qvs: update docs prior to meeting
This commit is contained in:
parent
695421bdbe
commit
bd3cc8c118
GPG Key ID:
8E401478A3FBEF72
|
|
@ -9,6 +9,7 @@
|
|||
* [Glossary](glossary.md)
|
||||
* [Generated Documents]()
|
||||
* [All Levels]()
|
||||
* [Create Ceremony Repository](generated-documents/all-levels/create-ceremonies-repository.md)
|
||||
* [Personal PGP Key Provisioning](generated-documents/all-levels/pgp-key-provisioning.md)
|
||||
* [Level 2]()
|
||||
* [Fixed-Location]()
|
||||
|
|
@ -18,7 +19,6 @@
|
|||
* [Procure SD Card Pack](generated-documents/level-2/fixed-location/procurer/procure-sd-card-pack.md)
|
||||
* [Procure Hardware](generated-documents/level-2/fixed-location/procurer/procure-hardware.md)
|
||||
* [Provisioner](generated-documents/level-2/fixed-location/provisioner/index.md)
|
||||
* [Provision Ceremony Repository](generated-documents/level-2/fixed-location/provisioner/provision-ceremonies-repository.md)
|
||||
* [Provision Computer](generated-documents/level-2/fixed-location/provisioner/provision-computer.md)
|
||||
* [Provision AirgapOS](generated-documents/level-2/fixed-location/provisioner/provision-airgapos.md)
|
||||
* [Provision Air-Gapped Bundle](generated-documents/level-2/fixed-location/provisioner/air-gapped-bundle.md)
|
||||
|
|
|
|||
|
|
@ -49,54 +49,6 @@ keys/
|
|||
|
||||
{{ #include ./git-repository-initialization.md:procedure}}
|
||||
|
||||
## Procedure: Adding a OpenPGP Public Certificate
|
||||
|
||||
1. Ensure you are on the correct branch:
|
||||
|
||||
* `git checkout main`
|
||||
|
||||
1. Pull the latest ceremony repo changes
|
||||
|
||||
* `git pull origin main`
|
||||
|
||||
1. If using a certificate from [Personal PGP Key Provisioning](/generated-documents/all-levels/pgp-key-provisioning.html):
|
||||
|
||||
1. Obtain the fingerprint for the certificate:
|
||||
|
||||
* `fingerprint="$(sq keyring cert.asc | awk '{ print $2 }')"`
|
||||
|
||||
2. Copy the certificate to a name based on the keyring:
|
||||
|
||||
* `cp cert.asc "${fingerprint}.asc"`
|
||||
|
||||
1. If exporting a certificate from GnuPG:
|
||||
|
||||
1. Find your key fingerprint:
|
||||
|
||||
* `gpg --list-keys`
|
||||
|
||||
1. Export your OpenPGP public certificate:
|
||||
|
||||
* `gpg --export --armor <key_fingerprint> > <key_fingerprint>.asc`
|
||||
|
||||
1. Place the file in `keys/all/<key_fingerprint>.asc`
|
||||
|
||||
1. Create signed git commit:
|
||||
|
||||
* `git commit -S -m "add <name> pgp key"`
|
||||
|
||||
1. Push to the commit:
|
||||
|
||||
* `git push origin main`
|
||||
|
||||
1. Communicate your new key fingerprint to all other participants:
|
||||
|
||||
* Preferred: In person
|
||||
|
||||
* Fallback: via two logically distinct online communications methods (e.g. encrypted chat, and video call)
|
||||
|
||||
1. Get confirmation they have used `gpg --import <your_key_id>.asc` to import your key from the git repo to the keyrings on workstations they will use to interact with the ceremony repo
