summaryrefslogtreecommitdiffhomepage
path: root/ci
diff options
context:
space:
mode:
authorJonathan <jonathan@mullvad.net>2022-05-11 10:33:11 +0200
committerJonathan <jonathan@mullvad.net>2022-07-05 11:27:04 +0200
commita6b73f3c3bf616b8ddfe075dd8ee197f2de17d58 (patch)
tree086092c9ddd93d21685a6967949e93c3a3203214 /ci
parentf150ec3b2e7912b556602645654806981c6d69c5 (diff)
downloadmullvadvpn-a6b73f3c3bf616b8ddfe075dd8ee197f2de17d58.tar.xz
mullvadvpn-a6b73f3c3bf616b8ddfe075dd8ee197f2de17d58.zip
Create verification script and github action
Create a script which verifies that a set of "locked down" files are not changed in commits that have not been signed. Create a github workflow that runs the script in the CI. The script accepts --whitelist <commit> and --import-gpg-keys arguments. The default settings are supposed to work on the build server without importing the gpg keys from the trusted_keys.pub file and running with a hardcoded whitelist commit. Make the CI workflow use these arguments as it is supposed to in .github. The public keys that can be imported are specified as files in the ci/keys/ directory. The files that are locked down are specified in the .github workflow as a single source of truth. This requires some complicated parsing in the verification script as well as a dependency from the verification script to the workflow YAML. These are not ideal design choices however the alternative is to not have a single source of truth for the locked down files as the github workflow can not depend on an external file. The mullvad signing key is named to be first in the list in order to be imported first. The whitelisted commit is the latest master before this commit
Diffstat (limited to 'ci')
-rw-r--r--ci/keys/1.mullvad_signing.pub84
-rw-r--r--ci/keys/albin.pub120
-rw-r--r--ci/keys/andrej.pub113
-rw-r--r--ci/keys/david.pub64
-rw-r--r--ci/keys/emils.pub64
-rw-r--r--ci/keys/jonathan.pub34
-rw-r--r--ci/keys/linus.pub97
-rw-r--r--ci/keys/oskar.pub75
-rwxr-xr-xci/verify-locked-down-signatures.sh76
9 files changed, 727 insertions, 0 deletions
diff --git a/ci/keys/1.mullvad_signing.pub b/ci/keys/1.mullvad_signing.pub
new file mode 100644
index 0000000000..63052fec45
--- /dev/null
+++ b/ci/keys/1.mullvad_signing.pub
@@ -0,0 +1,84 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFgRmCoBEAChee2rs/braqjqim1D+uvTBpPZzkpccJVb2SqhErQKs54iJVyo
+H5pNrGR4VIzFRUnY7fbATo2Ej+0MlglXahl4ok93XmeDz04P5rH2NKnLvWYdaK1C
+9Lvpq22t1nytJuhc124UBahVVEYjc7l2+JGdTh7WvLj8FXqfnnmI1upVU48S70RL
+oM3tSDZqQaO3OGCc0znMNBGI/uKNNwc6Omm6KPvczOhci7bnKt0b0R6TrXufvgOG
+y1DM9sntIbXtpIjOuZdTWyrGTm/AvT6zddPFjN8SN6ZIfoRmJT6ROB6ZTtiz/d20
+VJ87QPEfVRKrMImZxtkJtSliojZB/I3/bkP7A4pvgJ6cJ+ErwW4cfqc3DrWaZY+D
+4AZnk71FA6C5rQdkFbfkgyUMY1WeKX+8N/R+e5oLGmoVI/fdHu1z0JkJJvEraAO9
++qX2mOcW5h/NRxv0Xw57fjMhnMha7bWs8Jn5AchDPJZs1U64Wr36FuSvcdxc0ON/
+WaX4RL/J5OtJHu+2FB+UB1/JuICdOP07/KFxUJod43KwwBctLUHOOz3m1KIVcnXR
+l6+gNQ7vxGm+xghN/zG7lgPLuw5ToCCkMLkQydsRPRSlm0f2zqbQUD3jn+4zZ2ma
+HBHcu6Ld8SSGPp5XIauAKhqZA9IkD5VPgqlrm0iJ4emzPYGp7PMFFdH3qQARAQAB
+tCpNdWxsdmFkIChjb2RlIHNpZ25pbmcpIDxhZG1pbkBtdWxsdmFkLm5ldD6JAjUE
+EwEIAB8CGwMCHgECF4AFAlgR6R8ECwkIBwUVCgkICwQWAgMBAAoJENWh1PJm3o3f
+muQQAJElHN6lLhpOgrbRprJAR15HfRI0Leoomfu5V53Qieqf+6O3TF4PC9JRn+v8
+NYOMsBmBgosvO8YcABA3wYTW6qyRGr+8zQePltEe/J9SE3oCbb4K5KWEThiicZ6R
+o0sJgXB3l0CIHVP+/3bWeZlBpTJNMLOEM+WsEsTe6v7hZfF7HIubVdKSIbQy7T3X
+nsk8840rt5LjJiNtSpsG+EJOIGEdXH5FAis35pTLrbkgnL3Evyjd2OW1grciqF+v
+7aba2g/2zpEGEdtbJKO5C4nG9CHcN5BlaSev0oQlKWuRSG3igwauZFe/0RQPkH/V
+kCOHA3l8NTlublQCdLLLrJJyX7aODH+AKLaVci17ogtGwwO+xNh0h4ejM0QuMLYV
+giMCpxRT5uUuOHbh3by1rwTSb+8dvIw3KyW1TbZ6LFCQHX+8Zs7xU7KQ6tGZ6Pvr
+Fhk/YiM8J+Fe+rBGwEcUfo/ALv4p7qHpRVA7CvdrzKg66iaN+iPQzsptamoSLsCj
+SYbjIby74X0vppRAg7sDXiAxJSRPXM3h1xO83yk1HMrswwWAUuJeToYRXOHYl5zN
+i3E0D6I5Zk1ioO9XPE7oILwJ7YaO4XuC3UuNMwWPSvOoJxbnsUdHpenITvbpe9DP
+z4HGzZWbUtShFDq77MDhv9vkNaFUOgP7AfO5N/35pVCkI4m1uQINBFgRmCoBEADT
+5YK+TLcGSzC4ML7t8VW+rVpYyY3pswX8dL058LYfCIrlaNa14/UvINvjA5529SWr
+jmmDluD8fqtMSFHw6l+XwPMOwvETAjaMLS6c/MLFmw2gHR2ARHBmLEn/ux9kZ03Y
+dEKak5wvkUVqLV7EgGnvfrI0FUw/gaIfdtAt0dcvpAG0bILXQtcYEj7BtiAdxiWL
+O8HMUzD7kj0Q2IUbA3bO4dAtJtXDyY+Ash/kqLzm+0kZtzk4FLWZT2CMw9l73mIT
+/f03+y8oBe1KhZ5FzqgUxQXdjV5hkWyFNbBn4+dsyoMltnVDPkRznIHDWJXiKUV+
+buSQ+xewO/flwrwcgbdTtH5qfuxtNBA2AkVs/dul8FJHeSCB7at6Vy1m8/xFlxgc
+QOk/wwiDKLBub0uIE6TfNs7SvAOUuZP5syLQq8ZeyYMWGrWQKgAEmHlXr0uCrqVF
+O5vjaja8Zwc6wdApiFxjiBzl3z7UiE3fafpeO9nqLwaZqz0RPCEpvCrkpDi4Gl2W
+nfWmQbj2jEpUER1osJhvNRCEfA12IUWjp1vFJhy31i6gTXdCxVBasQrxpJBEZnuJ
+57yIZ+FbdMI0wQD2OMdUYxx4o9p6aGwhotSBrgpM0cfZ5LruP6MjBfWKqLnZBuYk
+prqWeh5rgtXIebsiGYp7V3Ay9pcoilbzh53/wU6y+wARAQABiQIfBBgBCAAJBQJY
+EZgqAhsMAAoJENWh1PJm3o3fbfoP/RfOil8d3hNK+qgG4Xh46bF/UmGzorYbVzzP
+myXXRHTMh3/Br2tPOOnhP65nKJnv8pqCuK1UOJpfXUXDyRpAP7opiWRaS0gbU9s6
+RBy499P/LyMmvZbM4YkpxwPJkC6JaITQ+ZtnPQp+MYLizsz5OD8utyfoPWDOdaEf
+3JHOvupcItDL3DDKw5zPzrI6pKc0IMObO5VI/uU3BIf0x+FKh2rhMVMI+Psapotm
+qhpaPZoz/QPapS2WiMNr7cInLxx7/fv/RLEr5WSVn1eAKkKuXUO/VB5+h4GdP/YV
+boBW4wMneEEkJX3iLr/IM1GQdQK/db4fyWAKh7LhzS9ZCVMxm5BU6GkId7GI2jFE
+djmedt6iF6Tyk0/49WjU/qAZ9H0IHgpyNCwUqPpzWgRiiIbZryRXycht/rH6zuL1
+8p5N6r7AgT6s6kCHfrNK/zxMOzylUuwng1EnLCmlg88PoCCQpaNFZkqwIR0LCh3p
+Xp8zAp+0Sx2td1FtjbEw+OaNCmmJoMqoejuw0nSOFdQUUNAB5WGeZQLoPaastanW
+ir6XcUChoy/1osuovAPNKpWWUxWDdW+62mV8s2ArkLzhgl0FmLZhu+VBKrQaNUKV
+WmPnMRZF6f1C3M8l5DtT1VzfEr1A9ON6uZzKITLlJdBltVFkV7qJTsxbsoj0AJj7
+0VY4XEjauQINBFgR4mgBEACsFJ+BkT+yBxB0E2MNUAcW5stDgscDOJOAXS/ViYd8
+68FqC87VnG+bgTqG2atRqb493RoCHwZyL3L9JniadSk35d9JEQBWzCPff+kEy5Uc
+bwzvSUJyCfjFdxU4YgH/bMt+RXi1mVjLcGTthRp4IfBxQcluI//rxP1kurrqq+lO
+wj7n+h1wxrdhvXXDiAeBJqlQcBjeT0VLc74PYQJ3SbpeX1aFaxsVATGpgXf3SWp+
+8vRCmzM9CnyZW8BeaXBrkwiZQEOeiqnQ0MWaD/8Fs6WWfiyoObJcadmS7HgqCfw7
+SwjSUjSPAr+Vr02P83S59u8ql0RWtDI8CCXcSc1t4u52lvXBdO3nKa9+PeW64I+A
+UfqgJOmfhWZsoImV1pCx+RzY6luFp7H7JVACAi3Z1s24fsRhN5wVZ/hjKn7xGPv0
+O+zFVGWXs/JKl6Bv7xMR0epL+D0d13ahPZYHyLqLfdeJwg2HT1BUAPy+QCy5rhzS
+iEjeygqVzwNTcBPnu1PFhzXSdGMvHKTFXwO5xPwqanvKUd9zH6Xxan5wAJL7yRPq
