Security team and email account #37

• decide who will receive security reports
• set up an email address for security reports (such as security@forgejo.org)
• create an OpenPGP keypair for the above email account
• publish the OpenPGP public key
• share the OpenPGP private key with the security team
• set up Keyoxide proofs for the OpenPGP public key

Discussed on Matrix, where @Gusted volunteered to handle security reports and @fnetX proposed creating a joint Codeberg / Forgejo security team.

Needed for forgejo/forgejo#9 / forgejo/forgejo#18.

Related forgejo/website#14

@Gusted the issue was assigned to you because you mentioned that you'd be willing to act on it in the chat. Feel free to unassign yourself if I overstepped.

Who should be on the receiving end on security@codeberg.org:

• At least one Forgejo contributor (e.g. myself)
• security@codeberg.org which is a alias to the active members of Codeberg infrastructure (Correct me if I'm wrong @fnetX).

I assume I can use OVH's feature to add the email redirections for security@forgejo.org?

I will create the OpenGPG in a moment.

I'm willing to be on the receiving end on security@codeberg.org

I disclosed vulnerabilities responsibly in the past.
If you think, you could benefit from someone with experience in Frontend technologies, sign me up.

(Also disclaimer: I'm community member at WeHackPurple on invite of Tanya).

Sorry, can someone explain the current setup again: Will there be security@forgejo.org forwarding to codeberg, or will security@codeberg.org forward to forgejo? Or both to individuals?

I think both addresses need to exist. The forwarding setup depends on who's involved on the Forgejo and Codeberg teams I guess. Perhaps both forwarding to individuals is best, unless a dedicated inbox will be set up for one or the other? Otherwise emails will be forwarded twice.

I'd like to advance with this in order to compete forgejo/forgejo#18.
Does anyone object to the following immediate actions?

• create an alias security@forgejo.org
• forward mails to those who volunteered above: @Gusted, @dachary, @Ryuno-Ki, @fnetX

We can then continue discussion and modify the forwarding targets later as necessary.

The above steps have now been completed.

I created the @forgejo/Security team to keep track of who will receive security reports.

Additionally, @Gusted has created an OpenPGP keypair for the security team, with the following fingerprint: 311A7E4BB93EFF1F7ED5BE3C5C597051A4676E79.

I will leave this issue open to continue discussion of the longer-term strategy for forwarding and handling emails to security@forgejo.org.

@Gusted, I suggest you should publish the public key to keys.openpgp.org.

Additionally, as mentioned on Matrix, we should set up WKD (perhaps at least initially by delegation to keys.openpgp.org).

We could also consider setting up Keyoxide identity proofs.

Keyoxide has nothing to do with the GPG keys right? Nonetheless a good idea.

https://keys.openpgp.org/search?q=1B638BDF10969D627926B8D9F585D0F99E1FB56F Published the public key to keys.opengpg.org

Keyoxide has nothing to do with the GPG keys right? Nonetheless a good idea.

Yes, you publish 'claims' on the GPG key (as 'annotations', which don't show up in most software), and 'proofs' on the sites you're claiming. No data is stored by Keyoxide.

See https://docs.keyoxide.org/openpgp-profiles/using-gnupg/ for more info on the GPG side.

For example, with the Gitea proof we could prove ownership of the Forgejo organization on Codeberg.
With the DNS proof we could prove ownership of the forgejo.com domain.
And likewise for a future fediverse account.

Keyoxide fetches the key from WKD if possbile and then falls back to keys.openpgp.org.

You can see my Keyoxide 'profile' for an example.

Do we also want keyoxide proofs for the other emails (e.g. contact@forgejo.org)? I will go ahead with keyoxide later today.

Hmm, yes, we do need to consider what we want to claim on each GPG key. For example the security key doesn't need to claim the (future) Mastodon account.

I'm not 100% certain if the same URLs can be claimed from multiple GPG keys (ie, if multiple proofs can be posted in a single location). I suspect not, but I will ping @yarmo (Keyoxide maintainer) to find out.

Congrats on forgejo, can't wait to see how far this goes.

yes, we do need to consider what we want to claim on each GPG key

IMHO every key should at least claim the forgejo.org domain, proving that they are indeed made by the people behind the domain.

I'm not 100% certain if the same URLs can be claimed from multiple GPG keys

Yes, this is possible! For domains, simply add multiple DNS TXT records. Or add multiple fingerprints to the one DNS TXT record, that should also work although I've never tried that.

I think a dedicated semi-private Matrix room will be at least something to deploy in addition to Keyoxide verified fingerprints and email addresses.

Why?

Because many of us have already begun their migrations in earnest to use our Matrix addresses as our primary PoCs, often only occasionally checking email, or only using it for direct contact with our paying customers.

About two dozen if my colleagues now only publish their Matrix addresses exclusively everywhere, and I'm not sure, but some of them might have almost entirely retired their email - one of those individuals is actually a prominent Matrix server dev.

share the OpenPGP private key with the security team

This is the only thing remaining in order to close this issue. @Gusted or @dachary could you confirm if the key has been securely shared with everyone in @forgejo/Security ?

I just sent encrypted emails to @fnetX and @Ryuno-Ki, the other two members of the security team awaiting confirmation. Maybe @Gusted already sent them the key.

I'm currently lazy with doing GPG (on my PC) as it's giving me a lot of headache due to some problems with dirmngr service.

I just sent encrypted emails to @fnetX and @Ryuno-Ki, the other two members of the security team awaiting confirmation. Maybe @Gusted already sent them the key.

Ah, that was the content of the mail!

I haven't been able to check the content from my mobile (d'oh).
Let me get back to you.

Closing as I believe this is completed; feel free to re-open if there is anything outstanding here.