{"action":"created","comment":{"url":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/comments/232672592","pull_request_review_id":173918666,"id":232672592,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzMjY3MjU5Mg==","diff_hunk":"@@ -0,0 +1,294 @@\n+# MSC1714: using the TLS private key to sign federation-signing keys\n+\n+Matrix servers use an ed25519 keypair (the \"signing key\") to sign events in a\n+room and federation requests. This is intended to prevent malicious servers\n+from masquerading as other servers, which might allow them to forge content and\n+access data they should not otherwise be able to.\n+\n+Remote servers must be able to confirm that a given signing key actually\n+belongs to a given server. One way to do this is simply to ask the target\n+server over a secure HTTPS connection; however, we also need to verify keys\n+used in the past by servers which are no longer online.\n+\n+In theory, this is currently done using an approach borrowed from the\n+[Perspectives\n+project](https://web.archive.org/web/20170702024706/https://perspectives-project.org/),\n+which involves asking a number of notary servers for a copy of the key, and\n+checking that they agree. However, in practice we have ended up in a situation\n+where almost every Matrix homeserver uses `matrix.org` as its sole notary. This\n+means that `matrix.org` is therefore a single, centralised, trusted point in\n+the federation.\n+\n+[MSC1711](https://github.com/matrix-org/matrix-doc/pull/1711) discusses the\n+problems with the Perspectives approach in more detail. This proposal suggests\n+an alternative approach to the management of signing keys.\n+\n+## Proposal\n+\n+In brief, the proposed solution is to have the origin server (server A)\n+cross-sign its signing keys with the private key it uses for HTTPS connections\n+on the federation port. Intermediate servers (server B) keep a copy of this\n+signature, so that when a new server (server C) needs to validate the signing\n+key, it can use the certificate chain to confirm that it belonged to server A.\n+\n+Each server therefore maintains a list of the signing keys it has seen for each\n+remote server, and the time it believes they are valid for. (It must also\n+retain copies of the certificate chain that it used to reach that conclusion.)\n+\n+### Extending the signature algorithm to cover RSA keys\n+\n+It is likely that the TLS key in use will be an RSA key, so we need to extend\n+the [JSON signing\n+format](https://matrix.org/docs/spec/appendices.html#signing-details) to cover\n+the use of RSA keys.\n+\n+We propose:\n+* The *signing algorithm* identifier should be `rsa`.\n+* The *key identifier* should be the `sha1` hash of the `DER` encoding of the\n+  public key.\n+* The *signature* should be the RSA signature of the `sha256` hash of the\n+  input, encoded with unpadded Base64.\n+\n+It is also possible to use other algorithms such as secp256k1 for TLS. We\n+propose that these not be supported for now.\n+\n+### Extending the `/_matrix/key/v2/server` response\n+\n+The REST endpoint for requesting a public signing key is [`GET\n+/_matrix/key/v2/server/{keyId}`](https://matrix.org/docs/spec/server_server/unstable.html#get-matrix-key-v2-server-keyid).