From d250d341934448e9b4a712f9c7801d655256cbd8 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@users.noreply.github.com>
Date: Thu, 14 Oct 2021 14:27:15 -0700
Subject: [PATCH] Change PGP keys (#9046)

* automate determining the key

* update packaging docs

* switch to new keys

* add changelog entry

* put keys in changelog
---
 certbot/CHANGELOG.md       |  8 +++++++-
 certbot/docs/packaging.rst | 13 ++++++++++---
 tools/_release.sh          | 20 +++++++++++++++++++-
 3 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/certbot/CHANGELOG.md b/certbot/CHANGELOG.md
index a32c10279..69dc00628 100644
--- a/certbot/CHANGELOG.md
+++ b/certbot/CHANGELOG.md
@@ -10,7 +10,13 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
-*
+* We changed the PGP key used to sign the packages we upload to PyPI. Going
+  forward, releases will be signed with one of three different keys. All of
+  these keys are available on major key servers and signed by our previous PGP
+  key. The fingerprints of these new keys are:
+    * BF6BCFC89E90747B9A680FD7B6029E8500F7DB16
+    * 86379B4F0AF371B50CD9E5FF3402831161D1D280
+    * 20F201346BF8F3F455A73F9A780CC99432A28621
 
 ### Fixed
 
diff --git a/certbot/docs/packaging.rst b/certbot/docs/packaging.rst
index 1f98581e4..2d02d6d7b 100644
--- a/certbot/docs/packaging.rst
+++ b/certbot/docs/packaging.rst
@@ -33,9 +33,16 @@ example: `v0.11.1`.
 
 .. _`Semantic Versioning`: https://semver.org/
 
-Our packages are cryptographically signed and their signature can be verified
-using the PGP key ``A2CFB51FA275A7286234E7B24D17C995CD9775F2``. This key can be
-found on major key servers and at https://dl.eff.org/certbot.pub.
+Since version 1.21.0, our packages are cryptographically signed by one of three
+PGP keys:
+
+- ``BF6BCFC89E90747B9A680FD7B6029E8500F7DB16``
+- ``86379B4F0AF371B50CD9E5FF3402831161D1D280``
+- ``20F201346BF8F3F455A73F9A780CC99432A28621``
+
+Releases before 1.21.0 were signed by the PGP key
+``A2CFB51FA275A7286234E7B24D17C995CD9775F2``. All of these keys can be found on
+major key servers.
 
 Notes for package maintainers
 =============================
diff --git a/tools/_release.sh b/tools/_release.sh
index 03945da21..ed726fa64 100755
--- a/tools/_release.sh
+++ b/tools/_release.sh
@@ -30,7 +30,25 @@ echo Releasing production version "$version"...
 nextversion="$2"
 RELEASE_BRANCH="candidate-$version"
 
-RELEASE_GPG_KEY=${RELEASE_GPG_KEY:-A2CFB51FA275A7286234E7B24D17C995CD9775F2}
+# If RELEASE_GPG_KEY isn't set, determine the key to use.
+if [ "$RELEASE_GPG_KEY" = "" ]; then
+    TRUSTED_KEYS="
+        BF6BCFC89E90747B9A680FD7B6029E8500F7DB16
+        86379B4F0AF371B50CD9E5FF3402831161D1D280
+        20F201346BF8F3F455A73F9A780CC99432A28621
+    "
+    for key in $TRUSTED_KEYS; do
+        if gpg2 --with-colons --card-status | grep -q "$key"; then
+            RELEASE_GPG_KEY="$key"
+            break
+        fi
+    done
+    if [ "$RELEASE_GPG_KEY" = "" ]; then
+        echo A trusted PGP key was not found on your PGP card.
+        exit 1
+    fi
+fi
+
 # Needed to fix problems with git signatures and pinentry
 export GPG_TTY=$(tty)