Skip to main content

Maintainer guide

This page contains an overview of the steps for the regular, day-to-day signing activities. It is intended as a mental aid for FMD maintainers.

Helper scripts are available here: https://gitlab.com/fmd-foss/key-management

See also the RELEASING.md of FMD Android and FMD Server. Those contain more details, because this guide focusses on the signing parts.

Workspace setup​

  1. Get a spare laptop and a Nitrokey HSM.
  2. Install Debian on the spare laptop.
  3. Initialise the Nitrokey with an SO PIN and User PIN, and waiting for a DKEK import. These are personal to you and your Nitrokey; do not share them.
  4. If this is the first time: Create a DKEK, splitting its encryption password with m-of-n.
  5. Import the DKEK into your Nitrokey.
  6. If this is an additional key: Import all relevant private keys from the wrapped exports.

Key generation​

  1. Generate key pairs for all purposes (APK, F-Droid repo, Server).
  2. Export the CVC-REQs (for attestation).
  3. Create self-signed certificates for the key pairs that will be used by Java tooling (APK, F-Droid).
  4. Import the certificates into the Nitrokey.

Backup​

  1. Create wrapped exports of all private keys.
  2. Export all public keys.
  3. Copy the wrapped private keys, the public keys, the attestation certificate chains, and the self-signed certificates onto an external backup medium.

Usage (FMD Android)​

Build the APK:

  1. Compile an unsigned APK on your build machine.
  2. Make sure the APK is reproducible.
  3. Copy the APK to the signing laptop.
  4. Sign the APK.
  5. Copy the signed APK back to your main laptop.
  6. Check that the signed APK is still reproducible.
  7. Publish the APK.

Build the F-Droid repo:

  1. Clone the GitLab repo.
  2. Copy the APK that you signed above to the repository root.
  3. source venv/bin/activate your fdroidserver installation.
  4. fdroid update
  5. Commit and push.
  6. Deploy to https://packages.fmd-foss.org/fdroid/repo

Usage (FMD Server)​

  1. Build the release ZIP.
  2. Make sure the ZIP is reproducible.
  3. Sign the ZIP.
  4. Upload the files to https://packages.fmd-foss.org/server