Skip to content

Add PGP keys used by scala-lang to the security policy #1672

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
+13 −1
Draft

Add PGP keys used by scala-lang to the security policy #1672

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4d8acda
Add PGP keys to /security
hamzaremmal Jul 18, 2024
5172b06
Add new Scala PGP key
hamzaremmal Jul 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,23 @@ Security announcements related to Scala are published to the ["Security Announce
Messages to this channel can only be posted by administrators, so it is very low traffic.
To set up email notifications for new security announcements, read [this post](https://users.scala-lang.org/t/about-the-security-announcements-category).

## Releases Integrity

To ensure the integrity of all the releases, our organization uses [PGP](https://gnupg.org/) keys for cryptographic signing.
We provide below an **exhaustive** list of all the keys
used for signing the artifacts under the `org.scala-lang` namespace on [Maven Central](https://central.sonatype.com/namespace/org.scala-lang)

| Fingerprint | Algorithm | Public Key |
|:-------------------------------------------------:|:---------:|:-----------------------------------------------------------------------------------------------------------------------:|
| 86DA 41A5 E169 9C9C EBE9 64A8 A905 2B1B 6D92 E560 | RSA-4096 | [Download Public Key](https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x86da41a5e1699c9cebe964a8a9052b1b6d92e560) |
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As mentioned by @SethTisue - this key - which expired:

$ gpg --list-public-keys C03EF1D7D692BCFF
pub   rsa4096 2018-02-13 [SC] [expired: 2020-02-13]
      86DA41A5E1699C9CEBE964A8A9052B1B6D92E560
uid           [ expired] Scala Project <[email protected]>
sub   rsa4096 2018-02-13 [E] [expired: 2020-02-13]
sub   rsa4096 2018-02-14 [S] [expired: 2020-02-13]

was used to create signature:

$ gpg --verify org/scala-lang/scala-library/2.13.15/scala-library-2.13.15.pom.asc org/scala-lang/scala-library/2.13.15/scala-library-2.13.15.pom
gpg: Signature made Fri 20 Sep 2024 21:25:22 CEST
gpg:                using RSA key C03EF1D7D692BCFF
gpg: Good signature from "Scala Project <[email protected]>" [expired]

after expiration time.

So either the signing tool was forced to use expired key, or the key at signature creation place was updated and not expired at the time. In the latter case - may I ask for that key to be sent to keyservers, please?

| ACF3 9CCD ED38 E2C6 F089 8BF2 8F7F 6C04 5196 7B84 | RSA-4096 | [Download Public Key](https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xacf39ccded38e2c6f0898bf28f7f6c0451967b84) |
| 2A5E 8B33 8438 CAC7 033F 9D8F B8A0 45C0 A6EC 398E | RSA-4096 | [Download Public Key](https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x2a5e8b338438cac7033f9d8fb8a045c0a6ec398e) |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there's also https://keys.openpgp.org/search?q=C478A820AD150412FF2860C563426A08B91ED6B0


## Reporting Vulnerabilities

We strongly encourage reporting security issues in Scala to us privately before disclosing them in public.

The email address for security related communication is `[email protected]`.
The email address for security related communication is [`[email protected]`](mailto:[email protected]).
Messages are delivered to the Scala Security Team, which includes people from EPFL, the Scala Center, VirtusLab and Lightbend.

We strive to acknowledge reports within 2 business days.
Expand Down