Threshold signing for releases #20977

For signing the SHA256SUMS.asc in the distribution I would like to move away from using a signing key that I solely, personally possess. I'm not entirely sure how, threshold signing is only a possibility there might be others.

I think it would be ideal if we could distribute the process over multiple people, like a M out of N scheme. For example, a few (relatively) trusted gitian builders.

The resulting signature should ideally be verifiable in the same way as it is now (with gnupg), getting people to adapt a custom tool for validation is going to be difficult.

Concept ACK

Accumulating the signatures in the SUMS file itself would be easier to implement, but I guess moves more responsibility to the user, as they need to define the K (of N) people they want to check the signature from. See https://twitter.com/LukeDashjr/status/1352418568978247683

Concept ACK either way

Concept ACK

Accumulating the signatures in the SUMS file itself would be easier to implement, but I guess moves more responsibility to the user, as they need to define the K (of N) people they want to check the signature from.

Hmm good point. There was some trick to have multiple signatures for a clear-signed PGP file. But no way to add rules like that.

Concept ACK

Is this still an issue after switching to guix-attestations?

No, I don't think so.