Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Switch package signing key #579

Open
kenhys opened this issue Aug 30, 2023 · 0 comments · May be fixed by #580
Open

Switch package signing key #579

kenhys opened this issue Aug 30, 2023 · 0 comments · May be fixed by #580
Milestone
5.1.0 (T.B.D.)

Comments

@kenhys
Copy link
Contributor

kenhys commented Aug 30, 2023 •
edited

Problem

Currently, we can't switch signing key yet.

Expected

Switch package signing key after releasing fluent-package v5 series.

Fluentd developers (Fluent Package Official Signing Key)
B40948B6A3B80E90F40E841F977D7A0943FA320E

Background

When releasing fluent-package v5.0.0, v5.0.1, we still use with old signing key because existing td-agent user can upgrade by
even though manually editing apt-line fluentd.sources.

https://github.com/fluent/fluent-package-builder/blob/master/fluent-package/manage-fluent-repositories.sh#L36

  • If user install package via install script, new signing key is also installed.
    • deb: /usr/share/keyrings/fluent-archive-keyring.gpg
    • rpm: import via gpg --import (old and new key)

So switching signing key affects only existing td-agent users who manually point to fluent-package apt line.
kenhys added a commit to kenhys/fluent-package-builder that referenced this issue Aug 30, 2023
@kenhys
deb: switch package signing key
9e72b53 
Before:

  Treasure Data, Inc (Treasure Agent Official Signing key)

After:

  Fluentd developers (Fluent Package Official Signing Key)

Closes: fluent#579

Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>
kenhys added a commit to kenhys/fluent-package-builder that referenced this issue Aug 30, 2023
@kenhys
deb: switch package signing key
b952d67 
Switch signing key when fluent-apt-source package
was installed to most of machines.

As we can't measure such a metrics, just switch after a while.
(It is important to determine "WHEN" we should switch to.

Before:

  Treasure Data, Inc (Treasure Agent Official Signing key)

After:

  Fluentd developers (Fluent Package Official Signing Key)

Closes: fluent#579

Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>
@kenhys kenhys linked a pull request Aug 30, 2023 that will close this issue
Draft
@kenhys kenhys added this to the 5.1.0 milestone Feb 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
Fluentd Kanban
Status: LTS WIP
Milestone
5.1.0 (T.B.D.)
Development

Successfully merging a pull request may close this issue.

deb: switch package signing key kenhys/fluent-package-builder
1 participant
@kenhys