Skip to content

Commit aa02099

Browse files
peter-tothpeter-toth
committed
Update GPG key generation
1 parent 202781c commit aa02099

File tree

2 files changed

+47
-37
lines changed

2 files changed

+47
-37
lines changed

‎release-process.md‎

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -55,39 +55,45 @@ You can skip this section if you have already uploaded your key.
5555
<h4 id="generate-key">Generate key</h4>
5656

5757
Here's an example of gpg 2.0.12. If you use gpg version 1 series, please refer to <a href="https://www.apache.org/dev/openpgp.html#generate-key">generate-key</a> for details.
58+
Note that you need an `@apache.org` email address to prepare a Spark release with the `Release Apache Spark` GitHub action.
5859

5960
```
6061
$ gpg --full-gen-key
61-
gpg (GnuPG) 2.0.12; Copyright (C) 2009 Free Software Foundation, Inc.
62+
gpg (GnuPG) 2.4.8; Copyright (C) 2025 g10 Code GmbH
6263
This is free software: you are free to change and redistribute it.
6364
There is NO WARRANTY, to the extent permitted by law.
6465
6566
Please select what kind of key you want:
66-
(1) RSA and RSA (default)
67+
(1) RSA and RSA
6768
(2) DSA and Elgamal
6869
(3) DSA (sign only)
6970
(4) RSA (sign only)
71+
(9) ECC (sign and encrypt) *default*
72+
(10) ECC (sign only)
73+
(14) Existing key from card
74+
Your selection? 9
75+
Please select which elliptic curve you want:
76+
(1) Curve 25519 *default*
77+
(4) NIST P-384
78+
(6) Brainpool P-256
7079
Your selection? 1
71-
RSA keys may be between 1024 and 4096 bits long.
72-
What keysize do you want? (2048) 4096
73-
Requested keysize is 4096 bits
7480
Please specify how long the key should be valid.
7581
0 = key does not expire
7682
<n> = key expires in n days
7783
<n>w = key expires in n weeks
7884
<n>m = key expires in n months
7985
<n>y = key expires in n years
80-
Key is valid for? (0)
86+
Key is valid for? (0) 0
8187
Key does not expire at all
8288
Is this correct? (y/N) y
8389
8490
GnuPG needs to construct a user ID to identify your key.
8591
86-
Real name: Robert Burrell Donkin
87-
Email address: rdonkin@apache.org
92+
Real name: Peter Test
93+
Email address: ptest@apache.org
8894
Comment: CODE SIGNING KEY
8995
You selected this USER-ID:
90-
"Robert Burrell Donkin (CODE SIGNING KEY) <rdonkin@apache.org>"
96+
"Peter Test (CODE SIGNING KEY) <ptest@apache.org>"
9197
9298
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
9399
We need to generate a lot of random bytes. It is a good idea to perform
@@ -98,24 +104,23 @@ We need to generate a lot of random bytes. It is a good idea to perform
98104
some other action (type on the keyboard, move the mouse, utilize the
99105
disks) during the prime generation; this gives the random number
100106
generator a better chance to gain enough entropy.
101-
gpg: key 04B3B5C426A27D33 marked as ultimately trusted
102-
gpg: revocation certificate stored as '/home/ubuntu/.gnupg/openpgp-revocs.d/08071B1E23C8A7E2CA1E891A04B3B5C426A27D33.rev'
107+
gpg: revocation certificate stored as '/Users/ptest/.gnupg/openpgp-revocs.d/69DD5A189B3C274353A677214926E0E83FF6D044.rev'
103108
public and secret key created and signed.
104109
105-
pub rsa4096 2021-08-19 [SC]
106-
08071B1E23C8A7E2CA1E891A04B3B5C426A27D33
107-
uid Jack (test) <[email protected]>
108-
sub rsa4096 2021-08-19 [E]
110+
pub ed25519 2025-09-18 [SC]
111+
69DD5A189B3C274353A677214926E0E83FF6D044
112+
uid Peter Test (CODE SIGNING KEY) <[email protected]>
113+
sub cv25519 2025-09-18 [E]
109114
```
110115

111-
Note that the last 8 digits (26A27D33) of the public key is the <a href="https://infra.apache.org/release-signing.html#key-id">key ID</a>.
116+
Note that the last 8 digits (3FF6D044) of the public key is the <a href="https://infra.apache.org/release-signing.html#key-id">key ID</a>.
112117

113118
<h4 id="upload-key">Upload key</h4>
114119

115120
After generating the public key, we should upload it to <a href="https://infra.apache.org/release-signing.html#keyserver">public key server</a>:
116121

117122
```
118-
$ gpg --keyserver hkps://keys.openpgp.org --send-key 26A27D33
123+
$ gpg --keyserver hkps://keys.openpgp.org --send-key 3FF6D044
119124
```
120125

121126
Please refer to <a href="https://infra.apache.org/release-signing.html#keyserver-upload">keyserver-upload</a> for details.
@@ -125,7 +130,7 @@ Please refer to <a href="https://infra.apache.org/release-signing.html#keyserver
125130
To get the code signing key (a.k.a ASCII-armored public key), run the command:
126131

127132
```
128-
$ gpg --export --armor 26A27D33
133+
$ gpg --export --armor 3FF6D044
129134
```
130135

131136
And then append the generated key to the KEYS file by:

‎site/release-process.html‎

Lines changed: 24 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -220,39 +220,45 @@ <h3 id="preparing-gpg-key">Preparing gpg key</h3>
220220

