Added new public key for planned rotation and bumped securedrop-keyri…

[zenmonkeykstop]

Status

Ready for review

Description

Updates securedrop-keyring, adding the new public key for the 2021 rotation, and bumping its version to 0.1.5.

Test plan

• clone https://github.com/freedomofpress/securedrop, verify and check out the tag 1.8.2
• verify that the securdrop keyring (../securedrop/install_files/securedrop/etc/apt/trusted.gpg.d/securedrop-keyring.gpg) is identical to securedrop-keyring/securedrop-keyring.gpg
• build the securedrop-keyring package with PKG_VERSION=0.1.5 make securedrop-keyring successfully
• Set up a securedrop-workstation dev environment if not already available
• Copy the securedrop-keyring package to sd-small-buster-template and sd-large-buster-templateand install it usingdpkg`, restart the templates and all workstation VMs
• Confirm that both the original and new public keys (fingerprints '22245C81E3BAEB4138B36061310F561200F4AD77' and '2359E6538C0613E652955E6C188EDD3B7B22E6A3') are available via sudo apt-key list on the template VMs and their child workstation VMs
• Confirm that sudo apt-get update completes without errors on the VMs

[conorsch]

Works beautifully.

Reminder that we don't have automatic nightlies for the keyring package, so we'll need to sign the packaging repo, build the new keyring package, and upload to apt-test manually. The package is reproducible, so we can promote the same artifact from apt-test to prod once it's ready for final release.

[zenmonkeykstop]

Is it worth holding off on signing+tagging the packaging repo until other queued changes are ready and releasing them all of a piece, or should we just go ahead and get this one done?

[conorsch]

My initial hesitation was the same: wait to tag until all pieces are in place. But given that the changes to securedrop-keyring are "ready", and the versioning scheme on this packaging repo is independent, it feels right to proceed with tagging the packaging repo and preparing a prod-ready artifact for the keyring. We'll post to apt-test first, then promote to apt prod if no problems.