+7/MSEqUFiE+OfVTeZ3PDduLrkrQm0ZIgTl4EkUNn70YbzrPnEDh7EMETNnAqjNU3
+5iwELxRyxjUdSaIuF/5gSfc4DG/c8miUrYAaXyqMuJWuF7aNnVnSQJDZCjnf//Yy
+KQARAQABiQQ+BBgBCAAJBQJYEeJoAhsCAikJENWh1PJm3o3fwV0gBBkBCAAGBQJY
+EeJoAAoJEKJlgfIZyDFMyBwP/ih4/pKyfQOdgP03IXK0v9dhKOs+PcSAd4BC+ACV
+kDz+N4Pui7/6FJ7+hSJE7Tf2vcWYYbtTrVCz335VCf5zWC/Tz8aXs9MOBlMeZNOS
+2Fsi8P1KOv2BD7qi+m6fkHJ59hDXp2SzvmYRNRgn3N1QpuJl6bjssLmG7X+8NrNA
+JZedzfXmvxDfnxaqKTwGotlJXVo5b/wB1ZXn7yr3zecuXKvcG1SJTGCSyK98jyip
+S/0qAOqzd6FPbNEl/4ehKPX5STdZytTzN8lcbtfTMUA6qLqe/5Tvt50n8yDD3bEh
+ripRSaC2BoVDADwxo7kDhTO6c1xCNMdG/9dHMelbzOPuxJhVMkNzL+dR5V6Q3Clt
+I2rjANqWq/3G7kA4oaItoYOYnh9J8a7P/bkMFbrGEYmaYu9PCqLY5NzqaCKlNyJP
+Fy8u0TdBhiyoBWWarTN6fZwTG6MotHPi9q0iWPfsb9kyoRJWIcvEJq+Vi0wE0+9/
+kXgibqh76U5JekysGV/dBgXaPF4XAPCpBaEe9sbD2PVeUDZPuVeo3c8iGPK1NxmJ
+dt1ktfCcuV3MYCo1DGifuOCCvVaJms6IEFjLPAEQmTGhRSVzTWZ7J8HoDqulhlJh
+HxLT7KI9z85238zplUarSEZ42gNT5SQd35prGVlJDVBwRm2NmJurcfU/EcPi++eD
+0hJhWrYP/3lW/OOkR5NZCK8HhKYM2kBcAsOC/6x5vV1VISslZY2LB3jKq+XhXlPO
+cEmQVMPliBx4yuFrPOKk1+87D9bEL5LJBQskgQwFe2Pg9QirIYflO+P+1LJK3U/g
+3NnlkSrOTRV0M/AvhtU/8R3V2V423pm3sjQsaRdMMtWGfsFNJxvotBkwgEDwDu7h
+sZqzL0zFucm+iMAhGnqi+EZEPXwbX1Utp7S8edBCztfytQMjnJ6jv4UCz///rc3i
+8IDlMo2d19CW/psPS4v7lns5g9oqCGpRbGRllrBV1M/o7bs7+1NyvPTJm9UAmt5U
+iApao4vt4YOG5w0vYd0t50pDS/j3TGjbakgxZpNUMpAgrhnelClKDsXbCVGCyhlJ
+ZOw9Q9t4vIAhFFSpxEDl1NREOUInoK3R4yo4Ep4sq6cbfZvoyAYZf1zpQHQX9OBN
+DKp1jwGLA3+0Jna2/1QUYFLjFiz9bdL+1nT9k/RStFBauRh529r+M1WlkwqNIL+L
+bRGm0rXbWu9eiLhq2ldnfIADOtccUll10RznrjumqgYYw2CI0YUudzpzIghAKZyo
+THYPADmBfvN2pZa/KU3c1OSKHOH2b91Xi97k3u0fECMHLgXctA3BkQ69fONSzx/c
+abgtcydAU0wAD3mG3mr1XI96uOMeVNK0wgYyO5VhzZNziSFhls0D
+=kwTD
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/ci/keys/albin.pub b/ci/keys/albin.pub
new file mode 100644
index 0000000000..b878082d47
--- /dev/null
+++ b/ci/keys/albin.pub
@@ -0,0 +1,120 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGFVXswBEADMjMXMGVAOlqG15MKMO/nuu4FEgVUpRFPrIi2InnLyy6IroG/A
+Ki++b6rNkBpOFGS5MpA9rvPCU/z33ZrjkXb3H0gOaRQqf/AMHiNA6prdMBoMVez8
+lvZ1JVNSH/3EMtLFtbm5P1B2/vBptEn15kvcJ21PVWh5GNBWYD/g9QgZtHtvfeG/
+mayRGcGmIqb2G0dDpVCGHvUrPA8A4G85n2QQhf2uSwYcfFT6VCacXgOtWnguKusi
+TdxSbwfqgCE1u1WxysZmhRBagcpAARZ8TRHxBHaYt2yJp3RMfGSXQ0qUSTr5HIO4
+FUWjWX5ZxX4ZkXKiq+s8wgCROsGRZfKIKsVex0/yNxNZiyXvq/Xz99KHmuuBda0X
+I6M/LeGaMMjP/oGR9iGo1ouQtzQU7cpJuUiAksf84yPkmksxozHRQwPPkTEPafLJ
+sxx3j79vpoYslunWYKGIRghZV4rCxIDTV5fztYFUpw0lyPSbp/w+A7ebeg3UbU4N
+Pclk6BdjG9Iq5yD6UALL/ZLsQ0fHpIB+WdfX8+P0ciCDO/7YBRquuMhuoTU7wz1i
+rk2hJLBBPCBtXW0p59fF5fDiA/c/ah3c+xJoKRaJmJPGH3yOax+ggl0++mnfSscp
+XMicUUce2Rid7R5l2k2AgR0x7YgGzH8qtC2ozIAruRIeORK06tBxCuKU3QARAQAB
+tBlBbGJpbiA8YWxiaW5AbXVsbHZhZC5uZXQ+iQJIBBMBCgAyAhsBAh4BAheAFiEE
+cK9oyqJCJqmcuvCmCdJ3Wm8nhW0FAmFVY7sCCwkCFQoFFgIDAQAACgkQCdJ3Wm8n
+hW27jhAAorDK3/DYuvL+HAzo7SvYgJGAESjV2YUf6uP+FJEhYL99ITPCf4nc2xJn
+IABbsp9rL8grYbcM8lghpOfeIcmScyTabD+MuYQTDPoRuVlE99+Dwnsmhair68u0
+eQBdWyt9wP7m8SClboKX7h1iM1OeK8jzozRw80isB56Xy3eY191CY7P8LQIAYRF9
+ug5CPBYjA1clET6yfP1j2/EJC+4349Uk+c5DUigt0iw5zxXw4vQdy2IFwVdYFYie
+B7eH86wVfW1tviBohO/aQj0Z1jGn5CRAX5tLatPD3wUJS+WXKPH1lFCpe6tiNPYy
+/q5Cn7rB6sb2KAEl9rRRfTcGWC3PEqFHtg44EC0aDdWNgT4iV/v09fHDh/F5dIg3
+rIUpxC9lhVMF9c/XP29fsopJ985/8B6fE52hOcgO1vTUfd3dh3rcjaLeOxhQb0az
+QVX2anmT2wVAahXzwQvyhz22eS0zrRpK65Zc0bYOn3rbE7uXBkBkxV1chiO8dMTV
+PrPC/Mpm9TBcKIqfW6FVcJnxm2ZRaiomNxX1Zhwy+ypKRgSx7xeK/Sj8v6j9BK9V
+fKPhJoXyVjQUmIGpiA897QfcHUFdu5+GsFTHy+XAABcM0qVgS3hD2PSgvrTnSBKk
+5+eme88Dzdmj7VRfQJaWD4eXRU85QOjOej7luq716RWyz5i7dAaJAjMEEAEIAB0W
+IQShGYcC/D4KCamuW3XVodTyZt6N3wUCYVcGIgAKCRDVodTyZt6N3++YEACPRoaJ
+J4tBBP1irYyNhviRe8ONYEwqgyH2NAQhCGwjjZw3dtpEnmdT7ED7epiMSG+pNXjC
+E+QVdGeellUZKLwRI8YzTkrLqRjx4bxs8fDcGe/dYI1vXYKFRhKDiNTK8Hx6Mr7H
+G4oM8fNJxUJdHqWf+JR2rBjJXGP+kjhskKcfZAqMKh0VegTO8tSOit43if5rLVf8
+mUkuDUAZiwRpQI0+CxD1uTHkMhmUeejyCjwaTxBWXiYgSU74bWUVKG7NumYXo25v
+toMcgzTZXVDXh96hpUMI811sHI6XVKKrwuB/g60G0QdOknxsWSVslj2Ex97b/WH9
+foGZJZJe/hxK2AGxGkNHkzLBGlz8YQi9YZQcZDGphlx3wccj616CR1xHtjmnXRna
+2OaF7XcGVJzDU1jICCDafe48+LU6Ctr7kwlfabLrIZ1DXuDySitMC3C8H5UgHyA5
+bT9tpHjGb/2EOfQfI55EuLCL4X0N/GW64XnltrHyESggYG3ajqR5wCpp947Thi/i
+Htj6/YLbyuc2/euJFMuliasOKl3JOnvL5M6uB6sVSHy9MC+lxrzG08W6VuYgYhVQ
+LXUVi2GdmRpfNroqEl9Aj310lM/YsE1T1Ry9mUrlVVI7ycwK4sz749SEUY33Clcl
+IRCwmM2jzy/IP2L/S3ZNLDYANRhMt2W8+h5io7kCDQRhVV+IARAAs2wYghfgpORf
+UNPD/6btg2cZRS0oiFmA++dZZZ6mLPx0RVt1Itc8B9hQuf6dSS1DBOa3zitmpMUY
+Nixvqghwoq111/2gOI0M90FSeLqslmaVTh/bFclDxg7rUX9FPITAMvMrlg97PpFv
+szH1R7YUlBfaTlvCJ6T5ICJitboWvzOmUoQQGK12jR8t8Bt0HCiFA5sHj2Q+LaSm
+thH37J0Af/CwoMfh3cltbCnTZ2oIbgQEEx9rvlSkDuJrN6Yt3r1KMCYUcLmDSIEg
+yws4/w/NoR9JPTGre8M8J9PeCYc/Nf2DFZd1J6ROnzneS6sjRrHYskz5VHluLD3e
+HWHX10bWlFXOJFS2A4F2PJ9o1sUeFuioNVWnYcFhzOHd76YQMXQ8+Cd0LRwZ9FCl
+W4zaD1cYSdJBvxKEReFygOuux/fTpXWRKScfZXJ6HxVZl6a86N/tYxrFShnNAUF3
+07rX+ffb0ylMnUS3+BMjJ2ZFkoroSpaybyGWNy98saCY5tTIKYXufoCrOWxl/rC/
+3OCIDib3y3HseeFB4RQjpVF6JlWWGmUXFWV79ilYKZz/iQW3RS+wQN/q/akxWXzu
+eVV1nH3UmGOVsxdqHTlVYIUMzz99nCyzjyMVNn3dgs3Fw41TedB+cQDCHz6Uldr4
+Tur5KyKdgB81BGCPsLy1WVE0KvMR7MMAEQEAAYkEbAQYAQoAIBYhBHCvaMqiQiap
+nLrwpgnSd1pvJ4VtBQJhVV+IAhsCAkAJEAnSd1pvJ4VtwXQgBBkBCgAdFiEEWLvd
+Vd70bvLf70Qx5QP/Vhx+KGMFAmFVX4gACgkQ5QP/Vhx+KGMZbw//e0F+/5N/iFo4
+zeNytmyexiqFVpEct42m4OYQjZWrsYe6XNwPdAwtVTqDAaU3XCXKOYYf2zugC7Xn
+pj63rEEspXdDnzOqpGteIwSymUl0E7kOFeUsH7DdF4tgHFctstwPUOzn/0rDpJIx
+7B47zPIrtoIYcl/mC4FK+prGh4vxwAOTD8m7HMF78q5UAICujXTd5Yw6lfKKvwmY
+nHlP57iZuSls1qOJ/py6b3fCiC5vXvMoGP+3Q92oj/jDn5l2PHFQ8PCpw5fx1uLU
+mwujDpq0bVwZSwF3xNvTofnRIKejSGPDWAdjKwOxbEr2W8w9d/YJSk1QhIPF+jc7
+xUp0Rdp9sMlawS2Evfb6jA3IULSsaLTGhI/Jyp8IJD38L9EnY1cFX/DEGwR2gDtW
+peW6Ll5Tv3vZiCR8g1WgAS9h5GD7ZH2kd/hi3KO66w64O5nOHSI7nTEhn/nJgTUr
+DBhKFkkah3+UOuUYWffV7dKEoUqgR8jRpjzIANb1uD7Vpg1hyxwWdG8T4TV2vydw
+2mRicpo7iiZXfZmxl4L0wwVSSuV6StIAu4lOczw4dBDi5DxQ6TTcLweA4UHygwq6
+61o7SlZWBc/8W3pwVBF6fa/jtqS3c0Kj46i/hQesagZ4ihGgSguNiat7NP2nBSsS
+WRZXzKGA0hQhegl/MUxKqpQ7HTZVxc7UpBAAjFF2bg2RgFo6gGoXCRJsuPPp0RoI
+sXnPa9sa/T5hbgy/rTqitgyaR0O++Lgc3sp4HnI5PopRo2vrbW0PNMptzQ5/mcCq
