README for the debian-keyring package
=====================================


Introduction
------------

The Debian project wants developers to digitally sign the
announcements of their packages, to protect against forgeries.  The
Debian project maintains GPG (GNU Privacy Guard) keyrings with keys of
Debian developers.  This is the README for these keyrings.


Background: PGP and GPG
-----------------------

When this file was originally written, PGP (Pretty Good Privacy) was
the most widely used public key cryptography program.  Unfortunately,
it uses a patented algorithm (the symmetric IDEA cipher), making a
DFSG-free implementation impossible.  GPG (GNU Privacy Guard;
http://www.gnupg.org/) is a DFSG-free cryptography program which is
based on the same concepts as PGP, but which uses unencumbered
cryptographic algorithms.

Furthermore, cryptographical weaknesses being discovered in PGP's
algorithms deemed its keys as no longer trustable, so we strongly
encourage you to migrate to a strong (2048 bit or greater, current
standard is 4096, RSA-based) GPG key.

Over the years, all of our developer's keys have been migrated away
from PGP.

Getting debian-keyring.gpg
--------------------------

The current versions of debian-keyring.gpg is always available via
rsync from keyring.debian.org (module keyrings).

There is also a (possibly slightly out-of-date) version available on
your nearest debian mirror in debian/doc/debian-keyring.tar.gz and as
the debian-keyring package.

The rsync area on keyring.debian.org is the canonical location for
keyrings and it is what the Debian installer program (dinstall) uses.
If your key is available from there, it will be seen by dinstall.  The
tarball and Debian package are provided for user convenience and are
not necessarily in sync with keyring.debian.org.

That file contains the keyrings, signed copy of keyring md5sums and
this README.  The keyring md5sums will be signed by the keyring-maint
team (currently, Jonathan McDowell and Gunnar Wolf).

Using the debian-keyring with gpg
---------------------------------

Add these lines to the bottom of your ~/.gnupg/gpg.conf[1] file:

keyring /usr/share/keyrings/debian-keyring.gpg

GPG cannot modify keys in these root-owned files.  In order to edit or
sign keys in the Debian keyring you will first need to import them to
your personal keyring.  If ~/.gnupg/gpg.conf lists the debian-keyring
files, keys already in the Debian keyring will not be imported to your
personal keyring.  You can use "gpg --no-options --import" to force
GPG to ignore gpg.conf and import keys to your personal keyring only.

It also possible to use public keyservers on the net directly.  This
requires that you have a working internet connection.
Add a line to your ~/.gnupg/gpg.conf[1] file such as:

keyserver subkeys.pgp.net

or

keyserver keyring.debian.org

Generate a key pair
-------------------

GPG is used for security, and security can be a bit tricky.
Please install the gnupg-doc package and read the GPG manual (located
in /usr/share/doc/gnupg-doc/GNU_Privacy_Handbook) before generating a
key pair. The actual generation is trivial. You must use at least
1024 bits.

The Debian project will only accept new key pairs if they are GPG
keys.

(It's a key pair, because GPG and PGP use public key cryptography.
One of the keys is private, one is public. This is all explained in
the GPG manual.)

You should also generate a revocation certificate, and store it in a safe
place in the case that you forget your pass phrase, or lose your key(s).

Exchange key signatures with other people
-----------------------------------------

If at all possible, meet other Debian developers in person and sign
each other's keys. Geographical and economical challenges often make
this impossible, but if you can do it, please do.  Signing keys means
verifying that the key and the username belong together. The
signatures can allow other people to trust the key. (This is the "web
of trust" stuff the GPG manual explains about.)

Also exchange key signatures with many other PGP/GPG users. It all
helps to expand and strengthen the PGP/GPG web of trust.

Do *NOT* sign other people's key unless you have met that person face
to face in real life and seen a good form of ID (e.g. passport,
driver's license), or in any other way you can be sure that the person
is who they say they are.


Getting your key into the debian keyring
----------------------------------------

If you are an old debian developer who hasn't uploaded your packages
for a long time, and your key is not in the keyring, send a mail to
keyring@rt.debian.org (making sure to include the words "Debian RT"
somewhere in the subject) explaining the situation, and including your
public key.