\n+This returns the requested key, the server name, and validity period (as well\n+as a bunch of other stuff not entirely relevant here), all signed by the\n+key. To this we add a signature by the TLS key. The response would therefore\n+look like this (eliding irrelevant fields):\n+\n+```json\n+{\n+  \"server_name\": \"example.org\",\n+  \"verify_keys\": {\n+    \"ed25519:abc123\": {\n+      \"key\": \"VGhpcyBzaG91bGQgYmUgYSByZWFsIGVkMjU1MTkgcGF5bG9hZA\"\n+    }\n+  },\n+  \"signatures\": {\n+    \"example.org\": {\n+      \"ed25519:abc123\": \"VGhpcyBzaG91bGQgYWN0dWFsbHkgYmUgYSBzaWduYXR1cmU\",\n+      \"rsa:df88cf5955704d6e0d21feb6662c87a070db4b01\": \"pfUHoNUX4CNA+EUhGZDW9w1ngjuODKGTLLdwZpGCCgmPgV/QGy93Myn8XNAyQ...\"\n+    }\n+  },\n+  \"valid_until_ts\": 1652262000000\n+}\n+```\n+\n+When the requesting server receives this response, it uses the public key from\n+the TLS certificate to validate the signature.\n+\n+### Extending the `/_matrix/key/v2/query` response\n+\n+When a notary server returns the keys for another server, it must include the\n+complete certificate chain alongside the keys.\n+\n+The response to either [GET /_matrix/key/v2/query/{serverName}/{keyId}](https://matrix.org/docs/spec/server_server/unstable.html#get-matrix-key-v2-query-servername-keyid)\n+or [POST /_matrix/key/v2/query](https://matrix.org/docs/spec/server_server/unstable.html#post-matrix-key-v2-query)\n+will therefore look like:\n+\n+```json\n+{\n+  \"server_keys\": [\n+    {\n+      \"server_name\": \"example.org\",\n+      \"verify_keys\": {\n+        \"ed25519:abc123\": {\n+          \"key\": \"VGhpcyBzaG91bGQgYmUgYSByZWFsIGVkMjU1MTkgcGF5bG9hZA\"\n+        }\n+      },\n+      \"signatures\": {\n+        \"example.org\": {\n+          \"ed25519:abc123\": \"VGhpcyBzaG91bGQgYWN0dWFsbHkgYmUgYSBzaWduYXR1cmU\",\n+          \"rsa:df88cf5955704d6e0d21feb6662c87a070db4b01\": \"pfUHoNUX4CNA+EUhGZDW9w1ngjuODKGTLLdwZpGCCgmPgV/QGy93Myn8XNAyQ...\"\n+        }\n+      },\n+      \"valid_until_ts\": 1652262000000\n+    }\n+  ],\n+  \"additional_certificates\": [\n+\"-----BEGIN CERTIFICATE-----\n+MIIHIzCCBgugAwIBAgISA+UZe4LyoLxziTfqbd/0D87vMA0GCSqGSIb3DQEBCwUA\n+MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD\n+ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODA5MTgwMDU2NDJaFw0x\n+ODEyMTcwMDU2NDJaMBgxFjAUBgNVBAMTDW1haWwuc3cxdi5vcmcwggIiMA0GCSqG\n+SIb3DQEBAQUAA4ICDwAwggIKAoICAQC6NrmFIQEbzC0An676DnDrfd5P0s0rzRY6\n++TOCRbxYZVgIqzcLJze0ca2UywZ312VEAsuPDvAcnfi6Ej6xv/sizsUyGIy83nPp\n+qNrkiBlHS8cILVtTbVyt+ZJgU81+oyZPQG7a3dewXh9ZKim4vwWVLLJC6676t7YL\n+Ksfx97bbgh4xb0LaffI7fJLDH0aelV88asNmAXBsjEnNhpEriib+vxliHs79kw/2\n+HOP7DGTc2pxET8i6mJvgIP86aKZyaJze70oH9F5AaL3MBdtRxusYhcxNftbvb569\n+tX+6hN1rmsq7c1DIrHIz9sXfUFWa+qL+j8rVX19uZtSfDuznQ1g0pQAQW6ow4HxZ\n+zMzXW1PrrYYGF+S3lh5ozJIrbkmNCTaeiocKx5gamNZ/DchIqHB2pY3EO7UwU7Hn\n+8iquOoUr/QC5joq+qjYscH8LGlC0RlgU0ZdeyDeIvZreu8UYjYxfL+GuyTp5e6py\n+fyEpyTwMPJGkCz9Qn6iUWhRpxgAqVFbdQEO8FY4SwAdqr1JVbhcgMyudGO/ofub7\n+CjPNzEBT0Hz05ihW4DDoOMYXB7VGqKnnjyIKIN6bvs8ztqm//soYJaeFL71c9z8G\n+CGbhlImrATZe2C0qg/S9NhWUr+ESG7D7UpwK+iMPuVf+o6e+dq9/Td3rrtFpN2r1\n+B2lJIbFBTwIDAQABo4IDMzCCAy8wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQG\n+CCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSgPe8H\n+gzqEX7m0wOqKOJVr6GZVBjAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86js\n+oTBvBggrBgEFBQcBAQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14\n+My5sZXRzZW5jcnlwdC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14\n+My5sZXRzZW5jcnlwdC5vcmcvMDYGA1UdEQQvMC2CDWltYXAuc3cxdi5vcmeCDW1h\n+aWwuc3cxdi5vcmeCDXNtdHAuc3cxdi5vcmcwgf4GA1UdIASB9jCB8