「DeveloperWiki:パッケージの署名」の版間の差分

提供: ArchWiki
ナビゲーションに移動 検索に移動
 
(セクション見出しの訳出)
1行目: 1行目:
−
[[Category:DeveloperWiki]]__NOTOC__
 +
[[Category:DeveloperWiki]]
  +
[[en:DeveloperWiki:Signing Packages]]
  +
__NOTOC__
   
−
==Choose a UID==
 +
==UID を選ぶ==
 
* Use a valid e-mail address: no obfuscation.
  
* Use a valid e-mail address: no obfuscation.
 
* The e-mail address should be reliable (do not use one you got from your ISP or a random free service).
  
* The e-mail address should be reliable (do not use one you got from your ISP or a random free service).
9行目: 11行目:
 
* We strongly advise you use your real name. It has to be exactly that found on official documents (passport, driver's license, etc.); see [http://wiki.cacert.org/PracticeOnNames CAcert's practice on names].
  
* We strongly advise you use your real name. It has to be exactly that found on official documents (passport, driver's license, etc.); see [http://wiki.cacert.org/PracticeOnNames CAcert's practice on names].
   
  +
==キーペアを作る==
−
==Create a key pair==
  
 
# Install <code>gnupg</code>.
  
# Install <code>gnupg</code>.
 
# Run: <code>gpg --gen-key</code>
  
# Run: <code>gpg --gen-key</code>
18行目: 20行目:
 
# Backup your private key: <code>gpg --export-secret-keys pierre@archlinux.de > pierre@archlinux.de-private.asc</code>
  
# Backup your private key: <code>gpg --export-secret-keys pierre@archlinux.de > pierre@archlinux.de-private.asc</code>
   
  +
==推奨: キーを CAcert にサインしてもらう==
−
==Recommended: Get your key signed by CAcert==
  
 
# [https://www.cacert.org/index.php?id=1 Create an account on CAcert.]
  
# [https://www.cacert.org/index.php?id=1 Create an account on CAcert.]
 
# Meet CAcert assurers and have them verify your official identification documents; see [http://www.cacert.org/policy/AssurancePolicy.php CAcert's assurance policy].
  
# Meet CAcert assurers and have them verify your official identification documents; see [http://www.cacert.org/policy/AssurancePolicy.php CAcert's assurance policy].
26行目: 28行目:
 
## Save the signed key from the CAcert website and import it: <code>gpg --import <filename></code>
  
## Save the signed key from the CAcert website and import it: <code>gpg --import <filename></code>
   
  +
==推奨: キーを他の開発者にサインしてもらう==
−
==Recommended: Get your key signed by other devs==
  
 
# When ever you meet with another dev, sign each others' keys.
  
# When ever you meet with another dev, sign each others' keys.
 
# Take this seriously: never sign a key when you cannot verify the other person's identity.
  
# Take this seriously: never sign a key when you cannot verify the other person's identity.
 
# See [http://www.cacert.org/policy/AssurancePolicy.php CAcert's assurance policy] for good guidelines.
  
# See [http://www.cacert.org/policy/AssurancePolicy.php CAcert's assurance policy] for good guidelines.
   
  +
==公開鍵を公開する==
−
==Publish your public key==
  
 
# Send your public key to a keyserver:
  
# Send your public key to a keyserver:
 
## Check your key id with: <code>gpg -k</code>
  
## Check your key id with: <code>gpg -k</code>
37行目: 39行目:
 
# Add your key fingerprint to your profile at https://www.archlinux.org/devel/profile/
  
# Add your key fingerprint to your profile at https://www.archlinux.org/devel/profile/
   
−
==Be safe!==
 +
==安全に！==
 
# Create a backup of your keys and be sure not to forget the passphrase!
  
# Create a backup of your keys and be sure not to forget the passphrase!

2020年5月22日 (金) 13:34時点における版


UID を選ぶ

  • Use a valid e-mail address: no obfuscation.
  • The e-mail address should be reliable (do not use one you got from your ISP or a random free service).
  • When in doubt, you should prefer using your @archlinux.org address.
  • The UID also has to be the same as the PACKAGER variable you use to build packages.
  • A correct UID looks like this: Pierre Schmitz <pierre@archlinux.de>
  • We strongly advise you use your real name. It has to be exactly that found on official documents (passport, driver's license, etc.); see CAcert's practice on names.

キーペアを作る

  1. Install gnupg.
  2. Run: gpg --gen-key
    1. You may use the default: a never expiring 2048-bit RSA key for encryption and signing.
  3. Create a revocation certificate, for use when/if your private key ever gets compromised:
    1. Run: gpg -o ~/.gnupg/pierre@archlinux.de-revoke.asc --gen-revoke pierre@archlinux.de
    2. Make sure to store this file in a secure location (and/or encrypt it with a passphrase); then delete the plaintext version.
  4. Backup your private key: gpg --export-secret-keys pierre@archlinux.de > pierre@archlinux.de-private.asc

推奨: キーを CAcert にサインしてもらう

  1. Create an account on CAcert.
  2. Meet CAcert assurers and have them verify your official identification documents; see CAcert's assurance policy.
  3. You will then be able to access a new part of the CAcert website and get your key signed:
    1. Export your public key: gpg --export --armor pierre@archlinux.de > pierre@archlinux.de.asc
    2. Paste the content of that file into the form on the CAcert website.
    3. Save the signed key from the CAcert website and import it: gpg --import <filename>

推奨: キーを他の開発者にサインしてもらう

  1. When ever you meet with another dev, sign each others' keys.
  2. Take this seriously: never sign a key when you cannot verify the other person's identity.
  3. See CAcert's assurance policy for good guidelines.

公開鍵を公開する

  1. Send your public key to a keyserver:
    1. Check your key id with: gpg -k
    2. Run: gpg --send-keys KEY-ID
  2. Add your key fingerprint to your profile at https://www.archlinux.org/devel/profile/

安全に！

  1. Create a backup of your keys and be sure not to forget the passphrase!
「https://wiki.archlinux.jp/index.php?title=DeveloperWiki:パッケージの署名&oldid=16373」から取得