+AAXUV+CelL0wHtmrku8ZsQ4f/MQLeGbElREVCn4SrU6EjSN+ZCfuYLCm3zHXCHTM
+8mfbAQFqmURwvB8lI8o6HbOh5VEEhCcWs3z4oQY2CCsdRwHPZ01C34Y9hCHBnGPB
+XdnpUcuM8PvE31rH6Z1HbXSga9sx4dk6ahH6OmIi5ktUMvoHfFlVFqwYqZiJbDgz
+B3LXoWh/4/yl6cxUnbPV74WO5CXv/wQ3O3SKEEniqEWYcql+0jqtOWg8wNv9KkRv
+1UByhlP81H31SFOowRCTM4CyqVhEKqpM61mV/yBrBGltZ55A0gKXiC/BeJjcnCXF
+VmJ/nsmkLhG2rTUo31+SDqsLsVnHQZwMO3/7dJG71gOoUdV7Oxb2I9M5lawDzrHj
+NMHJCz9wpAMpZZFvADytk6XJOkqOd61/S/mYMtt+DVIAwxuxg4L6yH91z1MvNAhr
+Trgh1A9IGXJ8Do8Iawx3xDcbxnUShOoCqQ8DzJ1RADG3fvkFe9F6LAJE+yE59tT/
+L00ChX5vOraztG+J+SAkJSJtB8sz0VfCfVNMPQdFlb65iJyurRxirt5tebGfEiiU
+c7hGV7983aBeljK5Ag0EYVVfqwEQAOLqfhHZwe7WJdrojE9sxfiFbW7uUF/+PygB
+HlyiPLJEtScRHTTFIh5TbV7Lc7cj0w2gJY3jPXmVAhOEgBJ5ca98WAItpPyufwR9
+Q3gJuuDwORXlt8m5Rt77iJnZVCoGYIoejEDueJGaAYvTA5BMOJBYFojvdVDJyLJ0
+0YVD8sUPo7y5BNkzSpLJeKDVi0ysuM2OmdFBoMy01q+4bKRWmJ3vCh+GAUUugBrs
+izOtXSGijZmOwpyzauD5r751ji4ono1SsmQmeqXb3ipUfyxf5QJL2Ela1uPEwN8g
+DIOV0bfB17bgbRDJ6pDAXDB7fd2LdysmMi8614qAl2i8VSeAjU0pFhZAl5kKJCL5
+SlRqBJgMBpTJvAsPOSceM4XxKSWFIHhJhX0bhat3ydt5sdI2hI6mfRQYiJzgGyIG
+I3eh7YDOg4lTxQW/743ObRUc2MUK6Uojzm3VAxZ1sskdXgqzFpnC9ZhHGlpOmMIr
++/5TAk9C7F3ny+/nFWAnTCJtMp7x0OUTQAa+KC6j0e20IRSwHC/dMhnZiI/ArsH6
+IpUR8qel7k3bXXeVD9/s+yKbVDY8eg4/2Sl4GJIwltk/QPOyA+g0Rr4zAklFXEKp
+BTou+maLIHT1cO8rCsj1LolISMsdgMRI9lXG8XnyNSvKttlxHPC4MxQYPq2E0wc3
+P5FrFZkZABEBAAGJAjYEGAEKACAWIQRwr2jKokImqZy68KYJ0ndabyeFbQUCYVVf
+qwIbDAAKCRAJ0ndabyeFbYWLD/41Ieql1CkJDemklIDz3nz1HxX9w3o6OJCdrzMq
+XvifEddiQIOK9uAxYAY4HQ2I9wO8jqzN+zVZZbjHYC1OmU5ANP3K+Ld3uoTzY6K+
+64KfiuHmQYHRmwubVUYzC8RxE8zaYalxlF/97NeQBVzDfw0HCEL/IzttDwTw5VyP
+0Z7GnnJO+O6/oQW3Bx4DPdY8eU66j2lXweZPhcG+grIDACzn8+4Fq0rl3bZjgY88
+rCaXy2c8Ymq70Yg9JoYHDf4bDTqVYx558c34JfNSb9SpcaQb+LFeHPTQr+mKM+/3
+rKzxuf9roN0qTa5DE6vYj5yKsQWeVw5vrLoEapwPA0QgHCBHvFaou4w5E3fcOeRo
+S6qyqME6Ei8/GBFp6QLzS11oFEsDsgIj8KTQ1iyVar9ZbxGSjCCGckH/ABp4aS+V
+dOnNpnRPxvhVJUXCRnSKiC7Fm5ozXEoyxW6Z+chLWzcOpikI6AvUzUl2ipqUzu7K
+UIEM3fLK+YIIC4qd22M2RdtlVNagY9wc28QdweypYn+7A5FbZPnUHzppPjPvnso8
+VuJ+F2U2lvAc0EjcJROceU/f5Y3lAuAeoSrlRVKgRBZP13tKxDlorT8N8W6ERkXO
+FPDuk7hY1RiaXBpDCACiiE6yvdVOaMJroWhasIJiTc7x5aR4HI1BZtpT+IVH8cMk
+KVkO77kCDQRhVV/CARAA6y+Vsh+MEJjM2FiTBaCeCpCowz7epa7gB9BbwA//PZgq
+aK6vOaUAUVvrbc8DcrDBxOiO01/0wEPX+ruTHg+SwZCHOZrN5ynkU3qtVPU99NDf
+7ZJn8vujC8iCPTKhp2b8fAgl887HcBXXhVlzqOxekvQ5XBRsfG91flbLrAfNBbul
+gk5a9SZWAkiLWmX/qvvwTD9ZImDu94sxXgMGAk096xj672YJQapsq714UNlolgdZ
+0oGu6jAHLx/wk3HBXy3CDRfUWiJFpEXlELPamMmGev7376BJprjtJWgTgNMf5jOw
+LF/paBV/IG77REzd5qlQE7/8ULrWEN9RwJk3jJLXN4xoNxj7itW9B6b8E0KiLcjt
+yglXWLh/KJkk+56A2rGvrz2A8O20feZFLZgLXAYi1YN7FTh/3kPzXpwA5i0BRyr1
+SMB3kcRgMiP1BbIoEeh+gh0tIA9fBtFeyrvkvmZ0JnwYOtZ4jboqhV/EZrcodv8f
+Thb8zer6SEb5CMpz9bp4xs2I07eJUpv7OB722TMhAM6QAMmVhA7dzMpnPJ/4Xvjj
+f5m9DGV1a0DoSQXSAo+8tbun53dGpACqZ/Dn+VY4cYJ8RK+Pqpj2ujHGAi0ao6VS
+6MkoJEvS+q1nuIBKo4khLuRUaGfDd1ZYLJkdOrYIJm/HIy3v54zYGBOBz4MboAMA
+EQEAAYkCNgQYAQoAIBYhBHCvaMqiQiapnLrwpgnSd1pvJ4VtBQJhVV/CAhsgAAoJ
+EAnSd1pvJ4VtZhAQAIL3ajXwnL0MGBiE7up6cAdNrnEK7u2iSa8wttLPF8eMrWfe
+GbHFe9bRws0r7HiHtyHxTzsLAIO37yN7/Lqm4wUNHbw0aRpsaObt+UfCaSQqFC07
+nGAfuAOZO/eZSh0xcHO+wSWkAqc9BZxVfa9Iw6qWk9cjjyf23b3lWhNTQ/1/iVd1
+SM6kRQB2ntWbrtSHw5FGPgzRSX+E2K+UzvSziF+0oU+R+267RKh1o9Iuws/EmGVb
+qUUcTPp4IfmxCsYR/JcuX52YABoTpbL+g98a8ztN512UsunaIeJVKBCEyvaciNH4
+oCD4/1aC3JvVAlnnogt0DpDp6K+00cQnWh/ObrXr2XXYiNNzCntKQ4Img5zeFf5R
+2Fb0F9VSbUMHrbRsrLKVAdU5v89UlOwGhpfTPc5UirS8fwiPOquI2bRQRhz7pezN
+MkElm5fEIBFjyyn1Uq9g0jym5fRsWCMv8Xb2FkujxnHeTQWYE1HgG3vPMkU9TShO
+XLiSG1/0V3/5wI/u2CeTURg4BpMEgdLDKygpR1qiXC9uCZee+NcKI+tylgus/JZD
+ToykxLY3PIgkksJeSozaxJz+Lz68okQHqyG9L6F+81enp5iQFw1g2KgfI1Y324zE
+Y/GTFqIUFeGS/kiIbHV2vJN+nxlU+1XOjWmWekzeSdNKUdI3aarpSBuS/CPf
+=rA/d
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/ci/keys/andrej.pub b/ci/keys/andrej.pub
new file mode 100644
index 0000000000..5ffb297f07
--- /dev/null
+++ b/ci/keys/andrej.pub
@@ -0,0 +1,113 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFjY/QoBEADX6UD9Rvz5ON6PwXYQFJPw/UblR6gGbKC9fCSdnMT/K4xyFuAQ
+x+jfvQ5vfEu7K9bzmyJb82EjeE5q0xOxl+PnRLECn2CYSGtyqJYx5ALnipy6YWNI
+XEVrACFrxlX3lBZCFdlEott4W7uvf4mTAkmSRy+hxG9F/RmjNrpHG//R31Wah9if
+tQsYrrhlJ9Jkz6JQ/iAQ3RcajpEiwWPZDDWv6bw0agr2ftR1xILG7LDHZVd2AjCk
+AYl2p3qpjUiqEOd3/egoiJrjhr+LkjI1wv+xqD/JOkRKFbYWnWgeW+Pi0qqClhga
+slIPKhsxgUumm5iRuwqP9Z9SCZSwIabxlrPJeBUItHugj/RFU81ySpXGC1wbN2KL
+GEeiVljt8iaOSz2i8RT8LWzFDiUqzzwI3iF6MO0LTyNZekEHd0Cqatmhl4Ees/sg
+/JC+N/Hh+qTa5tK7YEL8ZuzOTi9e0tkOaf/HzQJaNjbearppc9gaKBeOMNnMCvuN
+gQsLI9HbEVnP6+7MNlYc5xfJXkHfDwJAFVilVTIa1hzim713HZK79rU8h+1Y6AIe
+/2T3TOGnWM9OhcDBoEKW9xshznzRU6jk7oN8JN3dDPxc9cxzM6a0v9LphbnnqV5f
+1ID0yEzPO/r5zEz1iyvIpipb7qJN/6oGwQkaBbkKY47+45Gp3AyGkjdl3wARAQAB
+tClBbmRyZWogTWloYWpsb3YgPGFuZC5taWtoYXlsb3ZAZ21haWwuY29tPokCUQQT
+AQoAOwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAIZARYhBN1l8ogrlLqf/Ug0
+Skz8R43MJUOjBQJg7p/9AAoJEEz8R43MJUOjN30P/ilJJVkoRLmsDBACgh2gsWcU
+TqRBS6TCj6cKvw7N46gNrq7ft3r+qKj7Ig90arAX0FTtraE13sWNoIEIfDlyqDgQ
+Do6Kaxrip7Y2lBcWcUTkYacTOLhveQFTl7CLEZFWm7uGBlcYGOE4tIYFqLZ1LEHK
+z/QXP9KDXxRNhMVP3VE6WsJg0X03HENiXfkYF8XdNYLcDU0UH5Ii4Pe5uSMR8Cxp
+ES5AtcUfp0nTA+f+0YaSaoK6M6zUJMSH5+78rZSQgLLO6Uq9/gMVydb66UNw++8P
+iUr4JRzIMiaB4pNVistMEHS5Ftt5C82nFjSEgIpQDQJORLkjX0pSW54/vn8Gb+3S
+XMgFeV7xzmmtd2DgmLIkCz+P7gonVRlImGv7/9Fa9bFweZTiS+7k2iroSmSiZ/9E
+WmF7375YUdFzmTe7Z/M/QAP49BkhqC3SKflgw+R1bFzM5AmHlkCrLNWIjQZ+elIv
+/wYv8UPkuwAJx3b69tOI6GT/JO3F7j2n042Wit9j9qAMsAweWRAtdTn1OW3npW7u
+f5QcZdvJFeaqHj+6kVFgc7Fo4BT9+jLL2uoxMD1fxxZdATSqySzSuQkn5yrLFnYT
+WGgVAya/BGJLqcUOqSx5hauyPkpn7aq1ghwIj3nXl01cRnfXvkHa2J+rB4/bVCE/
+PPg5hl8LnH3OEfzT5UOliQI9BBMBCgAnBQJY2P0KAhsDBQkHh3EABQsJCAcDBRUK
+CQgLBRYCAwEAAh4BAheAAAoJEEz8R43MJUOjb3gP/247+ir0HFnEA3574XoQw7Hy
+38eWB5dqvOjeft9DXa98DrKgmUr+wdT0kdNyXlteNIABlInaHULRytHwORO2F5ki
+UkvRTbnUyxdsGFbmNnG/iZdb2a2ZUgY1YSzf2nwDJlkXYsadySJkN22w1d5cmc/y
+u3kPcYXMZkNha6fQcoAgK8w19z9m52F8uqticE7tLdN4FFF/GqlI/EeMyU127xSi
+4PkNIhjajAclzIcIXC/hABO0IvVG5xa+EGq10vThKVoqb1zetRnb+QKXuMOWN8oW
+/AAgCwkWmiimYsTj2nw90DfjMACrK/Rov9CWQXfkwkciA3XCpDr+BUabf4Jdt89u