zAIBgZngQwB\n+AgEwgeYGCysGAQQBgt8TAQEBMIHWMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxl\n+dHNlbmNyeXB0Lm9yZzCBqwYIKwYBBQUHAgIwgZ4MgZtUaGlzIENlcnRpZmljYXRl\n+IG1heSBvbmx5IGJlIHJlbGllZCB1cG9uIGJ5IFJlbHlpbmcgUGFydGllcyBhbmQg\n+b25seSBpbiBhY2NvcmRhbmNlIHdpdGggdGhlIENlcnRpZmljYXRlIFBvbGljeSBm\n+b3VuZCBhdCBodHRwczovL2xldHNlbmNyeXB0Lm9yZy9yZXBvc2l0b3J5LzCCAQQG\n+CisGAQQB1nkCBAIEgfUEgfIA8AB2AMEWSuCnctLUOS3ICsEHcNTwxJvemRpIQMH6\n+B1Fk9jNgAAABZepk2FsAAAQDAEcwRQIhAPktfD8mbtvBwnCzoRY9bIeSltkPeX5d\n+EghHgC5UTYPFAiBtOlV1hAR72B+SWNT96ekLCPTRlnN2Z5ipmYd/FuSL/QB2ACk8\n+UZZUyDlluqpQ/FgH1Ldvv1h6KXLcpMMM9OVFR/R4AAABZepk2N4AAAQDAEcwRQIg\n+F3zx9U/eV7sQs5Civ4iMaY57aCZxsvymHL8PFPB2w4kCIQDeD9nIgQUuUWmDpPpW\n+3qyLV+MkT4EmEm6nXgWw/bfSGzANBgkqhkiG9w0BAQsFAAOCAQEAY/kY12CN90Y9\n+f83CQXxa+1ecI0iLK1VNec52cBhR4am7hmAZs4C4EGWPm7XSQH14UJbXuNS6jTd1\n+n/eMlz/U5+LmkV5sB2knSIywHC+kKFADjCOGk5FIZihCv1Q3dtW2l9U6mBqKswvN\n+O4nIXyer0XzEzq9LdOZ5QTeoAUUfQBjOHOUbV2rMk+kKm+zY26MBrkx6PKkNm68l\n+rJ7r96V4ML9R504090hLOfw54SkRhFDImDHqwn4nsQ8NxdDegPBVVi+WY+OIvAur\n+fU58EBL6OZP8RMnmH3s9qbU52mUfMVVzPtv4JQJvCZgESZR2p06qTbrpG20t+dbq\n+1Kl/BZOLmA==\n+-----END CERTIFICATE-----\",\n+\"-----BEGIN CERTIFICATE-----\n+MIIHIzCCBgugAwIBAgISA+UZe4LyoLxziTfqbd/0D87vMA0GCSqGSIb3DQEBCwUA\n+MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD\n+ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODA5MTgwMDU2NDJaFw0x\n+ODEyMTcwMDU2NDJaMBgxFjAUBgNVBAMTDW1haWwuc3cxdi5vcmcwggIiMA0GCSqG\n+SIb3DQEBAQUAA4ICDwAwggIKAoICAQC6NrmFIQEbzC0An676DnDrfd5P0s0rzRY6\n++TOCRbxYZVgIqzcLJze0ca2UywZ312VEAsuPDvAcnfi6Ej6xv/sizsUyGIy83nPp\n+qNrkiBlHS8cILVtTbVyt+ZJgU81+oyZPQG7a3dewXh9ZKim4vwWVLLJC6676t7YL\n+Ksfx97bbgh4xb0LaffI7fJLDH0aelV88asNmAXBsjEnNhpEriib+vxliHs79kw/2\n+HOP7DGTc2pxET8i6mJvgIP86aKZyaJze70oH9F5AaL3MBdtRxusYhcxNftbvb569\n+tX+6hN1rmsq7c1DIrHIz9sXfUFWa+qL+j8rVX19uZtSfDuznQ1g0pQAQW6ow4HxZ\n+zMzXW1PrrYYGF+S3lh5ozJIrbkmNCTaeiocKx5gamNZ/DchIqHB2pY3EO7UwU7Hn\n+8iquOoUr/QC5joq+qjYscH8LGlC0RlgU0ZdeyDeIvZreu8UYjYxfL+GuyTp5e6py\n+fyEpyTwMPJGkCz9Qn6iUWhRpxgAqVFbdQEO8FY4SwAdqr1JVbhcgMyudGO/ofub7\n+CjPNzEBT0Hz05ihW4DDoOMYXB7VGqKnnjyIKIN6bvs8ztqm//soYJaeFL71c9z8G\n+CGbhlImrATZe2C0qg/S9NhWUr+ESG7D7UpwK+iMPuVf+o6e+dq9/Td3rrtFpN2r1\n+B2lJIbFBTwIDAQABo4IDMzCCAy8wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQG\n+CCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSgPe8H\n+gzqEX7m0wOqKOJVr6GZVBjAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86js\n+oTBvBggrBgEFBQcBAQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14\n+My5sZXRzZW5jcnlwdC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14\n+My5sZXRzZW5jcnlwdC5vcmcvMDYGA1UdEQQvMC2CDWltYXAuc3cxdi5vcmeCDW1h\n+aWwuc3cxdi5vcmeCDXNtdHAuc3cxdi5vcmcwgf4GA1UdIASB9jCB8zAIBgZngQwB\n+AgEwgeYGCysGAQQBgt8TAQEBMIHWMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxl\n+dHNlbmNyeXB0Lm9yZzCBqwYIKwYBBQUHAgIwgZ4MgZtUaGlzIENlcnRpZmljYXRl\n+IG1heSBvbmx5IGJlIHJlbGllZCB1cG9uIGJ5IFJlbHlpbmcgUGFydGllcyBhbmQg\n+b25seSBpbiBhY2NvcmRhbmNlIHdpdGggdGhlIENlcnRpZmljYXRlIFBvbGljeSBm\n+b3VuZCBhdCBodHRwczovL2xldHNlbmNyeXB0Lm9yZy9yZXBvc2l0b3J5LzCCAQQG\n+CisGAQQB1nkCBAIEgfUEgfIA8AB2AMEWSuCnctLUOS3ICsEHcNTwxJvemRpIQMH6\n+B1Fk9jNgAAABZepk2FsAAAQDAEcwRQIhAPktfD8mbtvBwnCzoRY9bIeSltkPeX5d\n+EghHgC5UTYPFAiBtOlV1hAR72B+SWNT96ekLCPTRlnN2Z5ipmYd/FuSL/QB2ACk8\n+UZZUyDlluqpQ/FgH1Ldvv1h6KXLcpMMM9OVFR/R4AAABZepk2N4AAAQDAEcwRQIg\n+F3zx9U/eV7sQs5Civ4iMaY57aCZxsvymHL8PFPB2w4kCIQDeD9nIgQUuUWmDpPpW\n+3qyLV+MkT4EmEm6nXgWw/bfSGzANBgkqhkiG9w0BAQsFAAOCAQEAY/kY12CN90Y9\n+f83CQXxa+1ecI0iLK1VNec52cBhR4am7hmAZs4C4EGWPm7XSQH14UJbXuNS6jTd1\n+n/eMlz/U5+LmkV5sB2knSIywHC+kKFADjCOGk5FIZihCv1Q3dtW2l9U6mBqKswvN\n+O4nIXyer0XzEzq9LdOZ5QTeoAUUfQBjOHOUbV2rMk+kKm+zY26MBrkx6PKkNm68l\n+rJ7r96V4ML9R504090hLOfw54SkRhFDImDHqwn4nsQ8NxdDegPBVVi+WY+OIvAur\n+fU58EBL6OZP8RMnmH3s9qbU52mUfMVVzPtv4JQJvCZgESZR2p06qTbrpG20t+dbq\n+1Kl/BZOLmA==\n+-----END