# Wren Linux's signing key, kept by a user of its own (`extras/signing-key.sh`)

## SYNOPSIS

```
wrenctl install signing-key                     set up the signer and the wren-key command
wrenctl remove signing-key                      take them out (asks before deleting the signing subkey)
wrenctl manual signing-key                      print the manual steps below

wren-key                    the first time: questions, the key, its backup on your stick
wren-key status             the key, until when it signs, and what uses it
wren-key git-setup [DIR]    git in DIR signs every commit and tag with it
wren-key pin [DIR]          DIR's pins.sh and data/ name the key (then commit and push)
wren-key sign-repo FOLDER DEB...   a signed apt repository of Wren Linux's packages
wren-key renew BACKUP       two more years for the signing subkey, from the backup
wren-key restore BACKUP [FINGERPRINT]   on a new computer: the key from its backup
```

On a new computer (or after reinstalling), don't make a second key: set up the extra, mount your
stick (`usb mount`), and run
`wren-key restore /media/$USER/STICK/wren-signing-key/wren-signing-key-backup.asc`.

It takes only the key `pins.sh` pins (or the one you name), asks the backup's passphrase, and keeps
only the signing subkey here, as the first run does. Then `wren-key git-setup ~/wren-linux` if git
should sign with it there.

To keep the backup on an encrypted stick, run `bash encrypt-usb.sh` first, and open it with
`usb mount`. This extra is only in a git copy of Wren Linux, not the package
(`wrenctl install wren-dev` gets one). Where the package is installed, run its `wrenctl` lines as
`WREN_DIR=~/wren-linux wrenctl ...`.

For the computer you publish Wren Linux from. Every Wren Linux computer checks its updates against
this one key (`update.sh` for commits, apt for the package), so whoever has it could put anything on
all of them, as root.

It is made in two parts: the primary key, which only vouches for the other, goes into an encrypted
backup on your USB stick and is then deleted from this computer; the signing subkey stays here, held
by `wren-signer`, a system user with no password, no login and no network (a firewall rule drops
everything it sends), whose files your own user can't read.

Your user may run one program as it, the signer, and only after typing your sudo password; the
signer signs, hands out the public key and makes, renews or restores the key, and never hands out a
secret key.

`wren-key` asks the signer for what it needs: on the first run it explains, asks your name, email,
where the backup goes and its passphrase, makes the key, writes the backup, a revocation certificate
and the public key to the stick, and offers to set up git signing and to pin the key.

## LIMITS

- The signing subkey is on this computer: root (or anyone who becomes root) can read it, and a
  program running as you can have something signed within the few minutes sudo remembers your
  password in that terminal. If you think it was taken, replace it from the backup and publish the
  revocation.
- While `wren-key` makes, renews or restores the key, the backup's passphrase and the backup pass
  through programs running as you: one that is hacked could take the primary key then. So it does
  those only at a quiet moment: the network off, within 30 minutes of a restart, no window open but
  its terminal, and nothing listed by the startup watch (which it asks to look again first). Restart,
  log in, turn the network off, and run it before anything else. These checks keep you from doing
  it at a bad moment by mistake; a program already running as you could fake their answers, and one
  with no window, or started again by something the startup watch doesn't cover, isn't seen.
- The backup is only as safe as its passphrase and the stick: keep the passphrase on paper away from
  the stick, and a second stick in another place. Lose both the backup and the passphrase and the
  key can't be renewed: every Wren Linux computer then needs a new key by hand.
- The signing subkey stops signing after two years. Renew it well before (`wren-key status` warns 90
  days ahead) and publish the renewed public key while the old one still signs.
- The revocation certificate works without the passphrase: whoever has it can void your key (though
  not sign with it). Keep it apart from the sticks.
- It doesn't protect the computer it runs on; it keeps the key apart from your user on it.

## MANUAL INSTALL

```
# gpg, and nftables for the firewall rule
sudo apt install --no-install-recommends gpg gpg-agent nftables
# The firewall rule first: the user never has a moment on the network
sudo install -D -o root -g root -m 0644 @WREN_DIR@/data/signer-firewall.nft /etc/wren/signer.nft
printf '%s\n' '[Unit]' 'Description=Keep wren-signer off every network' \
    'Before=network-pre.target' 'Wants=network-pre.target' '' '[Service]' \
    'Type=oneshot' 'RemainAfterExit=yes' 'ExecStart=/usr/sbin/nft -f /etc/wren/signer.nft' \
    'ExecStop=/usr/sbin/nft delete table inet wren_signer' '' '[Install]' 'WantedBy=multi-user.target' |
    sudo tee /etc/systemd/system/wren-signer-firewall.service
# The user: no password, no login, its home its own
sudo useradd --system --user-group --home-dir /var/lib/wren-signer --no-create-home --shell /usr/sbin/nologin --comment "Wren Linux signing key, off the network" wren-signer
sudo usermod --lock --shell /usr/sbin/nologin wren-signer
sudo install -d -o wren-signer -g wren-signer -m 0700 /var/lib/wren-signer
sudo systemctl daemon-reload
sudo systemctl enable --now wren-signer-firewall.service
# check it is loaded before going on: this prints the drop rule
sudo nft list table inet wren_signer
# The signer, root's
sudo install -d -o root -g root -m 0755 /usr/local/libexec
sudo install -o root -g root -m 0755 @WREN_DIR@/bin/wren-signer /usr/local/libexec/wren-signer
# Your user may run the signer, and nothing else, as wren-signer, with your
# password (not NOPASSWD). visudo checks the rule first.
printf '%s ALL=(wren-signer) /usr/local/libexec/wren-signer\n' "$(id -un)" >/tmp/wren-signer
sudo visudo -cf /tmp/wren-signer
sudo install -o root -g root -m 0440 /tmp/wren-signer /etc/sudoers.d/wren-signer
rm /tmp/wren-signer
# The command, and its man page
install -D -m 0755 @WREN_DIR@/bin/wren-key ~/.local/bin/wren-key
install -D -m 0755 @WREN_DIR@/bin/wren-key-gpg ~/.local/bin/wren-key-gpg
install -D -m 0644 @WREN_DIR@/data/wren-key.1 ~/.local/share/man/man1/wren-key.1
# Then, with a USB stick mounted:
wren-key
```

To undo:

```
sudo rm /etc/sudoers.d/wren-signer /usr/local/libexec/wren-signer
rm ~/.local/bin/wren-key ~/.local/bin/wren-key-gpg ~/.local/share/man/man1/wren-key.1
# Only if your backup is safe: this deletes the signing subkey
sudo userdel wren-signer
sudo rm -rf /var/lib/wren-signer
sudo systemctl disable --now wren-signer-firewall.service
sudo rm /etc/systemd/system/wren-signer-firewall.service /etc/wren/signer.nft
sudo systemctl daemon-reload
```