+CWxnpl12BRIRIb6+uQ0bK+2Lp6wy1EaGaLTRVn5bXFt9WUg2OHmZ4c4UJai8lY0/
+FzvQXWKwsOP0lz25EzO94i2xONVZ1po5BfBF9GkfR//ALMbHxedfXfXAluQNTgRC
+FwvnZG4LHtwTq3gcznF+2JOnz3OKgTocy9oJ3NwLis2zqQkQVqMAOvH6K1WL8twG
+bliepQQVH2xyNBhutrTpu3G4hE4eI+vbziTuOMtl66eRtObdQ+pGBImYjKAZ7IuR
+8VTXT9YPpze3MEPzvZ26Kw4bvQOY+zqjI3LLVnAmdTLHB77089npVBnLUwBJsfjg
+cfxCj1bUeYkm/qoztI4HiQJABBMBCgAqAhsDBQkHh3EABQsJCAcDBRUKCQgLBRYC
+AwEAAh4BAheABQJY2TpoAhkBAAoJEEz8R43MJUOjOBoQAJ25IZqazRLJaky598Tb
+6/6LfCDIwqTz9eOsHeXB3oErJT5tLuZ/0hzkEph/pzMHnr5llAQFfBgxMVMYIJHl
+We2HtLeycRJtiUd+tdVR1c+3K9xNiTtw384wuvE7GIX8nX2jiTDcNLr8D6z7KP4m
+WC0NZyLvs+HZejYCAMJw0ABlf41d5Yy0XLILwrNDn5REMMDGpt+Wg/k5UPKB3JOM
+672lqC0tD59tImKVCykHgjWM7rVhI4+w6XsKlRVUN78uc1UVk+HTD5aZWWNU4zrQ
+vgrsWhoWeT5rP83eeCxOplxk/NGWTpsFga+Cea2OeXwyygqt08ONnbAQN/Qf/4PE
+E2o1shDIYala1iXunlRtdG2ZfypmJv6fdbMYUnxv13sX3/gGWwt1aDMdxIeqSHcs
+xl01I0iEMKgDRenVdDcA3LYXuLd9J366wRxOA5AKG1DELO60PTpx3h4ME9tcGiIF
+OGJBzUhmC+UcuP3OzKMu/bO00kZOWE+EZb3fKZcCodxeTnmg50krd/3PSedrd0Ym
+BP7rnmeR9r1MNK/HG34NpyAZa9vRIBR3xjlbbSAEFQ1nCH+uPRQuJa/szz/pQU7v
+xIh7A5JV5jvrAmiekuNuqrWfzw1w3HqaX0I8E6N/M+WnsoH0e1oEqfeRB88VUzS9
+ZwmmHfsNCj0jxel0WG1ArztftCFBbmRyZWogTWloYWpsb3YgPGFuZEBtdWxsdmFk
+Lm5ldD6JAk4EEwEKADgCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AWIQTdZfKI
+K5S6n/1INEpM/EeNzCVDowUCYO6f/QAKCRBM/EeNzCVDo6e7D/9ZODwiBmHhtKTe
+ADm+/UhPt7tJ7JGDMU8gIz7R5spJ/7Qtx2B/GwFE9vUMHwIOuibSGvitymkjaZX6
+qPSY6cigRV292YRhmoF8OoDcqJdFw6orvxoc/C3wUSApg18NjzrmvPkGYbAQ9yFK
+Bz7IDXMCLpnYZFU+ezf/ocxnAOL95D0P0+qDyq1v1bc4uoyBo/JXAgXvxohDM9ul
+FrQP28uwDofHoqKsOUR6ikYdn4BJls/0C5Et6HBkzDJXKAjOwnfeMlnukCTg1CZ6
+rIQw2pOLD6uCgTPysl7WaVMlo6ah8MiEyu1Aqb6mMnkjla8/E/0XI9IlB3RMh/jR
+4xPgZoKpYFBQGsS1PM7bHL6iMEnWNpYQ2esMOtBKEcCzNDaSYoj9+Elzz+8DUIY/
+U3Bnm/snQu6YWZlj/ih1QzOVzqo/X1eQ5NtjmxBV+3/WOt2JrL3UQ239Ln7t2JYi
+OUj1LaSwMcoNf1LH3HJ9nl9W56FDe2wAZKBBMttH6yoAUgj61ZwJy2LyDCdU+DLY
+C668GvcUy58jmDmBcFYozMRAgQV5u9Y3zqv09hPKXSESfByaJ9OBBxId3F/z+b4H
+2lxIfm7w9c6XbyvHNf2fhYogmuUqRHS93hV+rWL88juM9Mzm/oPDqOn0SzsJWqVT
+y+uKTukzEU7AZwrd9AU8dqe/ztTiYIkCPQQTAQoAJwUCWNk6dAIbAwUJB4dxAAUL
+CQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRBM/EeNzCVDo6zkD/9RirJ9eP3YbrX5
+meCvno5pvKc0Jkm9bBin+7TDBX4yvehR5ixXJn9Nf79OIgVsCaKqqgTRDqKQM7s1
+zSO/00H4zj/xkj0fcds6+lMyC+jj+4CXLTpH4iS7pLvWVjJUYjh8Kc2Gcys1bxa5
+N+2xDkM1jR9yc5et3xP2ikXgfR584dHGGpg9+8Lu6kCJZNkxwDWEUp2lWUlkwNE1
+n7Qgx/E1sw9vB3yV2pb8Nm5OP6LCEhG7hi0UoN4w3A2Y8Iy64VpxM7iC4j0YT+Im
+jvCj6dSgwXmUpOfar0HEYWP6OYIAuUt4O/ZO/YBUWNw4vpWXECB5VZ+zra4ppe5o
+z6i3YKZPfF175488P8Tw5NK4m8pO+yCla1fzA0J2bxGns6VoqDWDk20dw1crukXG
+7Ir+dW5HqeRI21tLIrPRW19Hzv2HlcdI7PAajZiyDCEfoLZtGuriunesLkNae1U3
+FfZ0t+uNHYuHngGiwQh2BgKzwy8maWxAXR1EJPqG7aeAlnLerkTvoBuFv+rUH8t7
+EZAo3sASJQChVE5dbzQq/WdJbzc+YxhOZPEe46i0HSZVZQpJp6+x4ogxEkee6Y/2
+cUjLXxgJ81icEmkfyeITb6nefSjIiTy/7khxyAkuKmBNgvteqJCZuhFY6/+mZqcx
+5+AfFExGMxf1drTfO5Vid17VyRYabokCMwQQAQgAHRYhBKEZhwL8PgoJqa5bddWh
+1PJm3o3fBQJeJchyAAoJENWh1PJm3o3fFf8P/RpyJ0S49hvdwpNCFarvnphA1A8I
+sxUJCg9xLnTil2CqW5hthhHetI7NLekgfdkyzE1k5jX++ncspj6/uWU95fajuDXp
+1eVgbgVctv2fL8cj2LkinqQlL93yFrVVL55GZ7KB52FF8/x+bvROtTHtJhWu5ikI
+6k5TGIZzhVrI9tFbB5RUBxXIHykacIHKmfLP0tqdZghbPEUM+mQ3KUgiivWAgi7I
+AUJCF+DOcYiNgG+7BBW82cCMWmZbLlQ+2gKmZxjUCAbCDDsHS/09izv+DVwnVDL6
+apKgWTVo5MFQR/KQ+ERjJ/HcR/ivyxYSXwsW1leWjbLWcuWGN+Hrw5hm4Y5LlhRt
+IOzOskfP86904dojYTQyhfNygsi6P0jwAEPvTzoeLch64zOnQq+S/BXbQXFHUY93
+rYUPkcZ40L07M4rYagl/FGN+OLZdsQ99JMX/N+Fd23vzAmgozPg2iTRVgdjRuDjH
+n4llaI/MLD0i6HXR+/jGaN4nFrShG/9QhqCvpZeBmrJBOL8hvDdUncwIcaaZVuGL
+n3frjjh9LnqPz/lBI0+mdGWs9fK/FJnABXg8Dy8Cd8t3YOtP2uHIZDOfBKkw/oUl
+wMFQSqjsJ1JCdzWK/bpJV/QNSyZ93/lzq/eKKygVtcOBPB1w1tAE/npA4QqarbC8
+diiHxryJDY5rQ0lZuQINBFjY/QoBEADTc6AjIC3M4aT+JvSLuzEsGpu/PPG2gGhc
+5w2eXta5TPqKQOmv8NWstG7WquESmqYppoK2/sWHcO784hsHgU5JUPNTwXDl3uOk
+dzag1GvGfggg/ZxZPSrrGISXVSq0pk/dtqM+VGZQ/bNOxX3gwIclvKAPNb+FRyTF
+HiEynmGAVsPGQDanoaVA32OrVcSbmh4e/QxbMFdD8qoxtFbJBBlS14J7Zp81aAnB
+aNl4cQr8tEbyoYfaGpCqOFV4qM21+/YNDXmD4hlDiGJdndpsL87eVttOv6UgHYXZ
+WYKpmivnj+lnVX2jeuxL9uY6w1U0o4WkCpemKBujxE8nhYtTHhX3m/TemdeeWCBg
+bb00bDpc/XxcL3m6czGnpRUNImEsc92KRu2OUVRedwvG7U+eYVB9nGWisr0wN846
+Xfb9u95rCKCdy6/JbX3Neue9PQfQ2brRCCicLW+xt3wiKf8mwfvstNAFb6FQPq1x
+TTG9pI2qNYubSxt9AB7l+8uyUtWR+UKXiub1umWiWigeGSz2TCcoIZjmEvrif5+o
+dYZxLZewz4oSkoZHME0rL817clAZGd2sGJMfuqk0erPVBVkkgVCEx4UUMkOZf/+8
+ukM6ge0D1EBMjqrBhYYcY1/8lNmOXOkgda99Abj28a+iVCNou3Yo3lw/Vy93/bWJ
+W9I6yquWfQARAQABiQI8BBgBCgAmAhsMFiEE3WXyiCuUup/9SDRKTPxHjcwlQ6MF
+AmA8p/sFCQsmEfEACgkQTPxHjcwlQ6O1HxAAxZnsNIEGIJ3jBt5YLmGTvgWk/Yd8
+e++OvwZztxHXny+oK8jZifTTzWLn33cWNUdKTcdvajgvTe31s1BKahs8Uno7IgHT
+Q7Lr/VQiaVRgNQxzMskNYWtn4ijNYpmfDqgsS11ZOmyv4i8FaxL3J9TicsJbnop8
+w1AppMwRGwOq8IGDgUrhvi4a5qkuFZDrsU7PJlKE/zaq2x3ub80d/jmW6o8wYctD
+0O0XIrrOZVD3zsJFGz8unnf8yU68fz2Ax6uO4Yk5iQhSeu7ILahuWcRd/ScPvMF5
+wlrnIo1RInIQpeB8vfOxqkajCh0dScHvpIy9Az6/31P7B+H8C1VDQO8ubPWnZdhz
+GHQGOMQV3E2fHimAwPIFby/U0w7BmTZaQLLNsiAPwN336Jfc2yfHmLwGz4XIeRL+
+FrjKHlz99OI70IVhb37rOLwuh/Liu3F6KgZTk6GO5hXGekp1IE61ze7clpH8y4y6
+nl7qy+RuBiEB/S9c64ZvP/9s5TaPyHwQoyLnqNoM5ft3PqfAsaubV5r9GWlnc6Nn
+oYSMkZmXsS5aG0TR6ClLTACEXhXekZI/Va3ut91Q9TRyoURr0xvDNKWjrp7WDPvu
+9z5PFNOt7OvklWnXkIVy8WcnDyk2fcb+A2k2GoCDVJZ5oGaXfV83faUzeA2Hrbxn
+uZPnS4OQomvzMTo=
+=gMeY
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/ci/keys/david.pub b/ci/keys/david.pub
new file mode 100644
index 0000000000..08cf032988
--- /dev/null
+++ b/ci/keys/david.pub
@@ -0,0 +1,64 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBF2S1KkBEAC7ws1UtnAlUbjSah47Tao0QHeW+jFJuz5GJCdm/jhsx5M2jdmM
+EvxpXm7d6riEhY53FAoesvYYJlx9jMKuKLILMVkRG2IFEyuM8zyS2hOaYEzPjLeu
+6hRi3j4SskaQwEly2pBcEE8ls52K6ky/nG1CZ2SN8gcDQTxR+12dFs3ws/I2psuj
+i4/BBmzhXGLe1PrmWIgyBE29dOamXFBbkb3Vx6wwQq+A46XPBDg8nr7bhK2AxwfP
+jmYekMge/xSrHqpQ/1xgGRYK6pM41jVcajRrYOwYdnQIgPTs/88NO/NoIhwBgqPf
+dxnayCsTwgNdiLY/bbdrnpUVQwr4/nopWchjtBogDnp5AwioaNryARvZefE1rX5G
+A5OGPFkHlQUNkpqGmeJhLYuJ2LU3SwPhExoiA9OtpdG0sqcEMRe69EgCPKqYh2Zg
+Jy6NmbmsEQh3PjR4mnb24gQiOZ5T3kNXo3TO8EWvHUaOE77qF1VcpcA2U8KZFzgu
