ReleaseKey » History » Revision 19

Revision 18 (Denis 'GNUtoo' Carikli, 02/23/2020 12:42 PM) → Revision 19/29 (Denis 'GNUtoo' Carikli, 02/23/2020 12:46 PM)

h1. Release keys 

 h2. Which key for which Replicant version? 

 h3. From Replicant 6.0 0004 RC1 

 Key ID: FB31DBA3AB8DB76A4157329F7651568F80374459 

 These images are signed with [[People#Denis-GNUtoo-Carikli|Denis 'GNUtoo' Carikli]]'s key and has the following fingerprint: 
 FB31 DBA3 AB8D B76A 4157    329F 7651 568F 8037 4459 

 h3. Up to Replicant 6.0 0003 

 Key ID: 5816A24C10757FC4 

 These images are signed with [[People#Wolfgang-Wiedmeyer|Wolfgang Wiedmeyer]]'s key and has the following fingerprint: 
 0F30 D1A0 2F73 F70A 6FEE    048E 5816 A24C 1075 7FC4 

 h3. Replicant 4.2 and below 

 Key ID: 16D1FEEE4A80EB23 

 These images are signed with the Replicant release key which expires 2024-01-17 and has the following fingerprint: 
 E776 092B 052A DC91 FDD1 FD80 16D1 FEEE 4A80 EB23 

 h2. Retrieving the Replicant release key 

 In the following, @KEY_ID@ needs to be replaced with the right key ID from above. 

 h3. From a key server (recommended) 

 You can retrieve our signing key from a public key server and import it to your GPG keyring using: 

 gpg --recv-key KEY_ID 

 Errors may occur if GPG is not properly configured. Following a guide like "this": should ensure that the key is retrieved securely. 

 h3. From our releases 

 A copy of our signing key is shipped with every Replicant release, distributed with [[ReplicantImages|Replicant images]]. 
 Once downloaded, the key can be imported to your GPG keyring using: 
 gpg    --armor --import path/to/KEY.asc 

 h2. Establishing a chain of trust 

 In order to establish a chain of trust, you are encouraged to retrieve our release key physically when meeting a trusted [[People|Replicant developer]] and sign it with your own key. 

 You can see the signatures the release key is already signed with running: 

 gpg --list-sigs KEY_ID 

 If a key you already trust is among these signatures, a chain of trust is established between your key and the release key. However, this chain of trust is not as strong as the direct one you establish when you personally verify and sign the release key.