Place public OpenPGP key in the file system directory `openpgp` about csaf_distribution HOT 2 CLOSED

Rationale

Not using WKD or public pubkey servers is making the implementation more reliable and simpler for provider and client implementors.

WKD would require an email address and public pubkeyservers often do not provide additional data to verify the pubkey.

from csaf_distribution.

changes towards csd02

The standard document has meanwhile changed to be more explicit about this:

https://docs.oasis-open.org/csaf/csaf/v2.0/csd02/csaf-v2.0-csd02.html#7120-requirement-20-public-openpgp-key :

The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.

For example, the public part of the OpenPGP key could be placed in a directory openpgp adjacent to the provider-metadata.json.

https://docs.oasis-open.org/csaf/csaf/v2.0/csd02/csaf-v2.0-csd02.html#717-requirement-7-provider-metadatajson :

 "public_openpgp_keys": [
      {
        "fingerprint": "8F5F267907B2C4559DB360DB2294BA7D2B2298B1",
        "url": "https://keys.example.net/vks/v1/by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
      }
    ],

technical approach

• We can use the long fingerprint as filename in the openpgp directory.
• The csaf_provider can use the create step to copy over the current public key in the directory, if it is not in there. Previous pubkeys stay in there.
• The aggregator will copy all pubkeys in mirror mode and add its own pubkey if it does additional signatures.
• The provider-metadata.json shall list all pubkeys in that directory.

from csaf_distribution.