Last modified: 2014-05-02 11:51:37 UTC
We need the ability to sign tarballs automatically. Using this ticket to track what needs to be done and by whome. Assigning to Antoine for now since he is the Jenkins guy.
Since we've had a number of conversations around this, let me enumerate the options we've talked about. We probably need to just pick a strategy and try it: 1) The "Jenkins" who does the signing is a private/secured version where we feel comfortable keeping a private key. 2) We put the signing key in an hsm in the datacenter, and make sure someone audits/watches what is being signed. 3) Jenkins signs with a key only to say, "This is what Jenkins built". It's up to someone in the release process to verify and sign the tarballs to assert that someone is pretty sure the tarballs were built correctly.
I do not have any free time in March to handle release tarballs / securing Jenkins. If someone else can take the lead there that would be much appreciated. We can most probably use a private Jenkins server for ops/analytics/mw tarball usage. They all have the same need apparently.
Resetting assignee, I am not working on this.
