Subject: [pgjdbc/pgjdbc] PR #3701: chore: add GitHub Actions workflow for generating release PGP key

From: "vlsi (@vlsi)" <[email-masked]>
Date: Mon, 30 Jun 2025 20:19:13 +0000

See https://github.com/vlsi/provision-release-pgp-key

We can copy-paste the workflow right into pgjdbc repository or we can have it as reusable workflow.

Any thoughts?

See also:
* https://slxh.nl/blog/2016/pgp-and-dns/
* https://www.netmeister.org/blog/dnssec-dane.html#dane

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Mon, 30 Jun 2025 20:29:31 +0000

Just as easy to keep it as a re-usable workflow in the event that something changes in the future

---

From: "vlsi (@vlsi)" <[email-masked]>
Date: Tue, 01 Jul 2025 10:34:09 +0000

I did not intend creating a new branch in pgjdbc/pgjdbc though.

---

From: "vlsi (@vlsi)" <[email-masked]>
Date: Tue, 01 Jul 2025 10:35:19 +0000

I've updated the workflow so it explicitly passes the required secrets instead of passing all the secrets with `secrets:inherit`.

Now the missing bit is to settle on the key name and the key email.

---

From: "dsvensson (@dsvensson)" <[email-masked]>
Date: Fri, 19 Sep 2025 06:11:11 +0000

I guess this is the related to the key change to:

https://keyserver.ubuntu.com/pks/lookup?search=305F296EAC47556B&fingerprint=on&op=index

Would be very nice to have the release key recorded in git history for example here:

https://github.com/pgjdbc/pgjdbc?tab=security-ov-file