             <h2>Retired Signing Keys</h2>
91             <p>The following retired and in most cases expired keys are
92             available.  <b>Note that these keys are no longer in use and are
93             listed here for reference purposes only</b>:
94                 <ul>
95                 <li><a href="/keys/ziyi_key_2002.asc">/keys/ziyi_key_2002.asc</a></li>
96                 <li><a href="/keys/ziyi_key_2003.asc">/keys/ziyi_key_2003.asc</a></li>
97                 <li><a href="/keys/ziyi_key_2003v2.asc">/keys/ziyi_key_2003v2.asc</a></li>
98                 <li><a href="/keys/ziyi_key_2004.asc">/keys/ziyi_key_2004.asc</a></li>
99                 <li><a href="/keys/ziyi_key_2005.asc">/keys/ziyi_key_2005.asc</a></li>
100                 <li><a href="/keys/ziyi_key_2006.asc">/keys/ziyi_key_2006.asc</a></li>
101                 </ul>
102
103             </p>
104         </div>
105
106         <div id="replacement">
107             <h1>Key Replacement Procedure</h1>
108
109             <p>When the archive key is to be replaced, a new key will be generated by one of the
110             ftpmasters.  This key will then be signed by that ftpmaster and other ftpmasters and
111             members of the ftpteam (including verification by phone call of the fingerprint and
112             other details of the key to be signed).</p>
113
114             <p>Once the new key is prepared, it will be placed on this page, put into the relevant
115             archive packages and announced to debian-devel-announce well in advance of being used.</p>
116
117         </div>
118
119         <div id="revokation">
120             <h1>Key Revocation Procedure</h1>
121             <p>A revokation certificate for the archive key is produced at the time of the creation
122             of an archive key.  The program gfshare (package
123                   <a href="http://packages.debian.org/lenny/libgfshare-bin">libgfshare-bin</a>)
124                     (a Shamir's secret sharing scheme implementation) is then used to produce 12 shares of
125                     which 7 are needed to recover the revokation cert.
126             This procedure is for use in emergencies only (such as losing ftp-master.debian.org and
127             all of the backups, a hopefully unlikely event) as the key can normally be used to produce
128             its own revokation certificate.</p>
129         </div>
130
131                 <div id="keysplit">
132                   <h1>Key Backup / Restore Procedure</h1>
133                   <p>After the creation of the archive key, the secret part of it will be backed up in one additional
134                   way. The program  gfshare (package
135                   <a href="http://packages.debian.org/lenny/libgfshare-bin">libgfshare-bin</a>)
136                   (a Shamir's secret sharing scheme implementation) is used to produce 14 shares of which 9 are needed
137                   to recover the secret key.</p>
138         </div>
139
140                 <div id="ssss">
141                   <h1>SSSS holders</h1>
142                   <p>The following people each hold one of the shares of the revocation certificate / private key.</p>
143                   <h2>Revocation shares</h2>
144                   <p>7 of those shares are needed to reproduce the revocation certificate</p>
145                   <table>
146                         <tr><th>Debian uid</th><th>Name</th></tr>
147                         <tr><td>sho</td><td>Samuel Hocevar</td></tr>
148                         <tr><td>don</td><td>Don Armstrong</td></tr>
149                         <tr><td>neilm</td><td>Neil McGovern</td></tr>
150                         <tr><td>djpig</td><td>Frank Lichtenheld</td></tr>
151                         <tr><td>jimmy</td><td>Jimmy Kaplowitz</td></tr>
152                         <tr><td>killer</td><td>Kalle Kivimaa</td></tr>
153                         <tr><td>noodles</td><td>Jonathan McDowell</td></tr>
154                         <tr><td>rra</td><td>Russ Allbery</td></tr>
155                         <tr><td>marga</td><td>Margarita Manterola</td></tr>
156                         <tr><td>thijs</td><td>Thijs Kinkhorst</td></tr>
157                         <tr><td>meike</td><td>Meike Reichle</td></tr>
158                         <tr><td>miriam</td><td>Miriam Ruiz</td></tr>
159                   </table>
160
161                   <h2>Key shares</h2>
162                   <p>9 of those shares are needed to reproduce the secret key</p>
163                   <table>
164                         <tr><th>Debian uid</th><th>Name</th></tr>
165                         <tr><td>luk</td><td>Luk Claes</td></tr>
166                         <tr><td>maxx</td><td>Martin Wuertele</td></tr>
167                         <tr><td>adeodato</td><td>Adeodato Simó</td></tr>
168                         <tr><td>myon</td><td>Christoph Berg</td></tr>
169                         <tr><td>93sam</td><td>Steve McIntyre</td></tr>
170                         <tr><td>bdale</td><td>Bdale Garbee</td></tr>
171                         <tr><td>sgran</td><td>Stephen Gran</td></tr>
172                         <tr><td>dannf</td><td>Dann Frazier</td></tr>
173                         <tr><td>weasel</td><td>Peter Palfrader</td></tr>
174                         <tr><td>enrico</td><td>Enrico Zini</td></tr>
175                         <tr><td>wouter</td><td>Wouter Verhelst</td></tr>
176                         <tr><td>mhy</td><td>Mark Hymers</td></tr>
177                         <tr><td>bzed</td><td>Bernd Zeimetz</td></tr>
178                         <tr><td>stew</td><td>Mike O'Connor</td></tr>
179                 </table>
180                 </div>
181     <hr />
182     <address><a href="mailto:ftpmaster@ftp-master.debian.org">Debian FTP team</a></address>
183
184     </body>
185 </html>