onionltd / mono Goto Github PK

Repositories:

https://github.com/oniontree-org/oniontree-org.github.io
https://github.com/oniontree-org/oniontree-org.onion

contain autogenerated content by the CI (https://github.com/oniontree-org/oniontree-hugo). Commits pushed to the repository aren't signed which potentially allows someone with write permissions to push forged content.

This is a proposal to implement automatic commit signing:

0. Generate a new PGP private key

1. Find a way to safely store a PGP private key

GitHub Actions offer a concept of Secrets. It's safe to say this is the best candidate.

2. Store the PGP private key on a disk

Once the private key is retrieved from the secrets, it must be imported to gnupg keyring. Is gnupg available? Is it safe to do so? Can't the keyring be read from the disk by someone unauthorized? Should the keyring be deleted at the end?

3. Sign new commit

Update git configuration so that the commit signing is enabled. https://github.com/oniontree-org/oniontree-hugo/blob/master/.github/workflows/build.yaml#L68

Unit tests are currently missing for HTTP server and the endpoint handlers. Without the tests, I can't upgrade the vendored dependencies, without fear of breaking things.

Onion v2 addresses has become obsolete and will not be supported beyond 2021. It's time to make the service available via v3 address, and do so sooner than later, so that the users have enough time to update their bookmarks and get accustomed to the new address.