CERTIFICATE-----\"\n+  ]\n+}\n+```\n+\n+The notary must present the certificates it used to validate each of the RSA\n+keys used in the signatures in the response. Of course, where certificates are\n+shared by multiple keys (for instance, because they are used as intermediate\n+certificates for a CA which has signed multiple leaf certificates), the\n+duplicates can be elided.\n+\n+Where a server is asked for its own key, the relevant certificates will already\n+be present in the TLS connection (and it may be difficult for a homeserver to\n+obtain its own certificates), so it need not add them to the response.\n+\n+### Requesting a signing key\n+\n+A server which wishes to check if a given signing key belongs to a particular\n+server now has two options:\n+\n+* If it only needs to check if a single key is currently valid (eg, because it\n+  needs to authenticate an incoming federation request), it can send a\n+  `/_matrix/key/v2/server` query to the server itself. It should use the public\n+  key from the TLS certificate to validate the signature in the response, and\n+  then clip the `valid_until_ts` according to the ranges in the certificate\n+  chain. It can then persist the key, together with the certificates, for\n+  future use.\n+\n+* Alternatively, it can send a `/_matrix/key/v2/query` request to any other\n+  server - most likely the one which is providing the events which need\n+  verifying.\n+\n+  It should collate the certificates in the REST response with those presented\n+  at the TLS level, and check that there is a valid trust path from a trusted\n+  root CA to a certificate for the relevant server name, using the correct RSA\n+  key, and use the key to validate the signature on the response. Again, the\n+  `valid_until_ts` should be clipped according to the timespans that the\n+  certificate chains are valid for.\n+\n+## Potential issues\n+\n+### Homeserver must have access to the private keys\n+\n+Obviously, the homeserver must have access to the private RSA keys which are\n+used in the TLS connection. However, this can be non-trivial where the\n+homeserver is deployed behind a reverse-proxy<sup\n+id=\"a1\">[1](#f1)</sup>.\n+\n+Indeed, CDNs such as Cloudflare will often use a shared certificate for the\n+public TLS connection which means it is impossible to get the private keys\n+without paying for a premium offering. Of course, it would be possible to use\n+another certificate solely for signing the keys, but it is inconvenient for\n+administrators to have to maintain the additional certificate.\n+\n+### Lack of agreement in CA roots\n+\n+This approach relies on all servers in a federation to agree on a set of\n+trusted root certificates. For example, suppose Alice has a certificate whose\n+trust root is CheapCACertsInc. Bob joins a room where Alice has sent some\n+events, and uses Alice's certificate to verify that the keys she has used to\n+sign the events do in fact belong to Alice.