You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by ar...@apache.org on 2026/08/26 09:43:43 UTC
(tooling-trusted-releases) branch arm updated: #1523 - move signing key management
This is an automated email from the ASF dual-hosted git repository.
alitheg pushed a commit to branch arm
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
The following commit(s) were added to refs/heads/arm by this push:
new 31601e13 #1523 - move signing key management
31601e13 is described below
commit 31601e1386ce32e6580f66c02609e57f46df4523
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Wed Aug 26 10:43:23 2026 +0100
#1523 - move signing key management
---
atr/get/committees.py | 36 +++++++++++-
atr/templates/committee-view.html | 121 ++++++++++++++++++++------------------
2 files changed, 99 insertions(+), 58 deletions(-)
diff --git a/atr/get/committees.py b/atr/get/committees.py
index f12a152a..4195749f 100644
--- a/atr/get/committees.py
+++ b/atr/get/committees.py
@@ -19,6 +19,7 @@ import datetime
from typing import Literal
import asfquart.base as base
+import htpy
import sqlalchemy
import sqlmodel
@@ -151,8 +152,10 @@ async def view(session: web.Committer, _committees: Literal["committees"], name:
automated_keys_file_form = await form.render(
model_cls=shared.keys.SetAutomatedKeysFileForm,
action=util.as_url(post.keys.keys),
- submit_label="Disable automated publication" if keys_automated else "Enable automated publication",
- defaults={"committee_key": committee.key, "enabled": "false" if keys_automated else "true"},
+ submit_label="Save",
+ defaults={"committee_key": committee.key},
+ pre_submit=_keys_processing_radios(keys_automated),
+ skip=["enabled"],
empty=True,
)
@@ -192,3 +195,32 @@ def _committee_key_lists(certificates: list[sql.SigningCertificate]) -> dict[str
if keys_list is not None:
key_lists[certificate.fingerprint] = keys_list
return key_lists
+
+
+def _keys_processing_radios(automated: bool) -> htm.Element:
+ # Two modes for now: automatic upkeep of the published KEYS file, or manual
+ # upload and regeneration. A third SVN-import mode is not offered yet. The
+ # radios carry the "enabled" field the form skips, so the value still posts.
+ options = (
+ ("true", "Automatically update the Committees KEYS file"),
+ ("false", "Manually upload KEYS files in ATR"),
+ )
+ checks: list[htm.Element] = []
+ for value, text in options:
+ radio_id = f"keys_processing_{value}"
+ attrs: dict[str, str] = {
+ "type": "radio",
+ "name": "enabled",
+ "id": radio_id,
+ "value": value,
+ "class_": "form-check-input",
+ }
+ if (value == "true") == automated:
+ attrs["checked"] = ""
+ checks.append(
+ htm.div(".form-check")[
+ htpy.input(**attrs),
+ htpy.label(for_=radio_id, class_="form-check-label")[text],
+ ]
+ )
+ return htm.div(".mb-3")[*checks]
diff --git a/atr/templates/committee-view.html b/atr/templates/committee-view.html
index 9130cb69..66ce21c3 100644
--- a/atr/templates/committee-view.html
+++ b/atr/templates/committee-view.html
@@ -23,6 +23,66 @@
</div>
{% endif %}
+ {# Allow tooling to associate keys for testing #}
+ {% if (not is_standing) or (committee.key == "tooling") %}
+ <div class="row row-cols-1 row-cols-md-2 mb-4">
+ <div class="col">
+ <div class="card mb-4 h-100">
+ <div class="card-header bg-light">
+ <h3 class="mb-0">Permissions</h3>
+ </div>
+ <div class="card-body">
+ <p class="mb-1">CI builds: <strong>{{ "Enabled" if ci_builds_enabled else "Disabled" }}</strong></p>
+ {% if committee.key in ("test", "tooling") %}
+ <p class="text-muted mb-0">
+ This committee is allowed to make automated releases for testing ATR, without an automated
+ release signing key.
+ </p>
+ {% else %}
+ <p class="text-muted mb-0">
+ Whether this committee can make releases built and signed automatically in CI, determined by
+ the presence of an automated release signing key. See the
+ <a href="{{ as_url(get.docs.page, path='trusted-publishing') }}">Trusted Publishing guide</a>.