+o0puK19Q5+eTJdr9kHK/8lHg+Opvs5Mmbk7wZFXfnp+VjSJZ8uSMk1rJ25qcFAe8
+7nJBFc80BCIU81alyikA3O2pp0j48aQiApal27PbWmLhzY/bd1DouT/VPRlpYvWt
+HtDLekqGkbD2O15nBQGn54W5KPE+4TliLilml0BVHQr0sPSEuMhu5eNOFQARAQAB
+tDVEYXZpZCBMw7ZubmhhZ2VyIChjb2RlIHNpZ25pbmcpIDxkYXZpZC5sQG11bGx2
+YWQubmV0PokCTgQTAQgAOBYhBIM5x9KULrhU4/J85a7p3s/VgumEBQJdktSpAhsD
+BQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEK7p3s/VgumEyekQAIQ7jmJ2wR7X
+4WZeLSrP8boVkblqUC6L0PB88Mag6YwDO4cFCXM44bvGDWo+KuKkkmI1EWjyXXKT
+XjlTIgrq71u91UAJk5ctZ0PwmJRHQTG6p3bpf6ENa28B0jhJ+bQ/S5pot50jgVBq
+umE/sysyjZZyXxvj3mbNq7Qo7wiu+Oifw0BSzJ9DRWrbk0+KtmiJdCQ0z062E2QX
+uFJaDdZMwurdAwdHk2JbktGDkiMfBhOaWW3avfh6KHRRNdCoLNpiMAyDqb0mElde
+7do5Y4UxxPU43KwJVs22bJcyh+kbeRm6sR9mHRpZeemzYDUUCdeA1qle2ODbdyVP
+WQaRJ5aLnydt/uuvk1pFq0i5mJ0n/k9CLPG6tzEuoxTLut9mZP8EcvgbfYfSL6ns
+My2xjCGgMjHY8FZTLeOJAHlTu9IHHEqW+W6hL3WSb1ZcyT6iO+wNxfuqBX7lIW3b
+Hpl4Dt2eHn5e9Au2GLNQuzmuYS1AqmfahHzsG8Htp2P7ULRBpt3n7Xz/R5ohxRRG
+X4zfBOzBYWVLSzdyBJrKlqP2f7LYLPcCAU4dWJqjjMmBqbwF8zVJipQpyVZM4Vag
+SWy4E0AeYDhvrJ6vkJDZmmYZylwKqSj0Q7nTM/1sRh7sETqB3Up2C+8PlBWctrhR
++4ZRL+MH2qNOdq1DdYUuwbVGx0cfbbFhiQIzBBABCAAdFiEEoRmHAvw+Cgmprlt1
+1aHU8mbejd8FAl4lwywACgkQ1aHU8mbejd/tFw//U38ryawaXBSCQhhTNNBhsFWj
+H+65JVUx6cbkGvybnAU1C5E44lcqZwKnGAei3EF/UDAQaHG581B3iHhGd5Udt1J9
+lbwc2s9LvZ1od2g2196CgOb5IPtqIjtCx4ldzx4Bt9fFwXkpeIEFM+fjjQNic2S0
+MeZ7m8gQpRbnCcgfXIfj80mncxGJdG5ehEIDi8hqwsOQClYtj7+Q+MTTVsWoJX/o
+Ben9qt8+U3GE20C8mTzIBqFlzNqev1wtBxYKn/+Mzspcy56Yrbv/aIUGBL4ib6Ub
+VFNvYf+5YCPR44mzyrno2ptQNyvDumkX+uX+DBeAQi6nkF1w1X+hwTP7tKU5Dg3L
+4m5JsW/EBQgNkZtvubQSPRUQQ3V0/wEfvxM8iQc/FArSrY307H7pH5/s8fVbo2IM
+Y89C13fTGlkkLxOLTFBYK9SwK9sANsA0xPYuBrEIVDtFbGEr+YSziOiycyzeuM65
+/42kjMMeowid40JSnadiHnTqzL1A9PkQfGC5h66rQB1qg7zaXLlTOWl1U+2gw66e
+zkeRTySXhzCEPligpERhnh7ujwLOSzZGtMG7k1rcQSmU+wQF90Dtyi8xF6/Ipk07
+1IRHeGJ9jph3VYK5SSKAyrGG3aJou0ece3tgK4meRs5KovmsrFBl8ZISr6ma+8v1
+lOu2a93W2e0RdwxydRG5Ag0EXZLUqQEQALAbJitrHdd94ND7DH8DsoPq1scSNShj
+AWfC9aILTJyTKjpc64eJmNwXHcZPxvGDfXc+UERcccPsRz/+kV2VsH4NFmw8gBYx
+zEZ5nzy0CRfdMOflM2xhshyJcnjpB8A7hxQM9wWV1L0gNDymD6r9uItvqOZ0fjDA
+c5kjuCgNhNgPjFa6jSiVoDSqdpyOVKJzsYARlOM4JLyRQk7YhXF7hs23dGxyT4qr
+X3lq83c3DS8SN4hKmRpj+dOGUZnttGKvXohZLrWg3ZKtEMpK9S9UruVVNw39QlhP
+xoih+qCYu4r2Ko/N8NVhH4Q5LliYmC/S6DdAIk+RAOA2SBzEgeNfZD9lUdcj6WyY
+xcZ4C+4PSPzYBSFKI4ubk1CmDx6jII6AGe6SbwlLEoXbffnTC6LmF4B3yTVUoGdp
+4Nh1EX3wrID0VJbRS89eZcFH4ATuy3xvpPn/eYlmj4+lEB4/jfGeHYCgJbTesMvP
+zzykLaRTNiDM4U0NxOH8CZkR/gvxFflu0jLgP4nIPNsBg9BkHrPvHk5OnDNutjYX
+zZ49qgEr3SwnRip3ny2XurX2nzNWa9+hjFK5xowHYjfWbhyXDcQpuMFAnsDrJNvT
+3K6iSygAthqsss562VMne7YA2/PgG9mepzgJAwrWP93S5uzKhBPanI+8GU0gbkFu
+b+y3ug5XyvdbABEBAAGJAjYEGAEIACAWIQSDOcfSlC64VOPyfOWu6d7P1YLphAUC
+XZLUqQIbDAAKCRCu6d7P1YLphJYWEAC5YSX1lL48SIeGSN9beBlluH2fR9E0ZeFV
+daBq4lABqN+GmRQNMBNXMY5ByQTnq7l4JLBa6t1DUz2b7TYi5RsZ5M9Th3oDFVl2
+oliTuv3B7TsUozSB9hCiHbNfGTA7KI2CI/05f64oCVs2QNvfJ9KH7P1OqjsP7zHh
+aX1Dk7berh0BZDrsV5R+of1+KuLJcKVpPYiCRZWKIzdnMCH5cFeUGOqDm55Xoz2x
+XUIzIP1MMklahKnxQv97rvX55yFUisxHDpKhSmIUXF2IvT3a+EdUNrrzlVPJHb14
+as+TWEPdLSzZdDwY5CWaHqhJEO4uklvqauKPViramH12B9BdtVzNEZqSZMzgLOYi
+UDgRdNxuybJDyqwnz+E8vsFjMqKh628+//BeeLAUcaPZ21niO4IDemobpkyHlgv3
+Goel60L82M5zcfOML/NgTSYpP5qOQZLK6fBiy0k7gchmzQn4zcNagljsmkX60SPW
+yjvAqGHdN3sBkAlVjSrXJFvr4VJIjtjql8XhRexujV5lprLpaGpDUSJ0n2nhi5uv
+EhsOjhQy2+L5ln3M/OdosU9Quabjeytn9wCg5O+cdsd+65zzeUoUSgGcS7VKDTRA
+Qodl6UiL2AnKCFx9q0pjqetAEAJHZTXdLx9V6fnTimA4NGFpHpXRA4lSevfLqUMh
+3LCH08vn/g==
+=Bcrw
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/ci/keys/emils.pub b/ci/keys/emils.pub
new file mode 100644
index 0000000000..ed90458905
--- /dev/null
+++ b/ci/keys/emils.pub
@@ -0,0 +1,64 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFyweBwBEADB60TDslzjYvyv2bkciqYZyHYx9SMs/5q9MfPPtfn+AXGHD7sA
+GZEFnL3hGNjyBEfYqebMKPdt5cSD6JbCfM4AvbKSRGvBtBlsl+DlmGeTqTFQSgJZ
+2ZtS6/s1HSz9szkED89eVWdupGFChQVn7sORW5+z247+pGYhBeccfb28UQRyPztl
+8GxZ5J7TEpNElL5PVI3Q8DhyMN9KX2cukpyDTMRgFGBBOAR4lPO3PgxYw8KSUTzD
+X8HZENYB8McTDLkCyZiRoV+VlEJ1gY0lq0td+ey3D+HCDN+Gg4T53Y9HGNmSLW80
+GdkxTPFDBoxseJdhYxqDTClWUblfzM6nntZl86H0Vms1gfsF83RfPoXerlHs+i2b
+y9bsDyPJM1mAqy98sop9EZ8X9bcsHskHPPPg6KWuVp2sMczVOYc87G94K33r/nVF
+gOGRTRPFOjvJD/NTJjzTGlfleXbiv2OMHiaYuidRF6J+lyQCOfsQB9uYhcSe/eWE
+3v0pEl1J6c1dEASaZH2vlk21MW1eeVc/Az0T7nHNaXLY4Sdk+0cogrSV5VN8ZqgP
+vfA8M/ay74xX0Vhb0n/76mDQLgaE1kPRGedEEJZWnyg9T24Jkcr2Bz/esDphyd6W
+xGC1bv9TvtgzWRGt5453FShlZ+sYTMsn6wCk8hcah9I2m4Nm9q3rcvNWTwARAQAB
+tDFFbcSrbHMgUGnFhsS3aXMgKFNpZ25pbmcga2V5KSA8ZW1pbHNAbXVsbHZhZC5u
+ZXQ+iQJOBBMBCAA4FiEEdGyNt52fh2RIQ+7G8Uhh9PEmkn0FAlyweBwCGwMFCwkI
+BwIGFQoJCAsCBBYCAwECHgECF4AACgkQ8Uhh9PEmkn0h3hAAoV3g7f84NZMqC1M3
+xVB6M6t/bsn6YUbaDExT1wU1QpQijq0KdDPcMhKTATwphCp29t7KH1dhkVDRT8iD
+7krNIl7rZ/auLKmUKqe9xtECFMygBdt2hie4vDRgcDtIz5vScGB+UnheOrrb5RMp
+jjW5j1rNR7lw9ZswWi1cBy6D73GCrP/Ays/3r5VvqdW+DxxCmRmROGP5GlGl9Ef1
+sJJV1rqfZuk6Lrb6zUXUBB4E0hC/vAXS4wgQYAD04EPRin2uAZpz4cBlWgsglYn8
+qKaJ4JGWwpd0s7sm1FjpWv8zNt/aWFRvo6P/NBa9+SkQncP4M9WSufY4D1xzELrl
+arRUJsdKfYyU51f9hMTcTlKQWyW7Wnjg3qUrNLSrWslamLyawW9ZW7R6z3eencnZ
+rqoWgcu9PIKlhMe/4saF1FC2qADISxBVlu6xtQaqMehp3mTVknf9hro7SRXARJrB
+hDsDap/GOEYaSbjPVlNeRxaQ9WqKI5NtIXiBo3jB932Ay7RDJ0NqxrMwhk+TcT9N
+HYLEE/KxPRH/7sDB8cj33DTDhWBqmia1MZopzEdXzMlOTJIE/QarpF9wQgjHU0og
+oX/AbBLISWYOj656gsZMv91JYjftfvEmr+ciQnJRtUyCaFbddjkmyFYoZNp+QD4K
+QShPyQSIZC48+3u7unbWGyk7LDSJAjMEEAEIAB0WIQShGYcC/D4KCamuW3XVodTy
+Zt6N3wUCXiXFkwAKCRDVodTyZt6N38q+D/4vB2kRa1YsbCDopQS5SQ6SSxim6aCO
+CgK7haIylgT708qaJtqpJbLAUU1+G9QyuixyP3uQbHvidZ7RNnF1hrMW/wzN4zzq
+dxUAx5RAA/eFWGluJUSxzH7ww4RInjvX9AwQLmZcT1rX8wH4Qw+Ow/9AKx72cQo2
+xLxOYR4cX8vPSP3vi2fdehDm7++qF0TBk0M3jZ8brygt2G/7g5BSohHzFNcrN/9Q
+QCNeGd44ffI8ClNz6Lhx+6srSGHYhreDQl2QtRcdLQvUfEbQozngpemG36Y9x8eP
+KX1M7d06zVKJEYvdqe4+NLllnXuC82EU736QBimrw/dz+6jgdnuacZtDwXEKkDXP
++R6qUgGG3TTJEglhn+l67pc/7HjFhUXVho3nznbGZNutf9e7xJ5ulWxQIYwx0Eig
+usPLNDcB1jtNazLBxSYqSOkyA/9axLUcWbj1WnZcM5bI6irowUhbJsEj6Gdx6r8N
+j44zX+KjhnMtzD8SrFDgrgPmdDGfmWvLq5gEdt0fpHEObCWOn0ckCLr8umy9quN3
+jT5GtiXbFNiHJKHhkZs1u04Sc9Zp0Nod8+m9z2PUZifcZqaF8IvWhgROamLF1hzI
