move to OpenSSH signing for factory images

1 files changed, 38 insertions, 34 deletions

diff --git a/static/install/cli.html b/static/install/cli.html
index 1be722fc..dfd44ee1 100644
--- a/static/install/cli.html
+++ b/static/install/cli.html
@@ -74,7 +74,7 @@
                     <li><a href="#booting-into-the-bootloader-interface">Booting into the bootloader interface</a></li>
                     <li><a href="#connecting-device">Connecting the device</a></li>
                     <li><a href="#unlocking-the-bootloader">Unlocking the bootloader</a></li>
-                    <li><a href="#obtaining-signify">Obtaining signify</a></li>
+                    <li><a href="#obtaining-openssh">Obtaining OpenSSH</a></li>
                     <li><a href="#obtaining-factory-images">Obtaining factory images</a></li>
                     <li>
                         <a href="#flashing-factory-images">Flashing factory images</a>
@@ -370,28 +370,22 @@ Installed as /home/username/platform-tools/fastboot</pre>
                 to confirm.</p>
             </section>
 
-            <section id="obtaining-signify">
-                <h2><a href="#obtaining-signify">Obtaining signify</a></h2>
+            <section id="obtaining-openssh">
+                <h2><a href="#obtaining-openssh">Obtaining openssh</a></h2>
 
-                <p>On the supported Linux distributions, the signify tool is used to verify the
-                download of the OS beyond the security offered by HTTPS. You should skip this on
-                macOS and Windows. It only makes sense to do this if you can obtain signify from
-                the distribution package repositories. GrapheneOS releases are hosted on our
-                servers and we do not have third party mirrors.</p>
+                <p>On the supported Linux distributions, OpenSSH is used to verify the download of
+                the OS beyond the security offered by HTTPS. You should skip this on macOS and
+                Windows. It only makes sense to do this if you can obtain OpenSSH from the
+                distribution package repositories. GrapheneOS releases are hosted on our servers and
+                we do not have third party mirrors.</p>
 
                 <p>On Arch Linux:</p>
 
-                <pre>sudo pacman -S signify</pre>
+                <pre>sudo pacman -S openssh</pre>
 
                 <p>On Debian and Ubuntu:</p>
 
-                <pre>sudo apt install signify-openbsd
-alias signify=signify-openbsd</pre>
-
-                <p>On Debian-based distributions, the <code>signify</code> package and command are an
-                <a href="http://signify.sourceforge.net/" rel="nofollow">unmaintained mail-related
-                tool for generating mail signatures (not cryptographic signatures)</a>. Make sure
-                to install <code>signify-openbsd</code>.</p>
+                <pre>sudo apt install openssh-client</pre>
             </section>
 
             <section id="obtaining-factory-images">
@@ -405,22 +399,31 @@ alias signify=signify-openbsd</pre>
                 using it for the rest of the installation process, so these instructions use
                 <code>curl</code>.</p>
 
-                <p>Download <a href="https://releases.grapheneos.org/factory.pub">the factory images
-                public key (factory.pub)</a> in order to verify the factory images:</p>
+                <p>Download <a href="https://releases.grapheneos.org/allowed_signers">the factory images
+                public key (allowed_signers)</a> in order to verify the factory images:</p>
+
+                <pre>curl -O https://releases.grapheneos.org/allowed_signers</pre>
+
+                <p>This is the content of <code>allowed_signers</code>:</p>
+
+                <pre>contact@grapheneos.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUg/m5CoP83b0rfSCzYSVA4cw4ir49io5GPoxbgxdJE</pre>
 
-                <pre>curl -O https://releases.grapheneos.org/factory.pub</pre>
+                <p>Other locations to obtain the signing key:</p>
 
-                <p>This is the content of <code>factory.pub</code>:</p>
+                <ul>
+                    <li><a href="https://bsky.app/profile/grapheneos.org/post/3kleyygkptm2x">Bluesky</a></li>
+                    <li><a href="https://twitter.com/GrapheneOS/status/1757758688952009209">Twitter</a></li>
+                    <li><a href="https://github.com/GrapheneOS/releases.grapheneos.org/blob/main/static/allowed_signers">GitHub</a></li>
+                </ul>
 
-                <pre>untrusted comment: GrapheneOS factory images public key
-RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3</pre>
+                <p>The current public key is signed with the previous signify key. If you already
+                have the previous signify public key (factory.pub) and want to verify the new key
+                with it:</p>
 
-                <p>The public key has also been published via the official
-                <a href="https://twitter.com/GrapheneOS/status/1145259815851253762">@GrapheneOS Twitter
-                account</a>,
-                <a href="https://www.reddit.com/r/GrapheneOS/comments/c7gb3f/grapheneos_factory_images_are_now_signed_with/esewpm9">the /u/GrapheneOS
-                Reddit account</a> and <a href="https://github.com/GrapheneOS/releases.grapheneos.org/blob/main/static/factory.pub">is available on GitHub</a>.
-                When the current signing key is replaced, the new key will be signed with it.</p>
+                <pre>curl -O https://releases.grapheneos.org/allowed_signers.sig
+signify -V -m allowed_signers -x allowed_signers.sig -p factory.pub</pre>
+
+                <p>When the current signing key is replaced, the new key will be signed with it.</p>
 
                 <p>Download the factory images for the device from <a href="/releases">the releases
                 page</a>. For example, to download the 2021110122 release for a device with the
@@ -429,14 +432,15 @@ RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3</pre>
                 <pre>curl -O https://releases.grapheneos.org/<var>DEVICE_NAME</var>-factory-2021110122.zip
 curl -O https://releases.grapheneos.org/<var>DEVICE_NAME</var>-factory-2021110122.zip.sig</pre>
 
-                <p>Verify the factory images using the signature if you were able to obtain
-                <code>signify</code> from trusted package repositories (see above), otherwise
-                continue on to the next section without this:</p>
+                <p>Verify the factory images using the signature if you were able to obtain OpenSSH
+                from trusted package repositories (see above), otherwise continue on to the next
+                section without this:</p>
+
+                <pre>ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s <var>DEVICE_NAME</var>-factory-2021110122.zip.sig &lt; <var>DEVICE_NAME</var>-factory-2021110122.zip</pre>
 
-                <pre>signify -Cqp factory.pub -x <var>DEVICE_NAME</var>-factory-2021110122.zip.sig &amp;&amp; echo verified</pre>
+                <p>This will producing the following output when successful:</p>
 
-                <p>This will output <code>verified</code> if verification is successful. If something
-                goes wrong, it will output an error message rather than <code>verified</code>.</p>
+                <pre>Good "factory images" signature for contact@grapheneos.org with ED25519 key SHA256:AhgHif0mei+9aNyKLfMZBh2yptHdw/aN7Tlh/j2eFwM</pre>
             </section>
 
             <section id="flashing-factory-images">