What exactly goes in the pgpKeyring field of the new manifest

[David Benson]

I'm using Keybase.io, as suggested. I have a public pgp key, but what is the pgpKeyring and how can I generate it?

[Jake Weisz]

Hey David, the instructions for generating the two PGP files you need to include can be found here: https://github.com/sandstorm-io/sandstorm/blob/master/src/sandstorm/package.capnp#L381

-Jacob Weisz

On Fri, Aug 28, 2015 at 11:45 AM, David Benson <david...@gmail.com> wrote:

I'm using Keybase.io, as suggested. I have a public pgp key, but what is the pgpKeyring and how can I generate it?

--
You received this message because you are subscribed to the Google Groups "Sandstorm Development" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sandstorm-de...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Asheesh Laroia]

I will personally send a chocolate cake to the first person to submit a pull request that adds app marketplace documentation to docs.sandstorm.io. This is not something I got anyone's approval on, just something I decided to do five minutes ago.

Your mission, should you choose to accept it:

* Create a pull request against https://github.com/sandstorm-io/sandstorm , specifically the docs/ directory, that adds a new file documenting how to submit one's app to the app marketplace. If you can't submit a pull request, that's fine, see below.

* Please phrase the documentation in a way that makes sense to you, since we (most of us who work on Sandstorm every day) often forget what does & doesn't make sense to others.

Details:

* Kenton already wrote some docs, but I want to make sure that (a) they live in docs.sandstorm.io which is now where we point people and (b) I want to make the docs are easy enough to understand.

* Suggestion: When people are here https://docs.sandstorm.io/en/latest/developing/ they should see a link to some information about the App Marketplace. And then when they click that, there should be information that they need.

* I also think we should migrate the details-on-different-sections out of capnp comments into text. Up to you, the pull request submitter.

* Chocolate cake details: First person to reply to this email "locks" the task. Then you have 48 hours to either submit a proposed pull request or email me your proposed text. I'll help you revise the pull request if you submit some text. If you don't submit any text to me, then the "lock" goes away, and someone else can email the thread. Email comm...@sandstorm.io when you have some proposed text, so I don't miss it.

* You'll presumably have to sign https://sandstorm.io/cla/ since this would be a long contribution.

* Technical details about the app market can be found at: https://apps.sandstorm.io/ and https://github.com/sandstorm-io/sandstorm/wiki/App-Market-Submission-Instructions ; the wiki page links to a few "capnp" files which contain detailed documentation.

* How to edit the docs on your own machine is documented here: https://github.com/sandstorm-io/sandstorm/wiki under "Technical documentation". If you need further technical help, I can provide it, but I'm at a wedding this weekend so it might take me a little bit to get back to you. Therefore, if you get stuck on technicalities of our docs system, write the docs in whatever system you prefer and we can turn it into a pull request second.

Other:

* If you want to give me a photo of you eating the chocolate cake afterward, that's great; I love photos.

* If you wouldn't actually eat a chocolate cake because e.g. you hate chocolate or have dietary restrictions, we'll figure something out.

* If you want to do this and have been working on it but need more than the 48 hours, that is fine; the 48 hours limit is there to make sure the "lock" doesn't go to people who aren't legitimately interested in writing this.

* If you are a coworker of mine, I'm not going to buy you a cake.

* I can send cakes domestically (US) and internationally. e.g. http://sendachocolatecake.co.nz/

[Jake Weisz]

Since I managed to do the publishing thing, I might be able to tackle this this weekend. I have to publish one more app anyways, so I still have to go through the process again anyways.

I don't do chocolate cake though, really, so I'd just be doing it to do it.

-Jacob Weisz

[Asheesh Laroia]

OK, you have the lock!

[Jake Weisz]

Though I am now curious what I need to know for the Mac/Windows a.k.a. vagrant-spk publishers. I know how this works on Linux.

-Jacob Weisz

[David Benson]

Thanks Jake, that unstuck me. On a slightly related next issue step 3 at https://github.com/sandstorm-io/sandstorm/wiki/App-Market-Submission-Instructions, the publish, is complaining the key not found in the keyring. I tried the app ID, is that right? If yes, does that mean I've generated the pgp keyring wrongly?

[Jake Weisz]

If you are speaking of the webkey in the command in step three, you are supposed to use the exact webkey on the page, as that is the current location of the Sandstorm App Market's index.

-Jacob Weisz

[Jake Weisz]

Alternately, if you're seeing the "<appId> key not found in keyring" error (which I didn't think would show up in step three, but makes more sense to your error), you may need to check on your
$HOME/.sandstorm-keyring file. It contains the private key associated with your appId (which is the public key).

"App signing keys are not stored in your source directory; they are instead placed on a keyring, currently stored at `~/.sandstorm-keyring`. It is important that you protect this file. If you lose it, you won't be able to update your app. If someone else steals it, they will be able to publish updates to your app. Keep a backup!"

If this is your issue, it is unrelated to your pgp key. Running 'spk listkeys' should tell you which appIds your keyring contains the private signing keys for.

-Jacob Weisz

[Jake Weisz]

So https://github.com/sandstorm-io/sandstorm/pull/794 is my version one of this. It isn't linked into any other docs pages yet, and I haven't cleaned up the outdated publishing instructions from elsewhere in the docs yet. (PR the sandstorm-website repo is still an instruction in the raw packaging guide, I think.) It is a work in progress, I already have things I want to change or break out into separate pages potentially (licenses). But at this point it's basically the key info from the Github wiki page with the GPG commands and a light version of the metadata reference from package.capnp.

I also submitted a PR on etherpad-lite to add shortDescription so it is a complete example of a valid manifest.

[David Benson]

OK, that's late night development for you, I put a 'drawio.key' in the directory that stages the build, a hint methinks. I used -k to point at it and it published. Need to read my own Makefile next time... Many thanks for your help Jake.