Useful cryptographic keys

Packaging

Our packages are signed with the Heptapod Packaging Team GPG key.

Fingerprint of the main key: 7DD5B49DBA3826D9D03BFE8387F6D64CA83C4416

Warning: 2024 change of subkey

As of 2024-04-28 the previously used subkey for signing has expired and and new key has been issued. You will need to reimport the key and will be able to check that everything is fine.

Importing or updating the public key

$ curl https://heptapod.net/static/heptapod-packaging.asc | gpg --import
gpg: key 87F6D64CA83C4416: public key "Heptapod Packaging Team <packaging@heptapod.net>" imported
gpg: Total number processed: 1
gpg:               imported: 1

Displaying fingerprint details:

$ gpg --list-keys --with-subkey-fingerprint packaging@heptapod.net

pub   rsa4096 2021-04-26 [SC] [expires: 2025-04-28]
      7DD5B49DBA3826D9D03BFE8387F6D64CA83C4416
uid           [  full  ] Heptapod Packaging Team <packaging@heptapod.net>
sub   rsa4096 2024-04-28 [S] [expires: 2025-04-28]
      33EB7A56E7E2BBC45E3723CA8D11CF04BFC97B03

The output above has been updated with the new subkey. Notice how the main key fingerprint is unchanged. Also if you set some trust previously on the main key, it should apply to the new subkey automatically.

For reference, here were the previous fingerprint details:

pub   rsa4096 2021-04-26 [SC] [expires: 2026-04-26]
      7DD5B49DBA3826D9D03BFE8387F6D64CA83C4416
uid           [  full  ] Heptapod Packaging Team <packaging@heptapod.net>
sub   rsa4096 2021-04-26 [S] [expires: 2022-04-26]
      12E4DA21FB43680A27F4EDFCA0AB681081F35BD6

Verifying a package

With `gpg`

Download the detached signature file alongside the package itself.

Example:

wget https://download.heptapod.net/rhgitaly/rhgitaly-1.4.0.tgz
wget https://download.heptapod.net/rhgitaly/rhgitaly-1.4.0.tgz.asc

Verify it:

$ gpg --verify rhgitaly-1.4.0.tgz.asc
gpg: assuming signed data in 'rhgitaly-1.4.0.tgz'
gpg: Signature made mer. 01 mai 2024 18:16:18 CEST
gpg:                using RSA key 33EB7A56E7E2BBC45E3723CA8D11CF04BFC97B03
gpg: Good signature from "Heptapod Packaging Team <packaging@heptapod.net>" [full]

Example of an old signature with the subkey that has now expired:

$ curl -OL https://download.heptapod.net/runner/binaries/heptapod-runner-linux-x86_64-heptapod-0.3.1
$ curl -OL https://download.heptapod.net/runner/binaries/heptapod-runner-linux-x86_64-heptapod-0.3.1.asc
$ gpg --verify heptapod-runner-linux-x86_64-heptapod-0.3.1.asc
gpg: assuming signed data in 'heptapod-runner-linux-x86_64-heptapod-0.3.1'
gpg: Signature made Mon 26 Apr 2021 03:30:52 PM CEST
gpg:                using RSA key 12E4DA21FB43680A27F4EDFCA0AB681081F35BD6
gpg: Note: This key has expired!
gpg: Good signature from "Heptapod Packaging Team <packaging@heptapod.net>" [full]

Since the signature is older than the key expiration, this is fine.

With `gpgv`

Alternatively, for servers and various scripts, you can store the key in a separate keyring and use the gpgv utility, once you have checked the key validity manually.

$ gpg --export packaging@heptapod.net | gpg --no-default-keyring --keyring ~/.gnupg/trustedkeys.kbx  --import
$ gpgv rhgitaly-1.3.3.tgz.asc rhgitaly-1.3.3.tgz && echo OK || echo FAILED
gpgv: Signature made Wed 20 Mar 2024 16:04:58 UTC
gpgv:                using RSA key 12E4DA21FB43680A27F4EDFCA0AB681081F35BD6
OK

gpgv exits with code 1 if the signature is invalid, which makes it practical to use in automated processes, as the example above demonstrates.

However, it does not check for validity nor expiration, assuming that you did by copying over to the trustedkeys keyring.

heptapod.host

SSH Server Keys

RSA (SHA256): OZ/IX5p7zU8DWQ3Xfya31Mg2nnmkuwZFtLbOMPfgBzM
ED25519 (SHA256): MG6q3rOmz25KBx1uy4MFPGY3CaoSIUMuBHqw9weCQbg

foss.heptapod.net

SSH Server Keys

RSA (SHA256): +n9EuD1VJHrrf6CTXxbWZ36toWAtFENbasNRejTJog0
ED25519 (SHA256): zLZX3eKgdOGFOZ3uf3Pu3QYRcVrAii9EjQ0dg09XGzk

Georges Racinet

Cloudcrane keys

SSH

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL65l9RFds86ZVrYfKlICUkclNpwviVHk3wLbFmHiO3m georges.racinet@cloudcrane.io

GPG

Fingerprint: 09719FFE0B476DC26923F8EEB8EB20361976F291

Octobus keys

SSH

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxUQvWvG21TMiUU3JSjw0vFeC94vkQVWtiw6macLBOXtSPisa6S6Y0uCPbOTaXUgeQBq1ncjPBsU2NqS12PDqxS4UM8e0X9BPOfQw04Guv8cZUbHvywqCMP2+qDwGcVteaELHW8OwcOVfLyz/qVa4jPpnGotYzUSKI+rOcFALZY6PZvJCdGF2So9j3ltDLiD4peZL8aiGDsAJIVTNgzRL3zjFAccMt0eQKSB4I8yOMHjEhlEiyumFX/u3qyFgZokeRsvRlEYAE1Q3sy6HxbAfP8TXJDiAXlnOZOeW4UG6kfM0ofV/bhDgV/dpWHDtdSxa+1JuB/U8RLy6FxFFBzmbjIh0WwAd4YneU9gzrpu2sVoNIHuTt9cs5k9LzBNlOkrFvKyx6L30kELyhbm0O1LbHFOp8tA0QtRo/r1ZB0vkEn/bi4njQ9KbVFvT7xfRHHncFv1Js+TsEK/L769Tn62MzHhCgou+LZh6VSTJfHig4H31FHRD2lK1Uh1IxoBeYibyxCELh48ummchK0Wp2ZEShA6+R8plrBaXWWW7q+qO0UfZ1ToVjkiWw6cYNohV2PcOyqLeE3j4xh18iMR7S2syMRo5qZK6H+54MKFHXjS74/ovBRtM97uhaorzRNFvUdp5zwxG0j2rOi8IlylvPJhE7tVJrlKQoidD/AcztD9hAlQ==

GPG

Fingerprint: BF5456F4DC625443849B6E58EE20CA44EF691D39

Useful cryptographic keys

Packaging

Warning: 2024 change of subkey

Importing or updating the public key

Verifying a package

With gpg

With gpgv

heptapod.host

SSH Server Keys

foss.heptapod.net

SSH Server Keys

Georges Racinet

Cloudcrane keys

SSH

GPG

Octobus keys

SSH

GPG

With `gpg`

With `gpgv`