NERUDO

main @ 55a1b0b

Connected

Recorded landings: 10

Read-only access

Sign in
nerudo/docsPublic
Loading community…

Files

main
Browse repository
Loading files…

0 entries

≡

account/signing-keys.md

at 55a1b0b

Signing keys

What these keys do

Nerudo approval key — The Nerudo command-line program uses this key for approval. Repository policy controls its approval rights.

GPG key — GPG is a program for digital signatures. Use Signing keys settings to add proof that you control a GPG key to your account.

Git commit signing — Git can add your digital signature to a commit on your computer. Account settings do not start that operation.

The GPG check does not give sign-in rights or repository approval rights. Nerudo does not check Git commit signatures at this time.

Use the Nerudo approval key

This key uses raw Ed25519 data. The private key stays in the local Nerudo key file.

The key file is ~/.nerudo/key. The CLI does not read the old file ~/.landseq/key. If your key is in the old file, copy it to ~/.nerudo/key.

A seal is a Nerudo approval signature for one commit. A trunk ID identifies the repository for the CLI.

A configured Nerudo CLI connection is necessary. Developer access credentials do not authorize approvals.

  1. Enter this command to show the public key:

    bash
    nerudo pubkey

  2. Open Signing keys settings.

  3. Compare the output with the public key under Nerudo approval key.

  4. If the keys differ, stop.

  5. Ask a repository maintainer to make sure that nerudo.toml contains your public key under [[approvers]].

  6. Replace TRUNK_ID and CHANGE_ID with the repository and change identifiers in the command below.

  7. Enter this command to examine a change:

    bash
    nerudo seal --trunk TRUNK_ID --change CHANGE_ID

  8. Read the commit and approval reasons that the CLI shows.

  9. At the confirmation prompt, enter y only if you accept that commit.

The CLI sends an approval signature for that commit. Other approvals can still be necessary.

GPG enrollment does not enable approvals. Do not replace your Nerudo private key to complete the GPG check.

Go to the GPG key form

Prepare a GPG key

Public key — Data that other users can use to verify a digital signature.

Private key — Secret data that GPG uses to make a digital signature. A passphrase is a password for this key.

Fingerprint — The full identifier of a public key.

  1. Install GPG on your computer.

  2. Enter this command to find keys on your computer:

    bash
    gpg --list-secret-keys --keyid-format long --with-fingerprint

  3. If no GPG key is available, enter this command:

    bash
    gpg --full-generate-key

    Use Ed25519 or RSA with 3072–8192 bits. GPG keeps the private key on your computer.

  4. Replace YOUR_FINGERPRINT with your full fingerprint in the next command.

  5. Enter this command to make a public-key file:

    bash
    gpg --armor --export YOUR_FINGERPRINT > nerudo-public-key.asc

Add proof of GPG ownership

Use the form in Signing keys settings for these steps.

Challenge — A file from Nerudo for one ownership check. The challenge expires after five minutes.

Detached signature — A separate file that contains a digital signature for the challenge.

Armored file — A text form of a public key or digital signature.

  1. Confirm your sign-in with a connected sign-in method.
  2. Enter a name in Key name.
  3. Paste the contents of nerudo-public-key.asc into Public GPG key.
  4. Select Prepare ownership challenge. Nerudo downloads nerudo-signing-key.txt.
  5. Open a terminal in the directory with the downloaded challenge.
  6. Enter the GPG command that Nerudo shows below the form. GPG makes nerudo-signing-key.txt.asc.
  7. Paste the contents of nerudo-signing-key.txt.asc into GPG signature.
  8. Select Verify ownership before the five-minute limit.

After Nerudo accepts the proof, the key shows Ownership verified. Nerudo keeps the public key and the verification date.

A new sign-in ends the challenge. An expired challenge requires a new ownership check.

Optional: sign Git commits on your computer

Git commit signing works without GPG enrollment in Nerudo. The Git commands below change only the selected local repository.

  1. Open a terminal in your local Git repository.

  2. Replace YOUR_FINGERPRINT with your full fingerprint in the commands below.

  3. Enter this command to select OpenPGP signatures:

    bash
    git config --local gpg.format openpgp

  4. Enter this command to select your key:

    bash
    git config --local user.signingkey YOUR_FINGERPRINT

  5. Enter this command to sign new commits:

    bash
    git config --local commit.gpgsign true

Git uses GPG for new commit signatures. Repository policy still controls approval rights in Nerudo.

Protect your private key

Keep your private key and passphrase on your computer. Upload only the public key and the detached signature.

Do not change the downloaded challenge. The GPG command must include --no-textmode to sign the same bytes.

The ownership check applies to the public key that you submit. Nerudo does not get subsequent revocations from keyservers.

Mark revoked changes the Nerudo record only. It does not revoke the key in GPG.

Related guides