...
|
# Use ssh-keygen to create an SSH key.
{note}
|
* Follow the latest steps and guides on the ASF website at [http://www.apache.org/dev/openpgp.html#generate-key] as you need to disable using SHA1 and new keys should be 4096 bits.
|
* ssh-keygen dsa key type only accept 1024 bits; use rsa / 4096 bits instead and adjust all the id_dsa* reference to id_rsa*.{note}
|
{code:none}
|
$ ssh-keygen -t drsa -b 4096
|
{code}
|
* Program defaults should be fine. No passphrase is required for the ssh key generation. The keys will be saved in ~/.ssh/id_drsa (private) and ~/.ssh/id_drsa.pub (public).
|
{info} See [Authenticating By Public Key (OpenSSH)|http://www.networknewz.com/networknewz-10-20030707AuthenticatingbyPublicKeyOpenSSH.html] for a good description on why and how to perform this task.
{info}
|
# {{scp}} your SSH public key ~/.ssh/id_drsa.pub created in last step to ~/id_drsa.pub on people.apache.org.
|
{code:none}
$ cd ~/.ssh
|
$ scp id_dsa.pub <your userid>@people.apache.org:id_dsa.pub
|
$ scp id_rsa.pub <your userid>@people.apache.org:id_rsa.pub
|
$ You will be prompted for your password.
{code}
|
...
|
$ ssh <your userid>@people.apache.org
{code}
|
* At this point, you will still be prompted for your password.
|
# Create a ~/.ssh folder in your home directory on people.apache.org and change its file mode to 700.
{code:none}
|
...
|
$ chmod 700 ~/.ssh
{code}
|
# Move or append ~/id_drsa.pub to ~/.ssh/authorized_keys and change its file mode to 600.
|
{code:none}
|
$ mv ~/id_drsa.pub ~/.ssh/authorized_keys
|
or
$ cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
|
$ chmod 600 ~/.ssh/authorized_keys
{code}
|
...
|
# Open a shell window. If using Windows, open a cygwin window.
|
{info}
* The generated keys are stored in:
** *nix - $HOME/.gnupg
** Windows XP - %HOME%\Application Data\gnupg
** Windows 7 - C:\ProgramData\GNU\etc\gnupg
* "gpg --version" shows the GnuPG's home location.
* Follow the latest steps and guides on the ASF website at [http://www.apache.org/dev/openpgp.html#generate-key] as you need to disable using SHA1 and new keys should be 4096 bits. Append the following text to gpg.conf.
{code:none}
personal-digest-preferences SHA512
cert-digest-algo SHA512
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
{code}
{info}
|
# Generate a key-pair with gpg, using default key kind ("DSA and Elgamal") and ELG-E keys size (2048).
{code:none}
$ gpg --gen-key
{code}
|
* The program's default values should be fine. For the "Real Name" enter your full name (ie. Stan Programmer). For the "e-mail address" enter your apache address (ie. [email protected]). You will also be required to enter a "passphrase" for the GPG key generation. Keep track of this as you will need this for the Release processing.
|
{info}
|
* The generated keys are stored in $HOME/.gnupg (*nix), %HOME%\Application Data\gnupg subdirectory (Windows XP) or C:\ProgramData\GNU\etc\gnupg (Windows 7).
* "gpg --version" shows the GnuPG's home location.
|
* Save the content in this subdirectory to a safe media. This contains your private key used to sign all the release materials.
{info}
|
# Backup your cygwin home directory to another media
|
# Append your public key to {{[https://svn.apache.org/repos/asf/openjpa/KEYS]}} and {{http://www.apache.org/dist/openjpa/KEYS}}. See the commands describe at the beginning of this KEYS file to perform this task. The gpg key-pair is used to sign the published artifacts for the releases.
{code:none}
|
...
|
{code}
{info}
|
# Submit your public key to a key server. E.g. [http://pgp.surfnet.nl:11371/] or [http://pgp.mit.edu/]
|
# Following the instructions in [http://people.apache.org/~henkp/trust/] and ask multiple (at least 3) current Apache committers to sign your public key.
|
...
|