+ziH2hMetCw29MpMdSKlssBlpQXldi9Jwm5DGZKvACBjQre1Ym5NA4qMe5tH0ak+K
+t+RwtpBzURMp2bkCDQRcsHgcARAAqZGVLfq/qBkPurucS5HwxinB4twnAM5kPolj
+3tij/m0b7m1r7fU0K/FTvfTA1XWwB787Z05hlP2XkN+Eo0OxeVBIDGs8LpNm36Vn
+cpEDyA+OBtl5enDJIGgWLiXXjvrlCByDRFX7EN14NRXybPZWVqMP31rHSsM97gNX
+QOHze8rdcorafHXvr6ZSY0HwwAGAXsesLBpLOfe9bU3LqPzAyJstNagKEf3o5o8M
+1f6vwqwCmsIVa4x/Fsas6iyXvH96sJRmq3RG/aMyNKv+qnrQHmXiHBK2/xF4hwu6
+LSNqjFKpS7O5vHlje449sN4cxd+oMW3LXZCusSTG1k42Io+vv/wNI8nARyAUUX5L
+BhNaVpclbF1LoF1P+uYLwYsC+MMxYu9S5GwyvbrT26HHftstvhCFlEYiP7MDf4P5
+PcGuEWp8gHS/GQIpE7Gs6edsSj+9G7K7Wi/AmywnrBoAn1mYDxrZeR/b0QWOLziF
+c93oC8OTBFxJAWfG61X1O0+2nLm2NT+EotytRlRo1IiL1JlJp/TpDEDWQfW8U9QU
+7zoEj0SkxA65BZOBVNdu7MzCvWfGKy4PZzloJTKuOlKObsigFhqde67CmKiWL9Qt
+pIdIMjPYYQJPxuW+/0U52dhbw76/1Hqa3t0udywVug+OSLgkadh9IIyORqHWXMSZ
+V3N9Q98AEQEAAYkCNgQYAQgAIBYhBHRsjbedn4dkSEPuxvFIYfTxJpJ9BQJcsHgc
+AhsMAAoJEPFIYfTxJpJ95pkP/jfkvDLrOVf6HB8k+w/zIxxoAC2gD9PqYy2whIDt
+aSeCtsoPQy9IkvRHSH4nV9PLHt0Sj30ui0zxe2KwmSTwKRQ1hRsX+xaKCCmm72xF
+f/yR8yMlVDmFh/HQCVWCNeh885Dhmld1af5oY9FasXU6dHnWB2bUbrmXeVRjVVsJ
+SaHUnBBvpD9wM1NPLhj2GPkDbb9UXobqmegJ3wa/wz2UyZ3qFixsl+g0VmU7n3+c
+hiVn5cfqBChxPryzPVAeduNp+RuXK9S6riQw+wr0tOyUIjHIyc+fgVojOQRMrTj0
+q1eb0qtoOgss0o6lRQFufkEPvKEkE1QYl9yqok0rav5MKEdnyWNJCvJcUIMDOkjJ
+6kGsM2ALNuE7YyfGcRLorHIy4b3Waow6zGLgexf1Omk/sl2AKCpWWUdV8Uph4i4/
+j4h6QbsftYU1hS3AzaUHYETvOWF1U5/lOJ5e3itL0/ofJ2SKK118HyJiuHcVlDQ3
+6XRTX/VmfEOZuXrH1UoJkHau4irdKMJKDsEHdPxWq5OdZXo1H2f/4Zr9bkrPBMRg
+Wi6NIpGzLHqvO9/zo5Po3uFOVbnWogCtrn7dY9tT0KsRpUMmzxFFEV8nwVq9Yb4M
+fJYFhsrYO5UQJUebrwdfL6/LP7u06zMSRggMeQwfTti1n0POBKHzPmhRrUW6vKDE
+iQ69
+=+FbO
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/ci/keys/jonathan.pub b/ci/keys/jonathan.pub
new file mode 100644
index 0000000000..817c5888e2
--- /dev/null
+++ b/ci/keys/jonathan.pub
@@ -0,0 +1,34 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEYnDtHRYJKwYBBAHaRw8BAQdAd6bpCoumhZYt8jb5nFJaT5MDACOqELEJigX+
+aJ1E7Ne0HEpvbnRlIDxqb25hdGhhbkBtdWxsdmFkLm5ldD6IigQTFggAMgIbAQIe
+AQIXgBYhBEfGT+IXRAcTqOhnV4Tzf2pdVrSSBQJicO2dAgsJAhUKBRYCAwEAAAoJ
+EITzf2pdVrSS7HcBALU/p64QXpcH4MsXkeeB6LMrGrl8LvwkNQbZ+ZPif5wFAP99
+k8P6mCXjyhJWzAfz0EJlpHiLv8NaMZg8Xfvv9QrtBIkCMwQQAQgAHRYhBKEZhwL8
+PgoJqa5bddWh1PJm3o3fBQJicPAaAAoJENWh1PJm3o3fYsgP/2f2aDRRMdq9+WaL
+C0P1vFCLZ7AfD9f/M8tvkt1Y45HTKo+zFbzuz6Rj2bFs/acrQbH2PkuOVtV1RKPu
+zYys6ys3LXp6u9gPhz+9zlv1gYq6DDcK7oUSVFU7Dpp8MidhX5Nmx7LL0y0vzjSI
+3aeqUphTiZFM4cO15k1hrmics8t2l+CnVZr4XFMSMiIXJviRgVNEDNcquPri2Gl7
+bowf0+gNaJ3wmyDNZyQk4Jv5IcE4LoY1/DHw/d28qkOhNh2/ktyhCDsgZqMxnoJy
+xwCpxTRF13NJnOVRxyvUjnEO6wQkFbDbZMVoYroBZCqY62CM6x/qYhvHc19KMmxA
+sSfDBtwRTO9Ne934Gb+Z0ir4FZNs/bfUiBVZUywFelayvwFZ0EOKbB/+ltlB1c9/
+YiOBzWf3rB8ssNSFHfKJvPhNIAZvSOyfGZqHaw4fKrsAuff9d8pr7E91cdRrumND
+hwtOsTx/kFEzreyWs1FqPmTzr0LLKvBCITMYyt2FqjV2QDmK3N9+xHB+azqylx48
+lcAWPTeIDjA2f9X3XeU8hpBrNI78P2kyCkTc5MVndHblG7pDGoFDk+chBgtMHJzf
+fgnh3A1KhuRxXri08qQPE6QUZjQt7WQd87NiFSEtqviYGD9XfGCatd2MSsVh3rHs
+ayq5ie1kZBF5qMwf1eO6tnnMKoNwuDMEYnDt5BYJKwYBBAHaRw8BAQdAsc8B/tcw
+Xy4VwBYnrOR5NGjKioO56b91qaFyd7lbnsOI7wQYFggAIBYhBEfGT+IXRAcTqOhn
+V4Tzf2pdVrSSBQJicO3kAhsCAIEJEITzf2pdVrSSdiAEGRYIAB0WIQQ/CEscYwEX
+IHPFwS17h+G+PX0/ogUCYnDt5AAKCRB7h+G+PX0/ojoIAQD4vimc8ADYdg1f4cCc
+wHvE8yQrt6B//4QN52Ujs7ruSAD/U+nW/xx4sASdNPtHuZev6rtftX0TgRYKPjqZ
+G4gLJAwD8gEAjhlWXhiL8q7ZPfWyMpAzx6TIeiCDoegErLptmFHf0lgBAPVjZRYw
+CuFAAXNdh7T6wHfBAinw7jOb5LTvW/j4yEkCuDMEYnDuABYJKwYBBAHaRw8BAQdA
+/Kz0kwA07NxFHX+BhjYJMNbGZ5p3qfXAYPv65+iLI9OIeAQYFggAIBYhBEfGT+IX
+RAcTqOhnV4Tzf2pdVrSSBQJicO4AAhsgAAoJEITzf2pdVrSSvu0BAJQbSfINwfrW
+LutAgIKr9v8Zgsv4Fmdn7JYKNQPLdpTLAP9VZYd5tIFe+RGJhtfUi6WssPtAdGvV
+0K+cJeSxightBLg4BGJw7jESCisGAQQBl1UBBQEBB0CH20snSTdUHig2qDmcVZ8i
+xuRVw4NhH3htUyqSVRa3KwMBCAeIeAQYFggAIBYhBEfGT+IXRAcTqOhnV4Tzf2pd
+VrSSBQJicO4xAhsMAAoJEITzf2pdVrSSxFYBAKaoU8nmdqykJGvminZ7II8XNuXg
+G0X3W81cxn9z5X2hAQCqwn3igtj7VDPM/a7oB7KCQfJlCARnww4eHPkZTnDoDQ==
+=Y1kC
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/ci/keys/linus.pub b/ci/keys/linus.pub
new file mode 100644
index 0000000000..fd6b6b0f4d
--- /dev/null
+++ b/ci/keys/linus.pub
@@ -0,0 +1,97 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFWdCVEBEADjVuGWDM6/UM2Rtk9/9fL4hJotw9RlgdMqb5dmFm8eKELyS0Y5
+xNIVrcVuHAl16Xy8vmGe76tS+Ctnpjyq9nxjwJMxSd+mpA4hDYLTEtz5FGvUy1v8
+NHHJhthpxNiZjIjYsH242rZtq6Yf1hOEMn9RVtzIreLIUJYagwk4D3tFd3kfsqCp
+TJJBbcpg2jSWB8rpl7a/Bdru2K0CJ+/SQ1Uio2MToEXovkuBFLqxT0I3x5MKzvsj
+l6XS8THZIjI2F496xH6CrqFN56aa4CH4pgf69LgsZWonNlCldh/TQ+xiZx4Z/DDH
+R8eM+pvpWnZhFD0wHJWqBUwb1Cg3wM7ZgYz0UfMHADiSkFp+3qbc7Uipi8wQTTRE
+OOVruOjv0RxCwmjn6cqxpwNX6uTs2Nm6BhWwZ3CRCiDyuJCxJCQ4x28k4mS62tmv
+Zk8s688K0q1B76jFUJa+X7+ZcIZOrw/2DFTP/8CAWO5js4SiFkv/pBuVHqMf4jyN
+MyAURcol8HQkrLWbE5DAiFW4j0GLYA35ATmH4tIn3fHsQ31FNjSpIS2icTlOejYA
+fLM8bsOblnn+HbFfrJ31j456Vj94fndf+k48PL9VJtKM6GT0upfyeT5SqcYEVsF4
+6xE5Zl24vys+KhnofdE8cIcAkZc4+HK7cYUzOxMYOq0Lxzs+XXWGldHHzQARAQAB
+tDhMaW51cyBGw6RybnN0cmFuZCAoY29kZSBzaWduaW5nIGtleSkgPGxpbnVzQG11
+bGx2YWQubmV0PokCSAQTAQgAMgIbAwIeAQIXgBYhBOoKd7+eEVYV/DvYvHZTuUDk
+lP6HBQJeJXf/AgsJAhUKBRYCAwEAAAoJEHZTuUDklP6H73YQAMHeRLdNG7lBfVPF
+YfzlBmawNThMCZazJ3zNZ+3asNmvSZ3P8OpWjXsC3dF/hvwzjmtrPx8RiLWxH733
+WESbRyvVYNwac//tAzkP2OS7BQXGZnlYtcwoAW5sRB6mr725kFh5NC4VisygqhtB
+bofdCV4Xjj8hQRiPENdkMbz1zvCLZjhKodm8+GRb3ih7nOUOn9v5ibqU7DtaEJ6A
+6RCFy+xo8/rD+0hvk5KO8sAGjteCgPkxJ6V5u2R3D1LTDu4w/Tzb50vFPupIteWa
+EFw2v1X8aOFETd6BL1KIiP5Ni1t066rrauiCq4ZYH2fVhSB5Fh2wGgE34AuKrPk5
+vI9HGsRn0JoTkigPiCFeFAWMogn4MX/qD0eMI4J9C9KhHjGldZyympCVsA7NpuXG
+BNDTZTzNFdgE6zfu1f08Aq2MKUaabjiZ+pJMnK9BsYn1JtquxQANihen0ivhIJhg
+GVs6+wy8GbnYlggbOXU+x6h7PDWs8d+4N0Nzy4kyQfEU08FDriSB5U8RHA18H5rB
+ACVNikFr0mlGQ2kq2TZP2f1H11rWCkKPkIPM5Dq+Ilqnr5Lx1mZViCf9k1um5ul8
+8PSVYCTvPWFXrzrvnP+vGAMLC+s8rAw1mxI8X11XEg3NgDScOVPg+KOyz6fXVqa/
+8KWN6j4JFbUBz/H8sL6YGUKmbSwCiQIzBBABCAAdFiEEoRmHAvw+Cgmprlt11aHU
+8mbejd8FAl4lfCEACgkQ1aHU8mbejd+LXxAAh9XGU+G3WGz/uHFNSRLmt9XRP79f
+wCcQO/0vR+4VX4v86SX1thGKZHRGPFZMr3tpgFOAybux7MYgD58TrwF0Mh/kGDr2
+CX6EDRNVa+t81p4cS7eKMsIY7MQ4A8yk5EaHzQQpMfpCoJmUF8epPLtJtv4qHXDI
