Commits on Jul 18, 2022

1. Remove operational and mirror keys from bootstrap key set …

   The list of keys passed to the Hackage Security setup should be the
   bootstrap root keys, rather than all keys used.
   
   There are three kinds of keys used with Hackage Security today:
   
    * root keys, which are the community roots of trust, kept offline and
      distributed among trusted community members,
   
    * operational keys, which are kept in memory on Hackage and used for
      ongoing cryptographic signatures of the timestamp file and index,
   
    * and mirror keys, which are used to sign the mirror list.
   
   Tools that wish to interact with Hackage need to carry a bootstrap set
   of root keys to solve the chicked-and-egg problem. These are five root
   keys that are implicitly trusted. These keys are used to sign
   root.json in Hackage, which then specifies which additional keys are
   available and used. The list here, however, contains all the keys,
   rather than just the bootstrap root keys.

   

   david-christiansen committed Jul 18, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for 78d3cdc
   • Browse repository at this point

   Copy the full SHA

   78d3cdc View commit details

   Browse the repository at this point in the history