Member register

How the digital seal works

Three states

Every public card has a digital seal. The graphic sits next to the word.

Not sealed Sealed Stale

Not sealed means no signatures yet. Sealed means the current card matches the signatures. Stale means the card changed and needs to be re-signed.

Member and Dalton

A card with a digital seal is sealed with the member's house key, then witnessed by Dalton, the doorman and bouncer. He did not sign the card in your place.

Member signed Dalton signed

The four files

Each icon on a sealed or stale card opens a page for one of these files. That page has the download.

The unsigned card. Filename mr.token. Signatures are checked against this file.

The member signature over that token. Filename mr.token.sig. Principal member (-I member).

Dalton's witness over the same token. Filename witness.sig. Principal dalton (-I dalton). He did not sign the card in the member's place.

The OpenSSH allowed_signers file. Filename allowed_signers. It names the member key and Dalton's key. It is not a signature.

How to verify

On a sealed or stale card, open each file's page and use Download. Then verify with OpenSSH. Check the member's house key first, then Dalton, the doorman and bouncer. Verify principal for the witness is dalton (-I dalton).

Member

curl -fsS -o mr.token TOKEN_URL
curl -fsS -o mr.token.sig MEMBER_SIG_URL
curl -fsS -o allowed_signers ALLOWED_SIGNERS_URL
ssh-keygen -Y verify -f allowed_signers -I member -n easyeasy-mr@easyeasyspeakeasy.com -s mr.token.sig < mr.token

Dalton

curl -fsS -o mr.token TOKEN_URL
curl -fsS -o witness.sig WITNESS_SIG_URL
curl -fsS -o allowed_signers ALLOWED_SIGNERS_URL
ssh-keygen -Y verify -f allowed_signers -I dalton -n easyeasy-mr-witness@easyeasyspeakeasy.com -s witness.sig < mr.token

A file page opened from the card fills these commands for that member. Download on that page uses the filename above.

House signet public key: https://door.easyeasyspeakeasy.com/.well-known/easyeasy-mr-witness

How members apply a digital seal

How-to on the door: hdi register sign.

  1. Edit the card, then save.
  2. Print a one-line token from the door. Redirect it. Do not add a newline.
  3. Sign that file locally with your house key using ssh-keygen -Y sign.
  4. Upload the signature.

Saving after a digital seal makes it stale until you sign again.