1518912 - docker-worker: add ed25519 cot signature support; deprecate gpg

Status: RESOLVED FIXED

(Taskcluster :: Workers, enhancement)

Description

[Aki Sasaki (not active)]

GPG 2.0.x is past its EOL; our current cot-gpg-keys solution is high maintenance and can only be properly tested on puppetized scriptworkers. Moving to a more modern signature algorithm and a set of known public keys, without a web of trust, will improve both of these situations.

We should:

• add ed25519 cot signature support to docker-worker.
• deprecate gpg support; once all 3 worker implementations are uploading signed ed25519 cot artifacts, we'll drop gpg support across the board.
• leave chainOfTrust.json.asc alone, until we drop gpg support
• create and upload two new artifacts: an unsigned chain-of-trust.json, and an ed25519 signature chain-of-trust.json.sig.

Ideally, I'd like to get the solutions in all 3 worker implementations working before we roll out, to avoid churn. I'm signing up to write this patch, though I may need a hand with both docker-worker and node questions.

See also: mozilla-releng/scriptworker#294, the discussion in mozilla-releng/scriptworker#293 (comment), and taskcluster/generic-worker#136 .

Comment 1

[Aki Sasaki (not active)]

Pete, I'll do this one last, but we may want to roll out ed25519 support before we converge on generic-worker.

Comment 2

[Aki Sasaki (not active)]

Attachment: docker-worker PR

Comment 3

[Aki Sasaki (not active)]

This is done :) Thanks Wander!