From c11771efc0786f19dfc4f0c47a1532dc17c021ac Mon Sep 17 00:00:00 2001 From: Vishal Seshadri Date: Fri, 11 Apr 2025 10:24:52 -0700 Subject: [PATCH 1/2] add(scribe-key): add scribe public key to software_signing --- content/Software_Projects/Software_Signing.adoc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/Software_Projects/Software_Signing.adoc b/content/Software_Projects/Software_Signing.adoc index ee9298aa..2b1ce6a3 100644 --- a/content/Software_Projects/Software_Signing.adoc +++ b/content/Software_Projects/Software_Signing.adoc @@ -9,6 +9,13 @@ Source code releases are usually signed by an OpenPGP key of one of Yubico's developers. Some ZIP files containing Windows executables are also signed using OpenPGP. +We're undertaking an effort to slowly move away from signing with individual +developer's OpenPGP key towards a single organization wide OpenPGP key. New releases +will start including signatures using the following key: + +-[PROD] Yubico Scribe GPG Signing Key +link:https://keys.openpgp.org/search?q=2D5641876C74EC9CB8A6FF43062BC0D272DC7CB1[`2D56 4187 6C74 EC9C B8A6 FF43 062B C0D2 72DC 7CB1`] + Following are the keys for Yubico developers who are currently releasing code. - Klas Lindfors From 1e0a88dfcabbcba353604c81718ebbaa8dc7a8dc Mon Sep 17 00:00:00 2001 From: Vishal Seshadri Date: Fri, 11 Apr 2025 13:41:23 -0700 Subject: [PATCH 2/2] update(scribe-key): add scribe public key to software signing page --- content/Software_Projects/Software_Signing.adoc | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/content/Software_Projects/Software_Signing.adoc b/content/Software_Projects/Software_Signing.adoc index 2b1ce6a3..3c99d825 100644 --- a/content/Software_Projects/Software_Signing.adoc +++ b/content/Software_Projects/Software_Signing.adoc @@ -5,13 +5,9 @@ We use three different techniques to achieve this. === OpenPGP Software Signing -Source code releases are usually signed by an OpenPGP key of one of -Yubico's developers. Some ZIP files containing Windows executables are -also signed using OpenPGP. +Source code releases are usually signed by an OpenPGP key of one of Yubico's developers or the centrally managed OpenPGP key. Some ZIP files containing Windows executables are also signed using OpenPGP. -We're undertaking an effort to slowly move away from signing with individual -developer's OpenPGP key towards a single organization wide OpenPGP key. New releases -will start including signatures using the following key: +Yubico's centrally managed OpenPGP key: -[PROD] Yubico Scribe GPG Signing Key link:https://keys.openpgp.org/search?q=2D5641876C74EC9CB8A6FF43062BC0D272DC7CB1[`2D56 4187 6C74 EC9C B8A6 FF43 062B C0D2 72DC 7CB1`]