+ </p>
+ {% endif %}
+ </div>
+ </div>
+ </div>
+
+ <div class="col">
+ <div class="card mb-4 h-100" id="keys-processing">
+ <div class="card-header bg-light">
+ <h3 class="mb-0">KEYS file processing</h3>
+ </div>
+ <div class="card-body">
+ <p class="text-muted">
+ How this committee's <code>KEYS</code> file is maintained:
+ </p>
+ {% if is_committee_member %}
+ {{ automated_keys_file_form }}
+ {# Upload and regenerate belong to manual mode, so they show only once it is the saved
+ setting. Switching the radio to manual takes a Save before these appear. #}
+ {% if not committee.automated_keys_file %}
+ <hr class="my-3">
+ <p class="text-muted">
+ Manual mode: the published <code>KEYS</code> file is not updated automatically. Upload a
+ replacement, or regenerate it from the keys held here.
+ </p>
+ <a href="{{ as_url(get.keys.upload) }}" class="btn btn-outline-primary mb-3">Upload a KEYS file</a>
+ {{ update_committee_keys_form }}
+ {% endif %}
+ {% else %}
+ <p class="text-muted mb-0">
+ This committee's <code>KEYS</code> file is maintained
+ {{ "automatically" if committee.automated_keys_file else "manually" }}.
+ </p>
+ {% endif %}
+ </div>
+ </div>
+ </div>
+ </div>
+ {% endif %}
+
<div class="card mb-4">
<div class="card-header bg-light">
<h3 class="mb-0">Projects</h3>
@@ -83,7 +143,7 @@
<div class="card mb-4" id="release-managers">
<div class="card-header bg-light">
- <h3 class="mb-0">Roster</h3>
+ <h3 class="mb-0">Roster and Release Managers</h3>
</div>
<div class="card-body">
{% if not is_standing %}
@@ -146,29 +206,7 @@
</div>
</div>
- {# Allow tooling to associate keys for testing #}
{% if (not is_standing) or (committee.key == "tooling") %}
- <div class="card mb-4">
- <div class="card-header bg-light">
- <h3 class="mb-0">Permissions</h3>
- </div>
- <div class="card-body">
- <p class="mb-1">CI builds: <strong>{{ "Enabled" if ci_builds_enabled else "Disabled" }}</strong></p>
- {% if committee.key in ("test", "tooling") %}
- <p class="text-muted mb-0">
- This committee is allowed to make automated releases for testing ATR, without an automated
- release signing key.
- </p>
- {% else %}
- <p class="text-muted mb-0">
- Whether this committee can make releases built and signed automatically in CI, determined by
- the presence of an automated release signing key. See the
- <a href="{{ as_url(get.docs.page, path='trusted-publishing') }}">Trusted Publishing guide</a>.
- </p>
- {% endif %}
- </div>
- </div>
-
<div class="card mb-4">
<div class="card-header bg-light">
<h3 class="mb-0">Signing keys</h3>
@@ -176,14 +214,10 @@
<div class="card-body">
<p class="text-muted">
These are the OpenPGP keys in this committee's public KEYS file. Downloaders and ATR use them to
- verify the signatures on the committee's releases. Members can add keys by importing a KEYS file.
- Anyone who signs releases adds their own key from the <a href="{{ as_url(get.keys.keys) }}">Manage keys</a> page.
+ verify the signatures on the committee's releases. Anyone who signs releases adds their own key from
+ the <a href="{{ as_url(get.keys.keys) }}">Manage keys</a> page; members can also import a KEYS file
+ under <a href="#keys-processing">KEYS file processing</a> above.
</p>
- {% if is_committee_member %}
- <div class="mb-4">
- <a href="{{ as_url(get.keys.upload) }}" class="btn btn-outline-primary">Upload a KEYS file</a>
- </div>
- {% endif %}
{% if signing_keys %}
<div class="table-responsive mb-2">
<table class="table border table-striped table-sm">
@@ -235,39 +269,14 @@
</tbody>
</table>
</div>
- {% if is_committee_member %}
- <p class="text-muted">
- The <code>KEYS</code> file is automatically generated when you add or remove a key, but you can also use the form below to manually regenerate it.
- </p>
- {{ update_committee_keys_form }}
- {% endif %}
{% else %}
<p class="mb-4">No keys uploaded for this committee yet.</p>
{% endif %}
</div>
</div>
-
- {% if is_committee_member %}
- <div class="card mb-4">
- <div class="card-header bg-light">
- <h3 class="mb-0">KEYS publication</h3>
- </div>
- <div class="card-body">
- {% if committee.automated_keys_file %}
- <p class="text-muted">
- Automated publication of the <code>KEYS</code> file to SVN is <strong>enabled</strong> for this committee.
- </p>
- {% else %}
- <p class="text-muted">
- Automated publication of the <code>KEYS</code> file to SVN is <strong>disabled</strong> for this committee. Key changes are not published until it is enabled or the file is updated manually.
- </p>
- {% endif %}
- {{ automated_keys_file_form }}
- </div>
- </div>
- {% endif %}
{% endif %}
+
{% endblock content %}
{% block javascripts %}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org