|
||||
|
||||
// ANCHOR_END: content
|
||||
/* ANCHOR_END: all */
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
# Create Ceremony Repository
|
||||
|
||||
{{ #include ../../component-documents/ceremony-repository.md:content }}
|
||||
|
|
@ -10,7 +10,7 @@
|
|||
|
||||
* 2+ SD cards
|
||||
|
||||
## Procedure
|
||||
## Generate OpenPGP Key
|
||||
|
||||
1. Insert AirgapOS SD card into computer
|
||||
|
||||
|
|
@ -21,3 +21,51 @@
|
|||
* [Disabling secure boot](generated-documents/level-2/fixed-location/procurer/procure-tamper-proofing-equipment.html) may be necessary
|
||||
|
||||
{{ #include ../../component-documents/openpgp-setup.md:steps-keyfork}}
|
||||
|
||||
## Adding a OpenPGP Public Certificate to the Ceremony Repository
|
||||
|
||||
1. Ensure you are on the correct branch:
|
||||
|
||||
* `git checkout main`
|
||||
|
||||
1. Pull the latest ceremony repo changes
|
||||
|
||||
* `git pull origin main`
|
||||
|
||||
1. If using a certificate from [Personal PGP Key Provisioning](/generated-documents/all-levels/pgp-key-provisioning.html):
|
||||
|
||||
1. Obtain the fingerprint for the certificate:
|
||||
|
||||
* `fingerprint="$(sq keyring cert.asc | awk '{ print $2 }')"`
|
||||
|
||||
2. Copy the certificate to a name based on the keyring:
|
||||
|
||||
* `cp cert.asc "${fingerprint}.asc"`
|
||||
|
||||
1. If exporting a certificate from GnuPG:
|
||||
|
||||
1. Find your key fingerprint:
|
||||
|
||||
* `gpg --list-keys`
|
||||
|
||||
1. Export your OpenPGP public certificate:
|
||||
|
||||
* `gpg --export --armor <key_fingerprint> > <key_fingerprint>.asc`
|
||||
|
||||
1. Place the file in `keys/all/<key_fingerprint>.asc`
|
||||
|
||||
1. Create signed git commit:
|
||||
|
||||
* `git commit -S -m "add <name> pgp key"`
|
||||
|
||||
1. Push to the commit:
|
||||
|
||||
* `git push origin main`
|
||||
|
||||
1. Communicate your new key fingerprint to all other participants:
|
||||
|
||||
* Preferred: In person
|
||||
|
||||
* Fallback: via two logically distinct online communications methods (e.g. encrypted chat, and video call)
|
||||
|
||||
1. Get confirmation they have used `gpg --import <your_key_id>.asc` to import your key from the git repo to the keyrings on workstations they will use to interact with the ceremony repo
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Operator - Sign PYTH-SPL Transaction
|
||||
# Operator - SPL Token Transfer
|
||||
|
||||
## Requirements
|
||||
|
||||
|
|
@ -70,7 +70,7 @@
|
|||
|
||||
1. Verify all signatures for the workflow data:
|
||||
|
||||
* `for file in <payload.json>.*.sig; do echo "Verifying: $file"; gpg --verify "${file}.json" "$file"; done`
|
||||
* `for file in <payload.json>.*.sig; do echo "Verifying: $file"; gpg --verify "${file}" "<payload.json>"; done`
|
||||
|
||||
* Ensure that the script doesn't output any "WARNING" messages to the console. If it does, abort the ceremony and initiate incident response.
