René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Docs: Missing instructions for importing previous release keys","articleBody":"## Situation\n\nIn the README section [Release keys](https://github.com/nodejs/node/blob/main/README.md#release-keys) there is a folded section \"Other keys used to sign some previous releases\". For these keys there are no instructions about how to import these keys. The keys are:\n\n* **Beth Griggs** \u003c\u003cbethanyngriggs@gmail.com\u003e\u003e\n  `4ED778F539E3634C779C87C6D7062848A1AB005C`\n* **Bryan English** \u003c\u003cbryan@bryanenglish.com\u003e\u003e\n  `141F07595B7B3FFE74309A937405533BE57C7D57`\n* **Chris Dickinson** \u003c\u003cchristopher.s.dickinson@gmail.com\u003e\u003e\n  `9554F04D7259F04124DE6B476D5A82AC7E37093B`\n* **Colin Ihrig** \u003c\u003ccjihrig@gmail.com\u003e\u003e\n  `94AE36675C464D64BAFA68DD7434390BDBE9B9C5`\n* **Danielle Adams** \u003c\u003cadamzdanielle@gmail.com\u003e\u003e\n  `1C050899334244A8AF75E53792EF661D867B9DFA`\n  `74F12602B6F1C4E913FAA37AD3A89613643B6201`\n* **Evan Lucas** \u003c\u003cevanlucas@me.com\u003e\u003e\n  `B9AE9905FFD7803F25714661B63B535A4C206CA9`\n* **Gibson Fahnestock** \u003c\u003cgibfahn@gmail.com\u003e\u003e\n  `77984A986EBC2AA786BC0F66B01FBB92821C587A`\n* **Isaac Z. Schlueter** \u003c\u003ci@izs.me\u003e\u003e\n  `93C7E9E91B49E432C2F75674B0A78B0A6C481CF6`\n* **Italo A. Casas** \u003c\u003cme@italoacasas.com\u003e\u003e\n  `56730D5401028683275BD23C23EFEFE93C4CFFFE`\n* **James M Snell** \u003c\u003cjasnell@keybase.io\u003e\u003e\n  `71DCFD284A79C3B38668286BC97EC7A07EDE3FC1`\n* **Jeremiah Senkpiel** \u003c\u003cfishrock@keybase.io\u003e\u003e\n  `FD3A5288F042B6850C66B31F09FE44734EB7990E`\n* **Juan José Arboleda** \u003c\u003csoyjuanarbol@gmail.com\u003e\u003e\n  `61FC681DFB92A079F1685E77973F295594EC4689`\n* **Julien Gilli** \u003c\u003cjgilli@fastmail.fm\u003e\u003e\n  `114F43EE0176B71C7BC219DD50A3051F888C628D`\n* **Myles Borins** \u003c\u003cmyles.borins@gmail.com\u003e\u003e\n  `C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8`\n* **Rod Vagg** \u003c\u003crod@vagg.org\u003e\u003e\n  `DD8F2338BAE7501E3DD5AC78C273792F7D83545D`\n* **Ruben Bridgewater** \u003c\u003cruben@bridgewater.de\u003e\u003e\n  `A48C2BEE680E841632CD4E44F07496B3EB3C1762`\n* **Shelley Vohr** \u003c\u003cshelley.vohr@gmail.com\u003e\u003e\n  `B9E2F5981AA6E0CD28160D9FF13993A75599653C`\n* **Timothy J Fontaine** \u003c\u003ctjfontaine@gmail.com\u003e\u003e\n  `7937DFD2AB06298B2293C3187D33FF9D0246406D`\n\n## Assessment\n\n### Category A\n\nSome keys can be imported from `hkps://keys.openpgp.org`, the same as the primary PGP keys:\n\n```shell\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C # Beth Griggs\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 141F07595B7B3FFE74309A937405533BE57C7D57 # Bryan English\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5 # Colin Ihrig\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 74F12602B6F1C4E913FAA37AD3A89613643B6201 # Danielle Adams\ngpg --keyserver hkps://keys.openpgp.org --recv-keys B9AE9905FFD7803F25714661B63B535A4C206CA9 # Evan Lucas\ngpg --keyserver hkps://keys.openpgp.org --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 # Myles Borins\ngpg --keyserver hkps://keys.openpgp.org --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D # Rod Vagg\ngpg --keyserver hkps://keys.openpgp.org --recv-keys B9E2F5981AA6E0CD28160D9FF13993A75599653C # Shelley Vohr\n```\n\n### Category B\n\nKeys available in `hkps://keys.openpgp.org` but stripped of identity (see https://keys.openpgp.org/about/faq#verify-multiple) because a new key has been submitted re-using the identity. In this case, if an attempt is made to import them from `hkps://keys.openpgp.org` they report \"new key but contains no user ID - skipped\", skipping import and returning a success code. They can be imported instead from `keyserver.ubuntu.com`\n\n```shell\ngpg --keyserver keyserver.ubuntu.com --recv-keys 61FC681DFB92A079F1685E77973F295594EC4689 # Juan José Arboleda\n```\n\nThe key `C0D6248439F1D5604AAFFB4021D900FFDB233756`, currently shown in the \"Primary GPG\" list has also joined this category. See issue https://github.com/nodejs/node/issues/58904\n\n```shell\ngpg --keyserver keyserver.ubuntu.com --recv-keys C0D6248439F1D5604AAFFB4021D900FFDB233756 # Antoine du Hamel\n```\n\n### Category C\n\nKeys not available in `hkps://keys.openpgp.org` and available in `keyserver.ubuntu.com`\n\n```shell\ngpg --keyserver keyserver.ubuntu.com --recv-keys 9554F04D7259F04124DE6B476D5A82AC7E37093B # Chris Dickinson\ngpg --keyserver keyserver.ubuntu.com --recv-keys 77984A986EBC2AA786BC0F66B01FBB92821C587A # Gibson Fahnestock\ngpg --keyserver keyserver.ubuntu.com --recv-keys 