221221
<h4 id="generate-key">Generate key</h4>
222222

223-
<p>Here&#8217;s an example of gpg 2.0.12. If you use gpg version 1 series, please refer to <a href="https://www.apache.org/dev/openpgp.html#generate-key">generate-key</a> for details.</p>
223+
<p>Here&#8217;s an example of gpg 2.0.12. If you use gpg version 1 series, please refer to <a href="https://www.apache.org/dev/openpgp.html#generate-key">generate-key</a> for details.
224+
Note that you need an <code class="language-plaintext highlighter-rouge">@apache.org</code> email address to prepare a Spark release with the <code class="language-plaintext highlighter-rouge">Release Apache Spark</code> GitHub action.</p>
224225

225226
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>$ gpg --full-gen-key
226-
gpg (GnuPG) 2.0.12; Copyright (C) 2009 Free Software Foundation, Inc.
227+
gpg (GnuPG) 2.4.8; Copyright (C) 2025 g10 Code GmbH
227228
This is free software: you are free to change and redistribute it.
228229
There is NO WARRANTY, to the extent permitted by law.
229230

230231
Please select what kind of key you want:
231-
(1) RSA and RSA (default)
232+
(1) RSA and RSA
232233
(2) DSA and Elgamal
233234
(3) DSA (sign only)
234235
(4) RSA (sign only)
236+
(9) ECC (sign and encrypt) *default*
237+
(10) ECC (sign only)
238+
(14) Existing key from card
239+
Your selection? 9
240+
Please select which elliptic curve you want:
241+
(1) Curve 25519 *default*
242+
(4) NIST P-384
243+
(6) Brainpool P-256
235244
Your selection? 1
236-
RSA keys may be between 1024 and 4096 bits long.
237-
What keysize do you want? (2048) 4096
238-
Requested keysize is 4096 bits
239245
Please specify how long the key should be valid.
240246
0 = key does not expire
241247
&lt;n&gt; = key expires in n days
242248
&lt;n&gt;w = key expires in n weeks
243249
&lt;n&gt;m = key expires in n months
244250
&lt;n&gt;y = key expires in n years
245-
Key is valid for? (0)
251+
Key is valid for? (0) 0
246252
Key does not expire at all
247253
Is this correct? (y/N) y
248254

249255
GnuPG needs to construct a user ID to identify your key.
250256

251-
Real name: Robert Burrell Donkin
252-
Email address: rdonkin@apache.org
257+
Real name: Peter Test
258+
Email address: ptest@apache.org
253259
Comment: CODE SIGNING KEY
254260
You selected this USER-ID:
255-
"Robert Burrell Donkin (CODE SIGNING KEY) &lt;rdonkin@apache.org&gt;"
261+
"Peter Test (CODE SIGNING KEY) &lt;ptest@apache.org&gt;"
256262

257263
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
258264
We need to generate a lot of random bytes. It is a good idea to perform
@@ -263,23 +269,22 @@ <h4 id="generate-key">Generate key</h4>
263269
some other action (type on the keyboard, move the mouse, utilize the
264270
disks) during the prime generation; this gives the random number
265271
generator a better chance to gain enough entropy.
266-
gpg: key 04B3B5C426A27D33 marked as ultimately trusted
267-
gpg: revocation certificate stored as '/home/ubuntu/.gnupg/openpgp-revocs.d/08071B1E23C8A7E2CA1E891A04B3B5C426A27D33.rev'
272+
gpg: revocation certificate stored as '/Users/ptest/.gnupg/openpgp-revocs.d/69DD5A189B3C274353A677214926E0E83FF6D044.rev'
268273
public and secret key created and signed.
269274

270-
pub rsa4096 2021-08-19 [SC]
271-
08071B1E23C8A7E2CA1E891A04B3B5C426A27D33
272-
uid Jack (test) &lt;[email protected]&gt;
273-
sub rsa4096 2021-08-19 [E]
275+
pub ed25519 2025-09-18 [SC]
276+
69DD5A189B3C274353A677214926E0E83FF6D044
277+
uid Peter Test (CODE SIGNING KEY) &lt;[email protected]&gt;
278+
sub cv25519 2025-09-18 [E]
274279
</code></pre></div></div>
275280

276-
<p>Note that the last 8 digits (26A27D33) of the public key is the <a href="https://infra.apache.org/release-signing.html#key-id">key ID</a>.</p>
281+
<p>Note that the last 8 digits (3FF6D044) of the public key is the <a href="https://infra.apache.org/release-signing.html#key-id">key ID</a>.</p>
277282

278283
<h4 id="upload-key">Upload key</h4>
279284

280285
<p>After generating the public key, we should upload it to <a href="https://infra.apache.org/release-signing.html#keyserver">public key server</a>:</p>
281286

282-
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>$ gpg --keyserver hkps://keys.openpgp.org --send-key 26A27D33
287+
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>$ gpg --keyserver hkps://keys.openpgp.org --send-key 3FF6D044
283288
</code></pre></div></div>
284289

285290
<p>Please refer to <a href="https://infra.apache.org/release-signing.html#keyserver-upload">keyserver-upload</a> for details.</p>
@@ -288,7 +293,7 @@ <h4 id="update-keys-file-with-your-code-signing-key">Update KEYS file with your
288293

289294
<p>To get the code signing key (a.k.a ASCII-armored public key), run the command:</p>
290295

291-
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>$ gpg --export --armor 26A27D33
296+
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>$ gpg --export --armor 3FF6D044
292297
</code></pre></div></div>
293298

294299
<p>And then append the generated key to the KEYS file by:</p>

0 commit comments

Comments
 (0)