\n+\n+Charlie, however, has heard that CheapCACertsInc's security is weak, and\n+prefers not to trust certificates that they issue. He is now unable to\n+verify that the events which claim to originate from Alice's server actually\n+did so.\n+\n+A similar situation arises if Alice used a trust root which is a certificate","path":"proposals/1714-signing-signing-keys.md","position":262,"original_position":262,"commit_id":"8fc23cd1df987d00929fabf006914d8ae474f109","original_commit_id":"8fc23cd1df987d00929fabf006914d8ae474f109","user":{"login":"richvdh","id":1389908,"node_id":"MDQ6VXNlcjEzODk5MDg=","avatar_url":"https://avatars1.githubusercontent.com/u/1389908?v=4","gravatar_id":"","url":"https://api.github.com/users/richvdh","html_url":"https://github.com/richvdh","followers_url":"https://api.github.com/users/richvdh/followers","following_url":"https://api.github.com/users/richvdh/following{/other_user}","gists_url":"https://api.github.com/users/richvdh/gists{/gist_id}","starred_url":"https://api.github.com/users/richvdh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richvdh/subscriptions","organizations_url":"https://api.github.com/users/richvdh/orgs","repos_url":"https://api.github.com/users/richvdh/repos","events_url":"https://api.github.com/users/richvdh/events{/privacy}","received_events_url":"https://api.github.com/users/richvdh/received_events","type":"User","site_admin":false},"body":"Yes, I guess we do.","created_at":"2018-11-12T14:16:44Z","updated_at":"2018-11-12T14:16:44Z","html_url":"https://github.com/matrix-org/matrix-doc/pull/1714#discussion_r232672592","pull_request_url":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/1714","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/comments/232672592"},"html":{"href":"https://github.com/matrix-org/matrix-doc/pull/1714#discussion_r232672592"},"pull_request":{"href":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/1714"}},"in_reply_to_id":232448912},"pull_request":{"url":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/1714","id":229758353,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI5NzU4MzUz","html_url":"https://github.com/matrix-org/matrix-doc/pull/1714","diff_url":"https://github.com/matrix-org/matrix-doc/pull/1714.diff","patch_url":"https://github.com/matrix-org/matrix-doc/pull/1714.patch","issue_url":"https://api.github.com/repos/matrix-org/matrix-doc/issues/1714","number":1714,"state":"open","locked":false,"title":"MSC1714: using the TLS private key to sign federation-signing keys","user":{"login":"richvdh","id":1389908,"node_id":"MDQ6VXNlcjEzODk5MDg=","avatar_url":"https://avatars1.githubusercontent.com/u/1389908?v=4","gravatar_id":"","url":"https://api.github.com/users/richvdh","html_url":"https://github.com/richvdh","followers_url":"https://api.github.com/users/richvdh/followers","following_url":"https://api.github.com/users/richvdh/following{/other_user}","gists_url":"https://api.github.com/users/richvdh/gists{/gist_id}","starred_url":"https://api.github.com/users/richvdh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richvdh/subscriptions","organizations_url":"https://api.github.com/users/richvdh/orgs","repos_url":"https://api.github.com/users/richvdh/repos","events_url":"https://api.github.com/users/richvdh/events{/privacy}","received_events_url":"https://api.github.com/users/richvdh/received_events","type":"User","site_admin":false},"body":"[Rendered](https://github.com/matrix-org/matrix-doc/blob/rav/proposal/signing_signing_keys/proposals