Submit GPG key to the OpenTofu registry

[tthompson-figma]

We would like to migrate to OpenTofu with all providers' GPG signatures validated. However, OpenTofu skips validation for this provider because the OpenTofu registry does not have this provider's GPG key.

You can follow this link to submit it: Submit new Provider Signing Key

If you don't have access to the public key anymore, you can retrieve it from the Terraform registry:

curl 'https://registry.terraform.io/v1/providers/launchdarkly/launchdarkly/2.9.2/download/linux/amd64' | jq --raw-output '.signing_keys | .gpg_public_keys | .[0] | .ascii_armor'

Note: For security reasons, it has to be submitted by the provider author for the OpenTofu registry to accept it.

Alternatives considered
Out-of-band GPG validation for providers missing keys in the OpenTofu registry. This is a pain :)

Additional context
OpenTofu is a fork of Terraform that is open-source, community-driven, and managed by the Linux Foundation.
Hashicorp opentofu/roadmap#24 (comment) for the terraform provider registry to disallow usage with things other than terraform, so OpenTofu had to build its own registry.

Potential impact
Allows OpenTofu users to use this provider with the same security guarantees they would using Terraform.

[sloloris]

Hi @tthompson-figma ! Thanks for bringing this to our attention and for providing such thorough instructions!

I've submitted our public key via the link you provided; here is the issue. I will follow up here if there is any movement.

I hope we're able to unblock you quickly!

[tthompson-figma]

It merged! Thanks so much for your super-fast help!! 🙇

[jrioux-trustii]

Hi, we have this issue in our pipeline following this change

Is there a wait time for the key to propagate? Or do we need to clear something on our side?

[nicolaschambrier]

Hi, we have this issue in our pipeline following this change

Is there a wait time for the key to propagate? Or do we need to clear something on our side?

Same issue here

[mguillet-payfit]

Hi,
The submitted GPG key in opentofu/registry#1216 seems to be an old one and not the latest used since version 2.10.0 of the provider.

v2.9.2:

➜  curl -s 'https://registry.terraform.io/v1/providers/launchdarkly/launchdarkly/2.9.2/download/linux/amd64' | jq --raw-output '.signing_keys | .gpg_public_keys | .[0] | .ascii_armor' | gpg -
pub   rsa4096 2020-07-30 [SC]
      EE3E8DB9FE983A0CCDA8CB395902D4FCD0383786
uid           Henry Barrow (GPG generated for Terraform provider transfer) <[email protected]>
sub   rsa4096 2020-07-30 [E]

v2.10.0 and later:

➜  curl -s 'https://registry.terraform.io/v1/providers/launchdarkly/launchdarkly/2.10.0/download/linux/amd64' | jq --raw-output '.signing_keys | .gpg_public_keys | .[0] | .ascii_armor' | gpg -
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa4096 2023-02-22 [SC]
      1F9EF64EE33373DD313FFA36F6E8B367CFA9B29C
uid           LaunchDarkly Integrations <[email protected]>
sub   rsa4096 2023-02-22 [E]

➜  curl -s 'https://registry.terraform.io/v1/providers/launchdarkly/launchdarkly/2.21.0/download/linux/amd64' | jq --raw-output '.signing_keys | .gpg_public_keys | .[0] | .ascii_armor' | gpg -
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa4096 2023-02-22 [SC]
      1F9EF64EE33373DD313FFA36F6E8B367CFA9B29C
uid           LaunchDarkly Integrations <[email protected]>
sub   rsa4096 2023-02-22 [E]

The recent GPG key should be submitted I think.
cc @sloloris

[sloloris]

@tthompson-figma the original addition of the GPG key was reverted because of the discussion above. Since it seems we can have more than one key for different versions of the LD provider, I want to just quickly check in as to whether you do in fact need the key associated with v2.9.2 of our provider, in which case I will try to revert the revert. In the meantime, I have submitted the more recent one.

[tthompson-figma]

@sloloris thanks for checking in! I think we're fine to upgrade our minor version instead of you all needing to keep the old key around :)

[sloloris]

Wonderful! In that case @mguillet-payfit, @nicolaschambrier, @jrioux-trustii the new key has merged. Please let us know if you continue to have issues but I will close this issue for now!