Using GnuPG on Savannah

Savannah maintains tree kinds of GPG keys:

  • Savannah key for signing notifications.
  • Users' personal keys.
  • Group release keys.

Savannah provides a basic testing facility, you can use it when adding keys. The test button imports the entered keys to a temporary keyring, then lists them and (for personal keys) encrypts a sample text. Make sure that you only register the keys you intended, and that you can decrypt the generated message.

Savannah signing key

Since 2024-07, Savannah signs its notifications with a GPG key; the public key is available on its Contact page.

Personal keys

Personal GPG keys are used for encrypted communications with users and recovering their accounts.

You can also use your registered key to comment on trackers via email.

To begin, please add your GPG key by logging in to Savannah using https://savannah.gnu.org/my/admin/change.php?item=gpgkey

Your GPG key should have at least one usable subkey with encryption capability.

Now, you can enable encryption checking the "Encrypt emails when resetting password" in https://savannah.gnu.org/my/admin/. Please keep your key current: GnuPG won't encrypt messages to expired keys.

Other people can get your key via the "Download GPG Key" link on https://savannah.gnu.org/users/user, where user is your account name.

Group release keys

Group release keys are used for verifying the integrity of files in the Download Area. These keys are registered in the Public Information of each Savannah project; you need to be an admin of the group in order to edit it.

The registered keys are available via https://savannah.gnu.org/project/release-gpgkeys.php?group=project, where project is the "system name" of your group.

How to upload a signed release.

Group member keyring

Historically, the Main page of Savannah projects linked to concatenated GPG keys of all members as https://savannah.gnu.org/project/memberlist-gpgkeys.php?group=project, and it was supposed to be used as the release keys for the group. This URL still works, but in March, 2021 the link on the Main page of the project was replaced with a link to Group Release Keys.

The old approach had a number of shortcomings:

  • no way to register keys for personal contact separate from the keys for releases;
  • no way to register separate keys for different groups;
  • GnuPG couldn't import keys when some members provided ASCII-armored keys while other ones used the binary format;
  • for projects with many members, the visitors were offered many more keys than needed; moreover, a mistake in the account of any member (like exporting the whole local keyring) could compromise the releases.

More info

Copyright © 2023, 2024 Ineiev

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.