301194963b
一些检查失败了
automerge / automerge (push) Has been cancelled
react-native-android-build-apk / AssembleRelease (push) Has been cancelled
Build macOS M1 / Main (push) Has been cancelled
Joplin Continuous Integration / Main (macos-15-intel) (push) Has been cancelled
Joplin Continuous Integration / Main (ubuntu-22.04) (push) Has been cancelled
Joplin Continuous Integration / Main (ubuntu-22.04-arm) (push) Has been cancelled
Joplin Continuous Integration / Main (windows-11-vs2026-arm) (push) Has been cancelled
Joplin Continuous Integration / Main (windows-2025) (push) Has been cancelled
Joplin Continuous Integration / ServerDockerImage (ubuntu-22.04) (push) Has been cancelled
Joplin Continuous Integration / ServerDockerImage (ubuntu-22.04-arm) (push) Has been cancelled
Joplin UI tests / Main (ubuntu-22.04) (push) Has been cancelled
Joplin UI tests / Main (windows-2025) (push) Has been cancelled
Joplin UI tests / Mobile (push) Has been cancelled
Close stale issues / ProcessStaleIssues (push) Has been cancelled
84 行
2.1 KiB
Markdown
84 行
2.1 KiB
Markdown
# Warrant Canary
|
|
|
|
This repository contains the official warrant canary for Joplin.
|
|
|
|
The purpose of the warrant canary is to provide a regularly updated, cryptographically signed statement indicating that no secret legal orders, gag orders, or similar directives have been received as of the stated date.
|
|
|
|
If such an order were ever received and disclosure were legally prohibited, the canary would cease to be updated.
|
|
|
|
## Location of the Canary
|
|
|
|
The current signed canary is published at:
|
|
|
|
https://github.com/laurent22/joplin/raw/dev/readme/canary.txt
|
|
|
|
## Canary Signing Key
|
|
|
|
The canary is signed using a dedicated OpenPGP key. It is linked from the canary.txt file.
|
|
|
|
Its fingerprint is present in the canary.txt file itself and duplicated at:
|
|
|
|
https://github.com/laurent22/joplin/blob/dev/README.md
|
|
|
|
## Updating the canary file
|
|
|
|
Run `yarn updateCanary` from the root of the repository and follow the prompt.
|
|
|
|
## Key Rotation Policy
|
|
|
|
The canary signing key may be rotated for the following reasons:
|
|
|
|
* Key expiry
|
|
* Suspected compromise
|
|
* Maintainer transition
|
|
* Operational upgrades (e.g. hardware-backed signing)
|
|
|
|
Key rotation will never be performed silently.
|
|
|
|
## Key Rotation Procedure
|
|
|
|
### 1. Generate a New Key
|
|
|
|
Create a new dedicated OpenPGP signing key.
|
|
|
|
Export the new public key in ASCII-armoured format.
|
|
|
|
### 2. Publish the New Key
|
|
|
|
Add the new public key to:
|
|
|
|
https://github.com/laurent22/joplin/raw/dev/Assets/keys/joplin-canary-signing-key.asc
|
|
|
|
### 3. Update Documentation
|
|
|
|
#### Update the README
|
|
|
|
* Mark the new fingerprint as **Active**
|
|
* Mark the previous fingerprint as **Retired**
|
|
* Document the rotation date
|
|
|
|
Example:
|
|
|
|
```
|
|
Active Canary Signing Key:
|
|
NEW FINGERPRINT
|
|
|
|
Previous Key (retired 2028-02-18):
|
|
OLD FINGERPRINT
|
|
```
|
|
|
|
#### Update updateCanary.ts
|
|
|
|
Add the new fingerprint to the canary template.
|
|
|
|
### 4. Transitional Signing
|
|
|
|
For the first canary issued after rotation:
|
|
|
|
* Sign with the new key
|
|
* Optionally also sign with the old key
|
|
|
|
This creates a cryptographic bridge between the two identities.
|
|
|
|
If the old key is compromised, do not dual-sign. Instead, publish a revocation statement.
|