René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Release signing keys may be poisoned","articleBody":"\u003e :bulb: Initially reported in [this comment](https://github.com/nodejs/node/issues/709#issuecomment-530606948), but I felt it warranted an issue of its own given the age of the issue on which it is attached.\r\n\r\nThis is not an issue with Node.js itself, but rather with the manner in which the release team's keys are currently distributed.\r\n\r\n## Impact\r\n\r\nAutomated installations of Node.js binaries which depend upon the documented method of verifying release signatures are no longer functional. No suitable alternatives currently exist for obtaining public keys of the Node.js release team.\r\n\r\nAny tools which continue to rely on the SKS keyserver network may be rendered unusable by certificates poisoned via CVE-2019-13050.\r\n\r\n## Bottom Line\r\n\r\nThe SKS keyserver network is no longer a viable option for distributing release keys.\r\n\r\n## Details\r\n\r\nWith the recent and unmitigated [death](https://code.firstlook.media/the-death-of-sks-pgp-keyservers-and-how-first-look-media-is-handling-it) of the [SKS keyserver network](https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f#the-consequences) (in [CVE-2019-13050](https://nvd.nist.gov/vuln/detail/CVE-2019-13050)), the [documented method](https://github.com/nodejs/node#release-keys) of obtaining the PGP public keys of the release team is no longer viable, and in fact may have [dire consequences to an OpenPGP installation](https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f#mitigations). A different method of [distributing release keys](https://keys.openpgp.org/), or even of [signing and verifying](https://jedisct1.github.io/minisign/) the release package itself, is necessary.\r\n\r\n## Proposed Solution\r\n\r\nFor minimal impact, my recommendation would be to place the public keys or authorized releasers within this repo, under a **/keys** directory, in a manner similar to that of [signed RubyGems](https://guides.rubygems.org/security/#building-gems) (except instead of X.509 certificates in a *certs/* directory, we'd be talking about ASCII-armored PGP certificates in a *keys/* directory), and update the README with instructions on how to import those keys into the OpenGPG keychain from the repo instead of from the SKS keyserver network.\r\n\r\nAlternatively, or in addition to the above, publishing these keys to nodejs.org may also provide a second factor to build assurance of the keys' integrity.\r\n\r\n\u003e :bulb: Especially paranoid users may want to seek additional verification from unaffiliated yet equally trusted soruces by fetching and comparing keys from those sources as well.\r\n","author":{"url":"https://github.com/canterberry","@type":"Person","name":"canterberry"},"datePublished":"2019-09-12T00:09:24.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":5},"url":"https://github.com/29531/node/issues/29531"}