/1714-signing-signing-keys.md)","created_at":"2018-11-09T17:02:05Z","updated_at":"2018-11-12T14:16:44Z","closed_at":null,"merged_at":null,"merge_commit_sha":"c7d456ec85a613867b02df2ec25429283f900bb4","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":1006690935,"node_id":"MDU6TGFiZWwxMDA2NjkwOTM1","url":"https://api.github.com/repos/matrix-org/matrix-doc/labels/T-Core","name":"T-Core","color":"3f6caf","default":false},{"id":933911135,"node_id":"MDU6TGFiZWw5MzM5MTExMzU=","url":"https://api.github.com/repos/matrix-org/matrix-doc/labels/proposal","name":"proposal","color":"8fff87","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/1714/commits","review_comments_url":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/1714/comments","review_comment_url":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/comments{/number}","comments_url":"https://api.github.com/repos/matrix-org/matrix-doc/issues/1714/comments","statuses_url":"https://api.github.com/repos/matrix-org/matrix-doc/statuses/8fc23cd1df987d00929fabf006914d8ae474f109","head":{"label":"matrix-org:rav/proposal/signing_signing_keys","ref":"rav/proposal/signing_signing_keys","sha":"8fc23cd1df987d00929fabf006914d8ae474f109","user":{"login":"matrix-org","id":8418310,"node_id":"MDEyOk9yZ2FuaXphdGlvbjg0MTgzMTA=","avatar_url":"https://avatars2.githubusercontent.com/u/8418310?v=4","gravatar_id":"","url":"https://api.github.com/users/matrix-org","html_url":"https://github.com/matrix-org","followers_url":"https://api.github.com/users/matrix-org/followers","following_url":"https://api.github.com/users/matrix-org/following{/other_user}","gists_url":"https://api.github.com/users/matrix-org/gists{/gist_id}","starred_url":"https://api.github.com/users/matrix-org/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matrix-org/subscriptions","organizations_url":"https://api.github.com/users/matrix-org/orgs","repos_url":"https://api.github.com/users/matrix-org/repos","events_url":"https://api.github.com/users/matrix-org/events{/privacy}","received_events_url":"https://api.github.com/users/matrix-org/received_events","type":"Organization","site_admin":false},"repo":{"id":24998719,"node_id":"MDEwOlJlcG9zaXRvcnkyNDk5ODcxOQ==","name":"matrix-doc","full_name":"matrix-org/matrix-doc","private":false,"owner":{"login":"matrix-org","id":8418310,"node_id":"MDEyOk9yZ2FuaXphdGlvbjg0MTgzMTA=","avatar_url":"https://avatars2.githubusercontent.com/u/8418310?v=4","gravatar_id":"","url":"https://api.github.com/users/matrix-org","html_url":"https://github.com/matrix-org","followers_url":"https://api.github.com/users/matrix-org/followers","following_url":"https://api.github.com/users/matrix-org/following{/other_user}","gists_url":"https://api.github.com/users/matrix-org/gists{/gist_id}","starred_url":"https://api.github.com/users/matrix-org/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matrix-org/subscriptions","organizations_url":"https://api.github.com/users/matrix-org/orgs","repos_url":"https://api.github.com/users/matrix-org/repos","events_url":"https://api.github.com/users/matrix-org/events{/privacy}","received_events_url":"https://api.github.com/users/matrix-org/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/matrix-org/matrix-doc","description":"Matrix Documentation (including The