Today we are announcing the release of SecureDrop 0.3.10. This release adds a new package, securedrop-keyring, to manage the public keys used to verify packages provided by the Freedom of the Press Foundation's apt package server.
In addition to the new keyring package, we are also rotating the key that is used to sign SecureDrop releases. This is being done to create a clearer and more logical association between keys and their roles in projects by the Freedom of the Press Foundation. Previously, SecureDrop releases were signed with the signing subkey of the "Freedom of the Press Foundation Master Signing Key":
pub 4096R/0xBADDE0C7FC9F6818 2014-10-26 [expires: 2016-10-27] Key fingerprint = B89A 29DB 2128 160B 8E4B 1B4C BADD E0C7 FC9F 6818 uid [ultimate] Freedom of the Press Foundation Master Signing Key sub 4096R/0xE02E0B594833B9A3 2014-10-26
We are moving to an approach that clearly designates project-specific release signing keys, rather than using a "master" signing key to sign releases directly. The current "Freedom of the Press Foundation Master Signing Key" is set to expire on 2016-10-27, and will be allowed to expire on schedule.
From now on, SecureDrop releases will be signed with a new "SecureDrop Release Signing Key":
pub 4096R/0x310F561200F4AD77 2016-10-20 [expires: 2017-10-20] Key fingerprint = 2224 5C81 E3BA EB41 38B3 6061 310F 5612 00F4 AD77 uid [ultimate] SecureDrop Release Signing Key
For instructions on obtaining the new release signing key and using it to verify releases, see the updated section of the documentation.
Existing installations should upgrade automatically within the next 24 hours. If you have any questions, or experience difficulties with this upgrade, please create an issue on our support site.