Onboarding juanarbol as a releaser

[BethGriggs]

@juanarbol has prepared a release (https://nodejs.org/en/blog/release/v17.9.0/)

We now need to complete the remaining onboarding actions (from GOVERNANCE.md):

• Be added to the GitHub releasers team in the Node.js org (grants ci-release access)
• Be added to the GitHub security-release team in the Node.js and nodejs-private orgs
• Have a single, high quality SSH key added to the "dist" user on the primary www server
• Have a GPG key added to the nodejs/node README.md
  • The key should be cherry-picked to all active release branches.
• Open a PR in nodejs/docker-node to add gpg key to node.keys
• Add the key to https://github.com/nodejs/release-keys

[nschonni]

Did you sign that release @BethGriggs? Just curious why there wasn't an issue in docker-node when the key hasn't landed there yet

[BethGriggs]

Yes, that one was signed by me (part of our onboarding process)

[nschonni]

Thanks for confirming! Just wanted to make sure our downstream check wasn't silently failing

[targos]

I did the first two points.
@juanarbol can you please point us to the SSH public key that you're going to use to promote releases?

[targos]

@juanarbol I think it's also better if you do the pull requests for the last steps.

[juanarbol]

I did the first two points. @juanarbol can you please point us to the SSH public key that you're going to use to promote releases?

Absolutely, but to be honest I haven't promoted any release yet; I've prepared a release at this point.

Besides that, what is exactly a "high quality SSH key", I'm not really sure about how to generate one

@juanarbol I think it's also better if you do the pull requests for the last steps.

Will do!

[targos]

Absolutely, but to be honest I haven't promoted any release yet; I've prepared a release at this point.

Installing the SSH key is a prerequisite for you to be able to promote a release.

what is exactly a "high quality SSH key"

I don't know exactly. I use ed25519, which is recommended by GitHub and also has the advantage of being short.

[nschonni]

https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent might be helpful

[juanarbol]

Just a quick question, I've two GPG keys, I sign commits with one, and I have created a new one just for releasing Node.js. I get the two keys by running gpg --list-keys (output below):

gpg --list-keys
pub   rsa4096 2020-02-18 [SC]
      MY_OLD_GPG_FOR_COMMITS
uid           [ultimate] Juan José Arboleda <soyjuanarbol@gmail.com>
sub   rsa4096 2020-02-18 [E]
pub   rsa3072 2022-05-02 [SC]
      IS_THIS_THE_GPG_KEY_I_NEED?
uid           [ultimate] Juan José Arboleda <soyjuanarbol@gmail.com>
sub   rsa3072 2022-05-02 [E]

I'm not really sure about how to solve this one "Have a single, high quality SSH key added to the "dist" user on the primary www server"

[juanarbol]

Thanks, @BethGriggs, for the help with the SSH key.

Node.js README with my key: nodejs/node#42961
docker-node repo with my key: nodejs/docker-node#1714
release-keys w/ my key: nodejs/release-keys#15

[BethGriggs]

Think we're complete here! Welcome @juanarbol 🎉