# Web Key Directory

WKD is a protocol to ship PGP keys to users.  GnuPG implements it as of at
least 2019.

See [WKD][wkd] for details from upstream.

Torproject only implements key retrieval, which works using HTTPS GET
requests, and not any of the update mechanisms.

The directory is populated from the tor [account-keyring][keyring].  When
updates are pushed to the repo on alberti, a hook will rebuild the keyring,
rebuild the wkd directory tree, and push updates to the static mirrors.
Note that only keys with `@torproject.org` UIDs are included.

To build the tree, we currently use [Debian's][debian-keyring] [update-keyrings script][debian-keyring-update-keyrings].

Key retrivals can be tested using gpg's wks client:

    weasel@orinoco:~$ systemctl --user stop dirmngr.service
    Warning: Stopping dirmngr.service, but it can still be activated by:
      dirmngr.socket
    weasel@orinoco:~$ /usr/lib/gnupg/gpg-wks-client --check al@torproject.org && echo yay || echo boo
    yay

[wkd]: https://wiki.gnupg.org/WKD
[keyring]: ssh://git@git-rw.torproject.org/admin/account-keyring
[debian-keyring]: https://salsa.debian.org/debian-keyring/keyring
[debian-keyring-update-keyrings]: https://salsa.debian.org/debian-keyring/keyring/blob/publish-dane/scripts/update-keyrings

Note that we're evaluating alternatives to our homegrown system, see
[issue 29671](https://gitlab.torproject.org/tpo/tpa/team/-/issues/29671).