+GPSeHJXAJGfAEeiLF2UPypA4hHGjyj8KtGzoLJ+2hOoO0PUwvBt2kViTFw9xojjK
+luyAXxOL19Z+tI3fa+5pYNOYml50qT1Lv8bnU2NN8dzu0yTErulg5r8sto7m2yQz
+kt0EUnWvq5guW0fb4yFtsB2Zz75ZgvnJbP+3il4pndD4ZlhDyXYo+kGAGmub4GH8
+tsFo5V8z4l7SUQB7aM+QDsuLU4d+6FiVagHH7gD53eFe6dY5TbhnWW3moFyNWDN1
+OloddP0ho1FPeiQoSQas8rkPrRMOAXLUPp2arf+HhV/W9ZzzSoFbTnCKkOL1OL38
+MJTQl/9/8s8LhVszkJMf506TfrzlciHa+kR3z92M249JCvVrqYp+KT6NCjJExgEB
+g3+DubMbqsohGrn49z8IaJqJWg4maYo2nKENyNesbmdAu8fgSIHh565s1AgDFlG3
+ias8rt13SB8Y94/l3CSvqJL+ajfHAEsxQA9nfpkeounFLOAyGqcpWVsDvvsjh/0a
+kRQbtt2MxF03YcG5Ag0EVZ0JUQEQAO4M9wzWmErzf/RPjGDf8weu6lc9gCUJePKd
+XjsxFHdYVtHXmLert7X3SrkOCzaNWGV8mUJT0lsdWn2CODQqq04V0itL9m+l56d7
+0n5FNXyDhdywk4MV30FOPgkzMCBzBNlqAHsX2MDyYHozlfFouGHuss86tPQyJ98I
+pLchmSNMYO2/L6xfotA+xCH8u/50gXqEZkHZsKM+Lvv6fS+ADjU55FqLM/Xgxdmq
+Gj/6YIwrBPrukEcE/68Cvs4L9WfuDcu7F+R8eE7pDzGhe1nzAcMvkIYVUaaA3qw9
+8SyhVEEfZjz5ySiZlJEPds1BkY2hm4yS9PIraJtvkUCM6xMklQ0g8YazC05DoKpm
+LZL5saDQr4xphMq+Pg9CynNl/x/CvAeAtcZhZhe3DpwiItCIAfDGpYsWsoX3bF3j
+3ZEjO8n0lbKONURqXKdWL6TNcFT86kX2LwaJZvNyY1cg8hxIATC6f4ChbbjmC2br
+STERmCVeN62HUiaASAVXKjpToqKNb+89KG3vqJGZwvPlgpduidKLmbdKQmp7YjNk
+hGPgqUpdBl1MraJw6YDBrS43IlpdDIwurt4nUYEYIZV5HzQ6Uu4ZAKZQ7M0fW7S+
+WIVzVNZdqcQF4CKErjvSQI3z5SvIG4r5Q5fMwizMDHBJzIZglUcRA28ZHFLIAmBS
+gkXX04WtABEBAAGJAh8EGAECAAkFAlWdCVECGwwACgkQdlO5QOSU/oei9xAAjFBq
+BjX1irYObVR1cKtuPVVL8dQJgWN/sr86ljxZni/ToSScKa3I5BHjXQGr9SZEPgjv
+70rez2dzOuUBhy69Mg4s6V9PaVGzVpIHE3iHN6xKfj61Gje5Dt503oqxZvHIDwRI
+JdXtOizC7/5YETE9EILCkEFeMRiFdXo5RWnuWcYlcbTEEnpNw9Mn/btcSnApqC42
+CMvyD7vzrzw02PvzxNIR8t77MsE7BTz7DSi4qD/1pUJMWtPJ8EcN5OiyaxR7+VSM
+7oaKIEQd6OMbC7XBaAcKUklcpd26f1x8xL7RuKzCBK6AWmuR76SFCSoZeMw2Dhby
+gZKe0NgEshJkwTdbNNVnMsP2/r0HYwsN+XrgS3Xa5hP5NsLQC+xH0F/lQslLH65v
+qqYXxmRJ4EM0q5ohdIhTId/37wYtBmkvzTkK6PyMCCQMK0j0Qksj7NZT+uH0ASGX
+uybimqPLR0bNKirxy2KLaARbSK3l9omCG2+HurHhlYz9mMdcxDS3sXHdU7as5FHR
+gowNLgFolO4p1La/se0YpfG9mN/kcVrz9TqpZQN3k8hfalTk2W7vEUcKmzh/4Uvg
+HzbhloNkBJR0FgalL4vJZkLNLRDiLPTv2j7V3qCXOADqZSVjmHX3r81AGAdYSd55
+JyFVuXte92L8OjNmVkU2pKxc4d2QxzJPKB7Q3K25Ag0EWBco2QEQANF9PsaThgBc
+ob+fDt7OZX9m7EE8XWGZc81qvJOVCYfjAi21QvWgTuYNBheqrMf3U1om7Sw9t8pJ
+eE3I3A2XsxltCEw/S1s2Jqh5Perdu1c1iK5Idj3AQLh3UKB3ipV6hMEUSD0S7glK
+OnOIisJk1uaLOYfUsvIzf61Axzn4hXJGxqIabERDSXDkLRGO9WTvxYsXG2ZacHLf
+74rbD8cCsSWuElWqkx4WjIVd//i1BtJr21Erd5t8fydosJtxmFhudBWmt4ltbPxT
+TrisMqAp451UvUuC5hnXWHAFO8KveQ5RUxETTC3jqCD2fsdpiD4k7phjDp7vstss
+Nx6Z5xsK/4gSnVLXnifExT38vwrq0HITiPiadn2ImKUP8gDmz2dZ0UvZYrL2ywA/
+bZtrQDm7rT3RJhrsJoPRm7EYW3kTwgCm66PCVmCIF96YrFJqLVYIGygi3CxTD83Z
+gWFbXiM8jmH6Y9aY/ix47YAFtMwBAQ+qJhSJvnKBxSv/sFQHS0UEnHT+UHxm/3jS
+Hrxk/MqUpcg7toWxZrhHOwtqNgh7NtmOcDhghiDPYB878p7+G7XeDemnZUmQbbXf
+o3xAB8r3QFEl7095LofMVH3DR2tbiKIu9Z9hkABnqwTcvTw0ac8GCajvi5uwwOC8
+IHLcxJw4iuSYotRrrotLt4XJiGrOM9fBABEBAAGJBD4EGAEIAAkFAlgXKNkCGwIC
+KQkQdlO5QOSU/ofBXSAEGQEIAAYFAlgXKNkACgkQeM6qjLcuRGcnSxAAyxSEAbpO
+DjxMfRMYJmJ5J2ZykivaGU1+oFUrdvvX0X/0OjxhMdSJegUtduqOtAqeWVAOoOFd
+TtqgGNiqd+XBWwGE6081hHdVHtg0wtf6VXPak7wTv8ncviOr7lOvwbfbBqNMO3Xm
+mYO0e0XIypKoTuV7W1kU/YgnYOcjHAH5kTMfBlcupHgIbLJEfEnvLoOc2noL07xh
+RDme4/fNnty1twMbos3Iyc3Mi78MGKanEesX32NcShmxYl8Wp80Pv9kIoCJkZaBD
+LqVcc0swKbfHYXL+8lMthWte+PoCjgJXR54iugsPjANQ+fv972tZzq60tefQyaXb
+jefgf1huFqiYZY462lBp7v8TRYX8isdEUKFVZElVFZwKVsAU2v1zbTaq3xI/T+2W
+tmMOsijwwMvx1rdWf82OHUhOqWuwtE2MMndm4mj8WIXdeebcqxlr9tFHDeMM86aw
+htddxPK7piETdhPwr2tHdAjGe7xpJPyaZaQyXGv232/Nn4AqCjEXMxWpBpV+4Eou
+gzta4Z4Rzi818eAFXF0Bd0o33vlgBLYVND+1uNhcck8Dmv6ifdxWjkt/bbjW2I3j
+FJ3iy9jW+/k1QkdalCn6Hv9/gWxL5N8QSDutmc9hnuQuzEYz4cC8Fk6uEPx0clu1
+0mWj6R9yREzporwWcwxelwqPap4PKA/yWWIrkQ//Qc+ZGpUrzlDnfM8SBBDSBOXV
+GqXxRIZnLZNAkPd19qsVeXiB4GRuuvVTw5WcJ4JiB1/Vrl0fg0VXfPTW2t/PvZmB
+k72u0V99sNagEwyX+ULQQw08fweSGi5d+7MMQJc9YBrunOXwUUz4EWUor1gDUuGT
+EkmdolHpLp5Z4FRnG0WZWPdd314Wz8/8RzNcke5Dq66dT85lmIeTR0MJrqyAWDCf
+HBZTCsTaxOtOBTZpfv/1R2IjM9tEjwdLgbjSRO1X5KXvdp/U143bAtNsORb56xpP
+j7fwqn6p6KLtF+xBKTYB+vCbxr4TCbZ4mylTq6BSOXwkDxgMRtVoqEsk+IBfiOmp
+RXexJ2a9boDX/g1z/P977dL5QIjSHlOWp2bMO7yqQ+/pmVjNZhMTr4rSQAezH1M1
+puTwJjB1TAqqI6qfLD4qwRa7jbelGJMzSHWPtrv/Dd652RYQzUviUo5/zCjNZ1f6
+meW0Rx6HNx1NyJgzfOnLCHu7MPj1dO4HAN3AzoTG4XdT6uKEohLJuP5nF00Bu/hl
+TsHchyLlhJa5dzCFHQ+sJg0w+g+g7CYI4qmJAvLUzMxEDb2hwHlmrlZiVMKCisUw
+AsZ03j1ZrZq+VM6jhmB8lOY6x0X/rSTz7a4nzuwKPmHM94/EMhJDm3aB+hA5F9kF
+i8Ay0MMaYqBsx6e+eBg=
+=PLRS
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/ci/keys/oskar.pub b/ci/keys/oskar.pub
new file mode 100644
index 0000000000..69ea501828
--- /dev/null
+++ b/ci/keys/oskar.pub
@@ -0,0 +1,75 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBF4lrHQBEADJZRC8DX+7p1CLzgQYF2oKxFiAX0pOzCuZXwjgLpit2jHcp8s8
+US9+v8P3ZYNcTigc3Eq2IQSenUe63ZyB9S1shnsegEqShAGYqDCaTl4dySVCOYBQ
+MdenG3leTBP1QAf0yVOMYuROUYGn0A0s1WTH+iG5zTKA2vtsQ5SBrODMC8MzxkQy
+0Sm3pvZMzLXFkq+RsE88GoSmshQ150pTIkLPew8Sqp345/kDTaaTH1OkRIbLThTD
+dl6uyX8HqmwknehpZsOG4voUIBHa4EgYybH76XS1eB1MrwOh2qUoEfGYcc/Ytvkf
+aw7B1txDsdq98Zqn1wkvxv55mREPazMRWkXqKVLvbEhI4whDnPKShWqTPfsnQwq8
+VxjYKvbUnmZqRBylohyNUyUzvawUExQVMusaW1lWJxQwpkcR50DgtDDDwQiU1NmI
+H2RZCbyqaa2mJSn7iPMEiYQoLo9RDY47xdaYrknWoerYUHp8PSEamRZCdbr2l216
+BNuQ0b3faizOqvImIFc3mdJG9VznHOEMlV4G0OkrdUH0sSwE95MFECkra1P4KZ/t
+7F6M04zvCJf26Ih+yEkeoJrhvjQX+XzYg7R5JbHxaZY6nkNcuqeRvDokqburjW89
+vr5FyDDhaEhWOLyXvl3FARUYbEprUulCsJh5W2j+16fEq95qb1XcxiN2gQARAQAB
+tC9Pc2thciBOeWJlcmcgKGNvZGUgc2lnbmluZykgPG9za2FyQG11bGx2YWQubmV0
+PokCSAQTAQgAMgIbAwIeAQIXgBYhBEuYbvUiK6G4ECMMYC85HeawDWGcBQJeJbaj
+AgsJAhUKBRYCAwEAAAoJEC85HeawDWGcoTMP/iX118Q6CRxalkszu/VFWbWeMJ2k
+hrumfLTFq2Lm6CvzGJiXBFYTYuYdwds+Arqx3MuYKs/0Ec56d5SiM3p/Uk4pdu1B
+viPPgSPA96KpO7Db6mhUavNoR7wToR+ZaZdWq8PBHegqJthl1tqmkgccB8r+0zOP
+7/CNib/zXwLGSfFrmnfwlaSZWsoDDVRTeEqaQRor7/2TtHLWq6/qrVDICSxcVxPz
+7+MHx6aPlxZRZLPhDKvdC/LWfeonP4RHLYASEzjGUEGQxZuxBgigUO7dDpB/OuHB
+gdfjDMPExVzeqLMpddFzuCD9mBwfwT6lLazrbgLazQ63P4mGNkG25jzRxza+DHHS
+Q+sL7YsQnqiDSMGTYOjtxUB0HRiFScKN+oIZ1p+VDNRpbxokg6JEXOXCpc+ZFMMn
+DSQxdTqR0fA2o4eerbScItOlYjVCCogsGimfAo8zmuU6fbhkEE7+t87JUN5ErT9K
