* Move example and integration test configuration files to /etc/csaf,
this includes the provider's config.toml as well as the test OpenPGP keys.
This shall make it more compatible with good practices like the FHS.
Co-authored-by: Jan Höfelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
* Adjust provider and aggregator to copy the used openpgp pubkey into a locally
provided directory `openpgp` beside the `prodiver-metadata.json`.
This more robust and self-reliant than using a public pubkey server,
which is the reason why the CSAF 2.0 csd02 mentions it as example in
"7.1.20 Requirement 20: Public OpenPGP Key".
* Improve aggregator by removing a typo `aggreator` from one written paths.
(Done with this change as it also affects the openpgp/ paths writing.)
solve #85
* Add general hints that this example only shows how the components
work together and that a GNU/Linux admin should be consulted for
a secure setup.
* Adjust the scripts that setup a testing instance to use better
permissions as good example.
* Add a section about security considerations.
* Add an OpenPGP test keypair.
* Move script parts of documentation into script, so they can be used on a fresh Ubuntu 20.04 system
for within a github action to setup a csaf_provider and upload documents to it for an integration test.
* Use dineshsonachalam/markdown-autodocs in github action to automatically
insert lines from the scripts into the docs.
Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