93C7E9E91B49E432C2F75674B0A78B0A6C481CF6 # Isaac Z. Schlueter\ngpg --keyserver keyserver.ubuntu.com --recv-keys 56730D5401028683275BD23C23EFEFE93C4CFFFE # Italo A. Casas\ngpg --keyserver keyserver.ubuntu.com --recv-keys 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1 # James M Snell\ngpg --keyserver keyserver.ubuntu.com --recv-keys FD3A5288F042B6850C66B31F09FE44734EB7990E # Jeremiah Senkpiel\ngpg --keyserver keyserver.ubuntu.com --recv-keys 114F43EE0176B71C7BC219DD50A3051F888C628D # Julien Gilli\ngpg --keyserver keyserver.ubuntu.com --recv-keys A48C2BEE680E841632CD4E44F07496B3EB3C1762 # Ruben Bridgewater\ngpg --keyserver keyserver.ubuntu.com --recv-keys 7937DFD2AB06298B2293C3187D33FF9D0246406D # Timothy J Fontaine\n```\n\n### Category D\n\nKeys not available in `hkps://keys.openpgp.org` or in `keyserver.ubuntu.com`\n\n```shell\ncurl -s https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/1C050899334244A8AF75E53792EF661D867B9DFA.asc | gpg --import # Danielle Adams\n```\n\n## Suggestion\n\nAdd information to the [Release keys](https://github.com/nodejs/node/blob/main/README.md#release-keys) on how to import keys from the \"Other keys used to sign some previous releases\" section.\n\n## PoC\n\nFrom the above assessment, the following shows how all keys can be imported on a key-for-key basis, including those in the current \"Primary PGP\" category.\n\nDiscussions in issue https://github.com/nodejs/node/issues/58904 are proposing to not rely on keyservers. This shows how keyservers can be used with minimal change to current usage and processes.\n\n```shell\ndocker run -it --rm debian\n```\n\nThen at bash prompt execute:\n\n```shell\napt-get update \u0026\u0026 apt-get install -y gnupg ca-certificates curl\n# Primary PGP keys\ngpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 # Juan José Arboleda\ngpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F # Marco Ippolito\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 # Michaël Zasso\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga\ngpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno\ngpg --keyserver hkps://keys.openpgp.org --recv-keys A363A499291CBBC940DD62E41F10027AF002F8B0 # Ulises Gascón\n# Other keys\n# Category A\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C # Beth Griggs\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 141F07595B7B3FFE74309A937405533BE57C7D57 # Bryan English\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5 # Colin Ihrig\ngpg --keyserver hkps://keys.openpgp.org --recv-keys 74F12602B6F1C4E913FAA37AD3A89613643B6201 # Danielle Adams\ngpg --keyserver hkps://keys.openpgp.org --recv-keys B9AE9905FFD7803F25714661B63B535A4C206CA9 # Evan Lucas\ngpg --keyserver hkps://keys.openpgp.org --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 # Myles Borins\ngpg --keyserver hkps://keys.openpgp.org --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D # Rod Vagg\ngpg --keyserver hkps://keys.openpgp.org --recv-keys B9E2F5981AA6E0CD28160D9FF13993A75599653C # Shelley Vohr\n# Category B\ngpg --keyserver keyserver.ubuntu.com --recv-keys C0D6248439F1D5604AAFFB4021D900FFDB233756 # Antoine du Hamel\ngpg --keyserver keyserver.ubuntu.com --recv-keys 61FC681DFB92A079F1685E77973F295594EC4689 # Juan José Arboleda\n# Category C\ngpg --keyserver keyserver.ubuntu.com --recv-keys 9554F04D7259F04124DE6B476D5A82AC7E37093B # Chris Dickinson\ngpg --keyserver keyserver.ubuntu.com --recv-keys 77984A986EBC2AA786BC0F66B01FBB92821C587A # Gibson Fahnestock\ngpg --keyserver keyserver.ubuntu.com --recv-keys 93C7E9E91B49E432C2F75674B0A78B0A6C481CF6 # Isaac Z. Schlueter\ngpg --keyserver keyserver.ubuntu.com --recv-keys 56730D5401028683275BD23C23EFEFE93C4CFFFE # Italo A. Casas\ngpg --keyserver keyserver.ubuntu.com --recv-keys 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1 # James M Snell\ngpg --keyserver keyserver.ubuntu.com --recv-keys FD3A5288F042B6850C66B31F09FE44734EB7990E # Jeremiah Senkpiel\ngpg --keyserver keyserver.ubuntu.com --recv-keys 114F43EE0176B71C7BC219DD50A3051F888C628D # Julien Gilli\ngpg --keyserver keyserver.ubuntu.com --recv-keys A48C2BEE680E841632CD4E44F07496B3EB3C1762 # Ruben Bridgewater\ngpg --keyserver keyserver.ubuntu.com --recv-keys 7937DFD2AB06298B2293C3187D33FF9D0246406D # Timothy J Fontaine\n# Category D\ncurl -s https://raw.githubusercontent.com/nodejs/release-keys/HEAD/keys/1C050899334244A8AF75E53792EF661D867B9DFA.asc | gpg --import # Danielle Adams\n# Summary\necho pgp public key count $(gpg --list-keys | grep ^pub | wc -l)\n```\n","author":{"url":"https://github.com/MikeMcC399","@type":"Person","name":"MikeMcC399"},"datePublished":"2025-07-07T07:19:10.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":5},"url":"https://github.com/58979/node/issues/58979"}