+sd9btcw7vNU6EAiZVYDRhwjx6g9ew8aEEjFq83vllsjsa36nxjUtousqH2f4YJI/
+tMhLd9CpmJupRT5xz4XNsnnBNBhCOVXdQ/Su2PtrcvvsIeXgz5fv8IwoKRwFM33E
+1L8DPzV7Z8lHHfszEQjMiFzumoXDRsoPyk3uC7PjKQtk2FBKuICGvMDyIHosHOX3
+45Gi+MezSR10LJnkiQIzBBABCAAdFiEEoRmHAvw+Cgmprlt11aHU8mbejd8FAl4l
+ukMACgkQ1aHU8mbejd+3fQ/+PHWYKkOm9RFaqDjzvkHTVJDv5ggWn+PQzxbWWA/Q
+tTXJ7DFZ4W2J6oW+NAlvFuhYVJpSeoBxS/grtVYmXtjkWfhh/ljkOyEZ+FbaryRS
+8H4WoTjER+XPdkPxbmM4XLHEYZNF8GBm1TQfJga2/WRZv1ecaohXqT3IpL4AipmD
+tPgwniFM52NqHkrL3i4i2uU1UKkSX2yNd7eXV0gW8a6w6YOWa2nKyiuHrMWNWDO6
+oQhyiPtou0dBj33tOUIp0JMk0Tj5ybQiKAPaVpEGszycC3BpcNo05mSKOr746c6I
+ur6C+crkEAY6FED3u8adEUcVFCzD8uXQAe3m0iun1F+4wv1M/sQY+js1IvUpTrso
+Neay0Qx3Xnwvm0vu7Ym2ITnBUzpA5k2XAXsDCX5Io2flD1+CU+AyY9ge9h6AQiJ0
+Yp5LYncGhWSszwtDC+GSBI/NUNeAKjLJV11EVELgVAYhFzG+XyCSzwFEjnDKyUEO
+qWyPaKuATmVJO1i4M2qdWdzi4++z/S4/BPpsqbw3Sz5Xs++z2aTuvjxdx8GG7Ah9
+aT0Tzxg5kHYoLBIpFzoMYfvin7GYLtuXFJ/Xt4wLcuAGZEetkbXDoxU6/xIn6ro9
+IFwW6GZfkVjORqWMHrUPwHo6h6/eo7kwnY2uvlzoVjD+ISw1a32wxlAAkmXv8GUs
+R6SJAjMEEAEIAB0WIQTqCne/nhFWFfw72Lx2U7lA5JT+hwUCXiW6XAAKCRB2U7lA
+5JT+h3QRD/0YUXMJL729neknKv6YBu9gBKUiMyJ2CDx1ux8jctfK5MKSeZH8aQKz
+vK/24aHMcsC1y4IYhgr/75qj/CmA9ttQDCMvcEn+a31rGnwGOo1Nj7J4a9m0MskT
+0rFmd4n2kiULNasfhAKUlTvv9652fO79txPgYxDVMQ03D6zY033BLcLULIIifGn6
+WQZVr1uawhQ9VypxN2JnGRz+0LKJB2rXSktP4LtLW0VVKZ5J8UqBf/Pah9qYnbmZ
+9rpMIoyhckHd6zfbtIQop6B9x5DMKsq+GLQ0bwzriNRU0AKGbHjY4dRNwCENSjqb
+yb6i085oATUVTph/OEn8xu05X7GN+xw3wPscvCOhKPzCDUOpQIDrOd0ubK1rmoVh
+zE1/YsJZI/VOxv786UXLf2vtcwkl8ZWR4VJW7TLuWZ5Atps39uJl2LgXay58OR/d
+m/RXFpdf5NWgvJg07yaxWZivHToZz9M7Rb2qMS3jLcw/8dH571Q7/hIJrK6dX7Fd
+OQ7BtYwThbvWfr37VZtWLxSKl+utaB5kLCM3rhE9heOovy23ED6+3ijr25sUqofo
+YrQIYYQ2QWRqMaDiWDub/7WaBM7FcRC/MZitF7unGkaxTu94zUHqoDeGNYgBqPSP
+JPWZopcW4cvPqDHAMHts9MxdQLe4vPvYJmcsilA7VBb7QzTv70P+bbkCDQReJax0
+ARAA4DxJIX5RMECz1FLk273O2Y0c4K4Bk28br+m6UkPPKjXNRZoIcsoPiqXrHRG1
+rxJMbM/djeiORXC2g/SpnIkOpGISHXhz5TFFBMDTlUFHJvaIW0VTRFLsdtqNtDiW
+p5BlVivVg2DTdsxeo4xbgCYZB2P6j8NQIejOYYYR+Oc7/JPY2knl9lZj3V4s0JwA
+YzViWnL634Gqqz/NbaX68WSKBWfmg2CA8mYjYQojOKOvyXA4uHGZtahXb+Zf4Z96
+my8Lo3J+ZdRG2Z+5uxEYBnjD2QSqOHa1jDX1FZVGcdKOsE71SrrN9i0DZwuP8por
+k+ctUnup6e25UFZevYqGWaQaLjhug8GjgbmIHHuVn1L31byw5Sb49GEbnUPIpXdA
+U8dcy5OYRN8mhMgYYx/N0K6q/nILc37v2r0ry6I//v2hyYEG8ROp+r/43ov9Uio3
+oW/UqPhU1D4VosGA5bxkzPPl1oblxwdc7XdSPCf3WhpWF4jsrPdRXnRv1mVaqe5A
+KCFQgdHo8zN0ryoGBgM0SQimqeZtD8+iSn3kkZtWF/9ssAVEtY9dceKG/Us0H0fp
+NBCyDVgBxabKwL/Lb9CwQ/gL/2ahQ20JK1mN08NauEtIGR/xwyk26OsuN0dOAQMd
+i+vFYu9x34Cv7H/mL5DmVaX3rql4MfRj8C/U56HGphQn8rMAEQEAAYkCNgQYAQgA
+IBYhBEuYbvUiK6G4ECMMYC85HeawDWGcBQJeJax0AhsMAAoJEC85HeawDWGcvSgP
+/24UOTjp2RFQ+xA+/xay8BUloU/Kb4PCtcQ5/97YxpV14lE+q6s9OCxKCrbpaNy3
+cHw0BTBianlY4Ld2eTwvWUmPF/QyWsLhmaJ2C2foIaEX6eIbihK1CrAqXsJPIMoO
+CP9+CYorHtjWdJvqp4LHHp37Xnf0tgFRp/kIHGhq8ucY4aGrh15CVcIfq+zr0Azu
+RfPq0EHB8ogRGJksFJqQ+2byaFlonPUYIHaV70CtjJFypxP9ZkayQs41jDV30HfG
+6HzFaZRtF6Xqgdcvrd+3fHUFTfoMb/3v4wIeXuO0HFPTwvT3vThy3MQAurVlfjem
+ojFYJxQ3XjmKynmTg/SPxHuufhxwqGJ9U6JHM7pt4YdcUprUk7J9271udyHlIjNh
+p6c/sbZ+NDpv9I8EUXKIiVnWcDgzAPVwUfWDI358CbUnPSd4T+YjQEbaHMTAKcAG
+z9FJGnre9qkSbKYCA0szyMLE6Mme1S0nTWqKSMxHM5GpjPSDvfZYaoWKQqTSJ2+/
+QIomC8VVGXK4+Ws6kyUo8Gd3tfjqwc/TCgDIpE9mN3Ipm0UimNwdWtze2F7icEp+
+nR9v8IQBROZWGJQVa03rprwGPvu6VQKQDH084qVmKUeYr9GQC02pCJjQUduop/xA
+NUHVkGIO0s3qWe6/HJL/hvp5Dmqmnsn4627J464v3cdh
+=HsQv
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/ci/verify-locked-down-signatures.sh b/ci/verify-locked-down-signatures.sh
new file mode 100755
index 0000000000..7ffdfc902d
--- /dev/null
+++ b/ci/verify-locked-down-signatures.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -eu
+shopt -s nullglob
+
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+readonly SCRIPT_DIR
+
+# In the CI environment we would like to import trusted public keys from a file,
+# but not in our build environment
+import_gpg_keys="false"
+
+# The policy of enforcing lockfiles to be signed was not in place before this commit and
+# as such some of the commits before are not signed
+# The whitelisted commit can be set in order to allow github actions to only check changes
+# since origin/master
+whitelisted_commit="618130520"
+
+while [ "$#" -gt 0 ]; do
+ case "$1" in
+ "--import-gpg-keys")
+ import_gpg_keys="true"
+ ;;
+ "--whitelist")
+ whitelisted_commit="$2"
+ shift
+ ;;
+ *)
+ echo "Unknown argument $1
+The options are --import-gpg-keys and --whitelist"
+ exit 1
+ ;;
+ esac
+ shift
+done
+
+if [[ "$import_gpg_keys" == "true" ]]; then
+ GNUPGHOME=$(mktemp -d)
+ export GNUPGHOME
+ for key in "$SCRIPT_DIR"/keys/*; do
+ gpg --import "$key"
+ done
+fi
+
+# Parse the locked down files from the github actions workflow file.
+# We need to define them there since github has no way to trigger on filepaths specified in a file.
+# We parse them from there in order to avoid duplicating the locked down files in multiple places.
+#
+# This regexp line is using a regexp to parse the github .yml file for the YAML list
+# that follows the `paths` key.
+# It uses `tr` in order to turn the multi-lined file into a single-line that sed can parse
+# correctly. This is done by replacing all new-lines with a `;`
+readonly SEPARATOR=';'
+locked_down_paths=$(\
+ < "$SCRIPT_DIR/../.github/workflows/verify-locked-down-signatures.yml" tr '\n' $SEPARATOR \
+ | sed "s/.*paths:$SEPARATOR\(\(\s*-\s[a-zA-Z\/\.-]*$SEPARATOR\)*\).*/\1/" \
+ | tr $SEPARATOR '\n' \
+ | awk '{print $2}')
+
+unsigned_commits_exist=0
+for locked_path in $locked_down_paths; do
+ locked_path_commit_hashes=$(git rev-list --oneline "$whitelisted_commit"..HEAD \
+ "$SCRIPT_DIR/../$locked_path" | awk '{print $1}')
+
+ for commit in $locked_path_commit_hashes; do
+ if ! git verify-commit "$commit" 2> /dev/null; then
+ echo "Commit $commit which changed $locked_path is not signed."
+ unsigned_commits_exist=1
+ fi
+ done
+done
+
+if [[ $unsigned_commits_exist == 0 ]]; then
+ echo "SUCCESS: Could not find any unsigned commits which modified a locked down path"
+fi
+
+exit $unsigned_commits_exist