Signing event: sign/keyid-fix

[github-actions]

Processing signing event sign/keyid-fix, please wait.

[github-actions]

Current signing event state

Event sign/keyid-fix (commit 3ced57e)

✅ root

Role root is verified and signed by 1/1 (1/1) signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

❌ targets

Role targets is not yet verified. It is signed by 1/2 signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

[jku]

I'm testing theupdateframework/tuf-on-ci#338 here -- will take a few more commits before it's ready

[github-actions]

Current signing event state

Event sign/keyid-fix (commit 2e40788)

✅ root

Role root is verified and signed by 1/1 (1/1) signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

❌ targets

Role targets is not yet verified. It is signed by 1/2 signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

❌ rdimitrov

Role rdimitrov is unsigned and not yet verified
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

✅ jku

Role jku is verified and signed by 1/1 signers (@jku).

❌ kommendorkapten

Role kommendorkapten is unsigned and not yet verified
Still missing signatures from @kommendorkapten
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

[github-actions]

Current signing event state

Event sign/keyid-fix (commit 8458fc1)

✅ root

Role root is verified and signed by 1/1 (1/1) signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

✅ targets

Role targets is verified and signed by 1/1 signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

❌ rdimitrov

Role rdimitrov is unsigned and not yet verified
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

✅ jku

Role jku is verified and signed by 1/1 signers (@jku).

❌ kommendorkapten

Role kommendorkapten is unsigned and not yet verified
Still missing signatures from @kommendorkapten
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

[github-actions]

Current signing event state

Event sign/keyid-fix (commit e7a54cf)

✅ root

Role root is verified and signed by 1/1 (1/1) signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

✅ targets

Role targets is verified and signed by 1/1 signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

✅ jku

Role jku is verified and signed by 1/1 signers (@jku).

❌ kommendorkapten

Role kommendorkapten is unsigned and not yet verified
Still missing signatures from @kommendorkapten
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

✅ rdimitrov

Role rdimitrov is verified and signed by 1/1 signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

[jku]

Documenting for myself and others. Commands I've run:

# fix keyids defined in root and targets
tuf-on-ci-delegate --force-compliant-keyids sign/keyid-fix root
tuf-on-ci-delegate --force-compliant-keyids sign/keyid-fix targets

# drop targets threshold to 1 since rado is not available for signing today 
tuf-on-ci-delegate sign/keyid-fix targets

# add myself as signer for role "rdimitrov" for same reason 
tuf-on-ci-delegate sign/keyid-fix rdimitrov

I think it looks correct. Wince rado isn't available we end up with empty sigs ("sig": "", theupdateframework/tuf-on-ci#157) which isn't ideal since the specs not crystal clear on it but

• I consider that valid metadata
• We could even do a cleanup commit that removes the empty sigs, it's just manual json editing...

[github-actions]

Current signing event state

Event sign/keyid-fix (commit 297c4d0)

✅ root

Role root is verified and signed by 1/1 (1/1) signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

✅ targets

Role targets is verified and signed by 1/1 signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

✅ jku

Role jku is verified and signed by 1/1 signers (@jku).

✅ rdimitrov

Role rdimitrov is verified and signed by 1/1 signers (@jku).
Still missing signatures from @rdimitrov
Signers can sign these changes by running tuf-on-ci-sign sign/keyid-fix

✅ kommendorkapten

Role kommendorkapten is verified and signed by 1/1 signers (@kommendorkapten).

Signing event is successful

Threshold of signatures has been reached: this signing event can be reviewed and merged.

[jku]

This looks fine to me. I will merge to see if the online signing is ok with this keyid fix: if not I will likely revert the whole thing and start again another day