StackStorm/st2-packages

Sign packages, turn on GPG verification

Open

#303 opened on May 24, 2016

View on GitHub
 (5 comments) (0 reactions) (0 assignees)Shell (63 forks)auto 404
featurehelp wantedsecurity

Repository metrics

Stars
 (28 stars)
PR merge metrics
 (PR metrics pending)

Description

According to packagecloud, they only sign the package meta. The gpg verify is turned off on packages explicitly. I think we need to start signing those packages via st2-packages before shipping it to packagecloud. We also need to add a step in install script to download st2 gpg keys and install it. Also, figure out how to turn on gpg verification with packagecloud.

[StackStorm_stable]
name=StackStorm_stable
baseurl=https://packagecloud.io/StackStorm/stable/el/7/$basearch
repo_gpgcheck=1
gpgcheck=0
enabled=1
gpgkey=https://packagecloud.io/StackStorm/stable/gpgkey
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt

[StackStorm_stable-source]
name=StackStorm_stable-source
baseurl=https://packagecloud.io/StackStorm/stable/el/7/SRPMS
repo_gpgcheck=1
gpgcheck=0
enabled=1
gpgkey=https://packagecloud.io/StackStorm/stable/gpgkey
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt

Contributor guide

Research direction
Study the st2 packages build process, identify where packages are built and uploaded to packagecloud. Implement GPG signing of packages before upload, generate or import a GPG key, and modify the install script to download the key and set gpgcheck=1 in the repository configuration. Test the installation with GPG verification enabled.
Tech stack
shell
Domain
devopssecurityinfrastructure
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitShell scripting
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40