Set up Keyoxide identity proofs using the GPG keys #40

As discussed in #37 and #39, we should add Keyoxide identity claims/proofs using our OpenPGP keys.

I propose the following:

• Key c5923710 (the "generic" key, currently the "release" key"

  • contact@forgejo.org identity
    • DNS claim: forgejo.org
    • Gitea org claim: https://codeberg.org/forgejo
    • Fediverse claim: https://floss.social/@forgejo
  • release@forgejo.org identity
    • (used for signing releases)

• Key 9e1fb56f (the "security" key)

  • security@forgejo.org identity
    • DNS claim: forgejo.org
    • Gitea org claim: https://codeberg.org/forgejo

@dachary, I have implemented the DNS and Codeberg org proofs locally for the "generic"/"release" key (including adding the contact@forgejo.org identity).

Any objection to me pushing it to the keyservers?

No objection.

Keyoxide proofs are implemented as outlined above for the general key c5923710.

I do not have the private key for the security reports key 9e1fb56f so somebody in @forgejo/Security will have to add the claims to that. I can add the proofs to the DNS and the Codeberg org though.

I'd be grateful if there was some kind of documentation somewhere about all this. I'll surely forget half of it by next week 😅

Yes, an overview of what keys are to be used for what (and who has access to the corresponding private keys) would be good.
I'm going to bed now but I'll try to look at that tomorrow.

@dachary I added some documentation regarding the GPG keys alongside the keys themselves in the secrets repo. Please let me know if it makes sense or if there's anything you think is unclear.

Most of the information there could be in a publicly-accessible place, but I'm not sure where is most appropriate... any suggestions?

Most of the information there could be in a publicly-accessible place, but I'm not sure where is most appropriate... any suggestions?

I would add that to a new CONTRIBUTING.md where WORKFLOW.md and RELEASE.md can also be moved. It may not be the best way to structure a development documentation but it is how Gitea does it and I think there is value in keeping it in a file that is familiar to existing contributors.

forgejo/forgejo#34 is the PR to merge WORKFLOW.md and RELEASE.md into CONTRIBUTING.md

@Gusted, adding you as an assignee because I think you mentioned you would set up identity claims for the security key (which I don't have access to).

@caesar Quite a adventure to use the hidden bits of GPG to achieve this 😅, but it's done https://keyoxide.org/security@forgejo.org

Great! Thanks @Gusted. Yes it does take some time to make sense of it all at first... a good CLI or GUI tool for adding claims is definitely something Keyoxide needs.