[tor-bugs] #31988 [Applications/Tor Browser]: Generate a mar signing key for nightly builds

[Tor Bug Tracker & Wiki]

#31988: Generate a mar signing key for nightly builds
-------------------------------------------------+-------------------------
 Reporter:  boklm                                |          Owner:  boklm
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  Medium                               |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-rbm, boklm201910, tbb-update,    |  Actual Points:  1
  TorBrowserTeam202001R                          |
Parent ID:  #18867                               |         Points:  1
 Reviewer:  mcs                                  |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by boklm):

 Replying to [comment:9 mcs]:
 > The script looks good. Do we expect to use this script manually or via
 automation? If we only plan to use it manually, it seems like we should
 avoid using `--empty-password`.  Of course if we do not use that option
 then there will be another password for us to track.

 I have been thinking about adding a password to the key, but then realized
 that we will using this key to sign automatically new nightly builds, so
 the signing script will need to know the password and we would need to
 store the password in a file along with the key. This means that if an
 attacker is able to steal the key, they will also likely be able to steal
 the password with it. So it seems to me that having a password does not
 provide any additional protection, and not having one make things a little
 more simple.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31988#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online