diff options
| author | Monzero Build System <builds@monzero.org> | 2026-08-15 21:35:15 +0100 |
|---|---|---|
| committer | Monzero Build System <builds@monzero.org> | 2026-08-15 21:35:15 +0100 |
| commit | dcf171abb3ce95a526ea9b8d4d1995aca8722144 (patch) | |
| tree | 393bf017f76d0012a0174b04dc6cec4b9f8fb607 | |
| download | monzero-gitian-sigs-dcf171abb3ce95a526ea9b8d4d1995aca8722144.tar.gz monzero-gitian-sigs-dcf171abb3ce95a526ea9b8d4d1995aca8722144.tar.xz monzero-gitian-sigs-dcf171abb3ce95a526ea9b8d4d1995aca8722144.zip | |
| -rw-r--r-- | .gitignore | 8 | ||||
| -rw-r--r-- | POLICY.md | 15 | ||||
| -rw-r--r-- | README.md | 20 | ||||
| -rw-r--r-- | gitian-pubkeys/.gitkeep | 1 |
4 files changed, 44 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..c6c4167 --- /dev/null +++ b/.gitignore @@ -0,0 +1,8 @@ +*.key +*.keys +*.pem +*.p12 +*.pfx +*.seed +private-keys/ + diff --git a/POLICY.md b/POLICY.md new file mode 100644 index 0000000..f205c12 --- /dev/null +++ b/POLICY.md @@ -0,0 +1,15 @@ +# Monzero build assertion policy + +1. Every assertion identifies an immutable source commit and release tag. +2. Release tags are annotated and their target commits are reviewed. +3. Builder keys are generated and retained by their individual owners. +4. Private signing keys are never copied into this repository or a build VM. +5. Public-key fingerprints are verified through a second communication path. +6. At least two independently administered builders must produce matching + results for each supported platform. +7. A mismatch stops publication until its cause is understood and documented. +8. Revoked or compromised keys are removed from the active builder set and + affected assertions are clearly marked. +9. Experimental asset/NFT functionality is not represented as production-safe + until its consensus and cryptographic review gates are complete. + diff --git a/README.md b/README.md new file mode 100644 index 0000000..6929704 --- /dev/null +++ b/README.md @@ -0,0 +1,20 @@ +# Monzero reproducible-build signatures + +This repository stores signed Gitian build assertions for Monzero releases. +It must not contain release binaries, wallet files, recovery seeds, private +keys, or unsigned claims presented as release verification. + +## Layout + +- `gitian-pubkeys/`: reviewed public keys belonging to independent builders. +- `<release>-<platform>/<builder>/`: assertions produced by Gitian `gsign`. +- `POLICY.md`: acceptance and release-signing policy. + +At least two independent builders must reproduce a release before its hashes +are published as verified. A builder signs only artifacts built from the exact +reviewed source commit or annotated release tag. + +This repository is initially empty by design. Create release assertions only +after the public Monzero source repository exists and builders have exchanged +and verified their public-key fingerprints out of band. + diff --git a/gitian-pubkeys/.gitkeep b/gitian-pubkeys/.gitkeep new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/gitian-pubkeys/.gitkeep @@ -0,0 +1 @@ + |