|
||||
|
||||
|
|
@ -82,14 +82,14 @@
|
|||
|
||||
1. Follow on screen prompts
|
||||
|
||||
1. Unplug the Shard SD card and place it in High Visibility Storage
|
||||
|
||||
1. Run the `icepick` command with the transaction payload
|
||||
|
||||
* `icepick workflow sol transfer-token --input-file=<(jq .values <payload.json>)`
|
||||
|
||||
* Follow on screen prompts
|
||||
|
||||
1. Unplug the Ceremony SD card and place it in High Visibility Storage
|
||||
|
||||
### Broadcast Transaction: Online Machine
|
||||
|
||||
1. Retrieve Ceremony SD from High Visibility Storage and plug it into online machine
|
||||
|
|
@ -98,6 +98,8 @@
|
|||
|
||||
1. The url that's found in the response after a successful broadcast should be reviewed and committed to the ceremony repository
|
||||
|
||||
1. Unplug the Ceremony SD card and place it in High Visibility Storage
|
||||
|
||||
### Repeat
|
||||
|
||||
1. You may repeat previous steps as many times as necessary to process all workflow payloads
|
||||
|
|
|
|||
|
|
@ -32,7 +32,7 @@ This is a ceremony for generating and sharding entropy to a set of existing Quor
|
|||
|
||||
1. Run the command to generate new entropy and shard it to quorum of public certificates of the input shardfile:
|
||||
|
||||
* `keyfork mnemonic generate --size 256 --shard-to <path_to_input_shard>,output=<output_shard_name>`
|
||||
* `keyfork mnemonic generate --size 256 --shard-to <path_to_input_shard>,output=<output_shardfile>`
|
||||
|
||||
1. Unseal an SD card pack
|
||||
|
||||
|
|
@ -48,9 +48,15 @@ This is a ceremony for generating and sharding entropy to a set of existing Quor
|
|||
|
||||
1. Each backup should be placed into High Visibility Storage after it's made
|
||||
|
||||
<!--
|
||||
1. Optionally write an `autorun.sh` file to the Shardfile SD card containing the following command:
|
||||
|
||||
* `keyfork recover shard --daemon /media/external/<shard_file_name>`
|
||||
-->
|
||||
|
||||
1. Unplug the SD card and place it in High Visibility Storage
|
||||
|
||||
1. Label the SD card "Shardfile \[date\] \[namespace\]"
|
||||
|
||||
1. Gather all the original items that were in the air-gapped bundle:
|
||||
|
||||
|
|
|
|||
|
|
@ -52,9 +52,11 @@ This is a ceremony for generating entropy which is used to derive Quorum PGP key
|
|||
|
||||
* `cp keyring.asc /media/<media_name>`
|
||||
|
||||
<!--
|
||||
1. Optionally write an `autorun.sh` file to the Shardfile SD card containing the following command:
|
||||
|
||||
* `echo -e '#!/bin/bash\nkeyfork recover shard --daemon' > /media/<media_name>/autorun.sh`
|
||||
-->
|
||||
|
||||
1. Unplug the SD card and place it in High Visibility Storage
|
||||
|
||||
|
|
|
|||
|
|
@ -86,6 +86,7 @@ The proposer must combine these values into a JSON file, such as:
|
|||
```
|
||||
|
||||
Example data object:
|
||||
|
||||
```json
|
||||
{
|
||||
"workflow": ["cosmos", "withdraw"],
|
||||
|
|
@ -100,14 +101,14 @@ The proposer must combine these values into a JSON file, such as:
|
|||
}
|
||||
```
|
||||
|
||||
1. Import the keys relevant to the ceremony:
|
||||
|
||||
* `gpg --import keys/all/*.asc`
|
||||
|
||||
1. Sign the data in the CLI using `gpg` or another OpenPGP implementation:
|
||||
|
||||
* `gpg --detach-sign <file> <file>.1.sig`
|
||||
|
||||
1. Create a signed git commit:
|
||||
|
||||
* `git commit -S -m "add <name> pgp key"`
|
||||
|
||||
1. Copy the updated ceremonies repo to the SD card
|
||||
|
||||
* `cp -r . /media/external/ceremonies`
|
||||
|
|
@ -116,6 +117,10 @@ The proposer must combine these values into a JSON file, such as:
|
|||
|
||||
1. Plug in the SD card into the online machine
|
||||
|
||||
1. Create a signed git commit:
|
||||
|
||||
* `git commit -S -m "add <name> pgp key"`
|
||||
|
||||
1. Push the latest commit to the repository
|
||||
|
||||
1. Notify relevant individuals that there are new transactions queued up, and that a ceremony should be scheduled. This can be automated in the future so that when a commit is made or PR opened, others are notified, for example using a incident management tool.
|
||||
|
|
|
|||
Loading…
Reference in New Issue