The debusine-signing command

The debusine-signing command starts and manages a signing worker. It is provided by the debusine-signing package. It is the usual django-admin command of a Django project, but Debusine adds some custom management commands that are documented on this page.

See also:

• Set up a Debusine signing worker

This command must be executed on the server while connected as the debusine-signing user. If it is run as root, it will automatically switch to the debusine-signing user. For example, to run the command check:

$ sudo -u debusine-signing debusine-signing check
or, more simply
$ sudo debusine-signing check

Command output

If a command is successful: nothing is printed and the return code is 0.

Running the signing worker

signing_worker

debusine-signing signing_worker starts the worker process itself, and is normally run automatically through a systemd unit. It normally doesn’t produce any output directly, but appends status information to the systemd journal. Its return values are:

Return value	Meaning
0	Success
1	Error: unhandled exception. Please report the error
2	Error: wrong arguments and options
3	Error: any other type of error such as invalid configuration file, etc.

Managing keys

generate_service_key

Generate a private key for the service. This key is used to encrypt other private keys, when storing them in software rather than in a hardware security module.

$ sudo debusine-signing generate_service_key /etc/debusine/signing/0.key

register_pkcs11_static_key

Register a key held in a hardware security module using PKCS #11. See Register a UEFI signing key stored in the HSM for an example of working out the appropriate URI.

$ sudo debusine-signing register_pkcs11_static_key \
    uefi \
    'pkcs11:model=YubiHSM;serial=12345678;pin-source=/run/credentials/debusine-signing.service/yubihsm-pin;id=1234' \
    /etc/debusine/signing/certificates/some-key.crt \
    'some description of the new key'

register_aws_kms_key

Register a key held in the AWS Key Management Service. See Use the AWS Key Management Service with Debusine.

$ sudo debusine-signing register_aws_kms_key \
    openpgp-repository KEY-ID 'some description of the new key'

move_key

Move a private key from one form of protected key storage to another. This currently only supports moving from nacl (software encryption) to aws-kms.

$ sudo debusine-signing move_key openpgp-repository KEY-FINGERPRINT aws-kms
Moving keys cannot be undone. Are you sure? [yN] y
Moved openpgp-repository:KEY-FINGERPRINT to 'aws-kms'.

You can skip the interactive prompt with --yes.