crates/holger-public-site/src/release_key.rs
//! **Release signing**: the one key Holger's (and Gunnar's) releases are signed with,
//! the owner's YubiKey key (PIV slot 9c, ECDSA P-256, generated and attested on the
//! device). The key id is written here and nowhere else in this crate; `/llms.txt`
//! and `/llms-full.txt` take it from [`RELEASE_KEY_ID`].
/// The key id: hex sha256 of the release key's SubjectPublicKeyInfo DER
/// (`slsa/release-signing-key.pub` in the holger and gunnar repositories).
pub const RELEASE_KEY_ID: &str = "d24d3785e8281bcd37e8f2c40a3a85e8152d3ce2200a5c929a1a5ca636e8249e";
/// `slsa/` in holger: the key, its YubiKey attestation and how to verify a release.
pub const HOLGER_SLSA_URL: &str = "https://www.gunnar.rs/nordisk/holger/tree/slsa";
/// `slsa/` in gunnar: the same key and files.
pub const GUNNAR_SLSA_URL: &str = "https://www.gunnar.rs/nordisk/gunnar/tree/slsa";
/// The section in Markdown.
pub(crate) fn markdown() -> String {
format!(
"## Release signing\n\nHolger's releases are signed with one key: an ECDSA P-256 key made on the owner's \
YubiKey. The YubiKey attests on the device that the key was generated there and cannot leave it, and \
every signature needs its PIN and a touch. Gunnar's releases are signed with the same key.\n\n\
- Key id (sha256 of the public key): `{RELEASE_KEY_ID}`\n\
- [slsa/ in holger]({HOLGER_SLSA_URL}): the key, its attestation and how to verify a release\n\
- [slsa/ in gunnar]({GUNNAR_SLSA_URL}): the same key and files\n"
)
}