All new maintainers should apply at http://nm.debian.org/, and your
key(s) will be added to the keyring as part of the admission process.


Updating your key(s)
--------------------

There is a keyserver running on keyring.debian.org, for any updates of
existing keys please send them there, e.g:

  $ gpg --keyserver=keyring.debian.org --send-keys 0x0123ABCD

To add a new key or remove an existing ones, please send mail to
keyring@rt.debian.org making sure to include the words "Debian RT"
somewhere in the subject line.


What the keyrings are
---------------------

 o debian-keyring.gpg

    This is the canonical Debian Developers (DD) keyring.  Anyone who
    has a key in here is an uploading Debian Developer.

 o debian-maintainers.gpg

   The keyring for Debian Maintainers (DM). Anyone who has a key in
   here is a Debian Maintainer.

 o debian-nonupload.gpg

   This is the keyring for Debian Developers (nonuploading). Anyone
   who has a key in here is a nonuploading Debian Developer.

 o debian-role-keys.gpg

    This is the keyring used to contain role account keys, such as
    "ftp-master" (it contains the key used to sign the Release files
    in the archive).

===

These keyrings are not part of the binary package but are available in
the source package or on keyring.debian.org.  It is very strongly
recommended that you do not use/trust keys in these keyrings for
verification purposes.

 o emeritus-keyring.{gpg,pgp}

    This is the keyring of emeritus developers; i.e. those who have
    resigned, retired, passed away or are otherwise inactive.

 o extra-keys.pgp

    This is extra keys used for verification purposes (usually of new
    Debian maintainers).  They don't go into the main keyring because
    PGP keys are deprecated and no new PGP keys are being added into
    the PGP keyring.

 o removed-keys.{pgp,gpg}

    These keys are that have been removed from the main keyrings for
    various reasons.  Keys in here could have been duplicates or
    compromised keys, etc.  These keyrings are not available in the
    debian-keyring package, only in the tar ball or via rsync.


Signing your GPG key with your PGP one
--------------------------------------

If you already have a PGP key, but only now made a GPG key, you must
sign your GPG key with your PGP one. This can be done as follows:

o If you have a version of gpg older than 1.0.3 (without RSA
  support), you will have to upgrade to a newer version which has RSA
  support included.  Additionally, you will also need the IDEA module
  (regardless of the GPG version in use).  If you are legally allowed to
  do so, you can download the ftp://ftp.gnupg.dk/pub/contrib-dk/idea.c.gz
  file and its signature ftp://ftp.gnupg.dk/pub/contrib-dk/idea.c.gz.sig,
  read the instructions at the top of the file, compile it and use it as
  a plugin for GnuPG.

o Find your GPG and PGP key ID's using gpg --list-keys, and pgp -kv
  Read the gpg and pgp documentation for more information.

o Sign your GPG key with your PGP key:
        gpg --load-extension idea \
            --secret-keyring ~/.pgp/secring.pgp \
            --keyring ~/.pgp/pubring.pgp \
            --keyring ~/.gnupg/pubring.gpg \
            --default-key 'Your PGP ID' --sign-key 'Your GPG ID'

Acknowledgements
----------------

This README was originally written by Lars Wirzenius, liw@iki.fi and
was over time maintained by James Troup <james@nocrew.org>. Currently
it is maintained by the keyring-maint team (Jonathan McDowell
<noodles@earth.li> and Gunnar Wolf <gwolf@debian.org>).  Contributions by
J.H.M. Dassen (Ray) <jdassen@wi.LeidenUniv.nl>, Igor Grobman
<igor@debian.org>, Darren Stalder <torin@daft.com>, Norbert Veber
<nveber@primusolutions.net> and Martin Michlmayr <tbm@cyrius.com>.

Many thanks to Brendan O'Dea <bod@debian.org> who setup and wrote
support scripts for the keyserver on keyring.debian.org.

================================================================================

[1] In Woody-era versions of gnupg (<< 1.2) the options file was
    called ~/.gnupg/options.
