Repository navigation
PGP keys verification #965
Description
Context
- The full context can be found at GHSA-76h5-j8cf-q8vj and GHSA-jcj3-qxpv-gxm2.
- Additional offline conversation at Slack
Action items
- As part of the onboarding the releasers should add the PGP key(s) to the Github profile, like Ulises' example
- Create a PR to update the onboarding steps (@UlisesGascon). docs: add GPG validation onboarding step #966
- Ensure that all the releasers has completed this step
Activity
docs: add gpg validation onboarding step
nschonni commentedon Dec 4, 2023
Aside: why is the website repo being used for security advisories? That doesn't seem to line up with the security reporting policy
ovflowd commentedon Dec 10, 2023
IDK, someone just created one for nodejs.org; I'm not sure if this is a setting on the nodejs.org repository, and if yes, if I should disable. cc @nodejs/tsc
UlisesGascon commentedon Feb 26, 2024
I was checking the changes with the team, I am waiting for a final update for two signatures and then we can close this issue.
ovflowd commentedon Jun 3, 2024
Is there any update here?
docs: add gpg validation onboarding step
ovflowd commentedon Sep 25, 2026
This seems to have become stale. @nodejs/releasers anything actionable here?