The signs are there

Today's job is wrapping up the mechanical parts of our TUF implementation. When I say mechanical, I mean physically securing the keys we're using to keep everyone secure and protected. Even if a hacker gains access to my build server.

This is done through rolling keys and revocations. The master keys are air gapped and hidden behind my house on an 1800 acre property that is frequented by illegal hunters. You'll have to find the metal container that's buried two feet down at a specific unmarked location and the coordinates to it are written down on a metal plaque that's bolted on a power pole at 25+ feet height somewhere you'd never find it.

Just kidding.

The mechanical parts here are simply to keep an attacker from generating new signed content. So it's air gapped, split into two, and stashed away in a sensible place. It does mean that from today on the keys on the repository server are rolling forward automatically, and if my build system at home goes offline for too long, the updates are going to be rejected by every client that has them enabled. This is what protects you against my server getting broken into. If it was just a simple power outage or hardware failure, once it goes back online everything and everyone will see the updates again as normal, and stuff just works again.

There are other ways of doing this sort of ceremony. In Clear Linux we had an actual signing server setup. But it required 4 or 5 people to manage it securely with different roles in place. With just me doing this on my own, that would just be wasted effort. But it can work well if the project grows and more people can be trusted.

With that part complete, there's one less step needed to go public and feel OK about it. It's a big step and cost me a good 5-6 hours of time to execute, plus all the followup testing to make sure that everything accepts the newly signed key and rejects the now invalid original one, and shredding any copy I had made elsewhere.

--sofar (aka Auke)