Spec)","fork":false,"url":"https://api.github.com/repos/matrix-org/matrix-doc","forks_url":"https://api.github.com/repos/matrix-org/matrix-doc/forks","keys_url":"https://api.github.com/repos/matrix-org/matrix-doc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/matrix-org/matrix-doc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/matrix-org/matrix-doc/teams","hooks_url":"https://api.github.com/repos/matrix-org/matrix-doc/hooks","issue_events_url":"https://api.github.com/repos/matrix-org/matrix-doc/issues/events{/number}","events_url":"https://api.github.com/repos/matrix-org/matrix-doc/events","assignees_url":"https://api.github.com/repos/matrix-org/matrix-doc/assignees{/user}","branches_url":"https://api.github.com/repos/matrix-org/matrix-doc/branches{/branch}","tags_url":"https://api.github.com/repos/matrix-org/matrix-doc/tags","blobs_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/refs{/sha}","trees_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/matrix-org/matrix-doc/statuses/{sha}","languages_url":"https://api.github.com/repos/matrix-org/matrix-doc/languages","stargazers_url":"https://api.github.com/repos/matrix-org/matrix-doc/stargazers","contributors_url":"https://api.github.com/repos/matrix-org/matrix-doc/contributors","subscribers_url":"https://api.github.com/repos/matrix-org/matrix-doc/subscribers","subscription_url":"https://api.github.com/repos/matrix-org/matrix-doc/subscription","commits_url":"https://api.github.com/repos/matrix-org/matrix-doc/commits{/sha}","git_commits_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/commits{/sha}","comments_url":"https://api.github.com/repos/matrix-org/matrix-doc/comments{/number}","issue_comment_url":"https://api.github.com/repos/matrix-org/matrix-doc/issues/comments{/number}","contents_url":"https://api.github.com/repos/matrix-org/matrix-doc/contents/{+path}","compare_url":"https://api.github.com/repos/matrix-org/matrix-doc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/matrix-org/matrix-doc/merges","archive_url":"https://api.github.com/repos/matrix-org/matrix-doc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/matrix-org/matrix-doc/downloads","issues_url":"https://api.github.com/repos/matrix-org/matrix-doc/issues{/number}","pulls_url":"https://api.github.com/repos/matrix-org/matrix-doc/pulls{/number}","milestones_url":"https://api.github.com/repos/matrix-org/matrix-doc/milestones{/number}","notifications_url":"https://api.github.com/repos/matrix-org/matrix-doc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/matrix-org/matrix-doc/labels{/name}","releases_url":"https://api.github.com/repos/matrix-org/matrix-doc/releases{/id}","deployments_url":"https://api.github.com/repos/matrix-org/matrix-doc/deployments","created_at":"2014-10-09T16:41:02Z","updated_at":"2018-11-08T11:57:23Z","pushed_at":"2018-11-12T14:02:59Z","git_url":"git://github.com/matrix-org/matrix-doc.git","ssh_url":"git@github.com:matrix-org/matrix-doc.git","clone_url":"https://github.com/matrix-org/matrix-doc.git","svn_url":"https://github.com/matrix-org/matrix-doc","homepage":null,"size":8535,"stargazers_count":171,"watchers_count":171,"language":"JavaScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":84,"mirror_url":null,"archived":false,"open_issues_count":517,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":84,"open_issues":517,"watchers":171,"default_branch":"master"}},"base":{"label":"matrix-org:master","ref":"master","sha":"6a3d68b7ed5560195bcadd9bbd05677cc69cd14f","user":{"login":"matrix-org","id":8418310,"node_id":"MDEyOk9yZ2FuaXphdGlvbjg0MTgzMTA=","avatar_url":"https://avatars2.githubusercontent.com/u/8418310?v=4","gravatar_id":"","url":"https://api.github.com/users/matrix-org","html_url":"https://github.com/matrix-org","followers_url":"https://api.github.com/users/matrix-org/followers","following_url":"https://api.github.com/users/matrix-org/following{/other_user}","gists_url":"https://api.github.com/users/matrix-org/gists{/gist_id}","starred_url":"https://api.github.com/users/matrix-org/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matrix-org/subscriptions","organizations_url":"https://api.github.com/users/matrix-org/orgs","repos_url":"https://api.github.com/users/matrix-org/repos","events_url":"https://api.github.com/users/matrix-org/events{/privacy}","received_events_url":"https://api.github.com/users/matrix-org/received_events","type":"Organization","site_admin":false},"repo":{"id":24998719,"node_id":"MDEwOlJlcG9zaXRvcnkyNDk5ODcxOQ==","name":"matrix-doc","full_name":"matrix-org/matrix-doc","private":false,"owner":{"login":"matrix-org","id":8418310,"node_id":"MDEyOk9yZ2FuaXphdGlvbjg0MTgzMTA=","avatar_url":"https://avatars2.githubusercontent.com/u/8418310?v=4","gravatar_id":"","url":"https://api.github.com/users/matrix-org","html_url":"https://github.com/matrix-org","followers_url":"https://api.github.com/users/matrix-org/followers","following_url":"https://api.github.com/users/matrix-org/following{/other_user}","gists_url":"https://api.github.com/users/matrix-org/gists{/gist_id}","starred_url":"https://api.github.com/users/matrix-org/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matrix-org/subscriptions","organizations_url":"https://api.github.com/users/matrix-org/orgs","repos_url":"https://api.github.com/users/matrix-org/repos","events_url":"https://api.github.com/users/matrix-org/events{/privacy}","received_events_url":"https://api.github.com/users/matrix-org/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/matrix-org/matrix-doc","description":"Matrix Documentation (including The Spec)","fork":false,"url":"https://api.github.com/repos/matrix-org/matrix-doc","forks_url":"https://api.github.com/repos/matrix-org/matrix-doc/forks","keys_url":"https://api.github.com/repos/matrix-org/matrix-doc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/matrix-org/matrix-doc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/matrix-org/matrix-doc/teams","hooks_url":"https://api.github.com/repos/matrix-org/matrix-doc/hooks","issue_events_url":"https://api.github.com/repos/matrix-org/matrix-doc/issues/events{/number}","events_url":"https://api.github.com/repos/matrix-org/matrix-doc/events","assignees_url":"https://api.github.com/repos/matrix-org/matrix-doc/assignees{/user}","branches_url":"https://api.github.com/repos/matrix-org/matrix-doc/branches{/branch}","tags_url":"https://api.github.com/repos/matrix-org/matrix-doc/tags","blobs_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/refs{/sha}","trees_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/matrix-org/matrix-doc/statuses/{sha}","languages_url":"https://api.github.com/repos/matrix-org/matrix-doc/languages","stargazers_url":"https://api.github.com/repos/matrix-org/matrix-doc/stargazers","contributors_url":"https://api.github.com/repos/matrix-org/matrix-doc/contributors","subscribers_url":"https://api.github.com/repos/matrix-org/matrix-doc/subscribers","subscription_url":"https://api.github.com/repos/matrix-org/matrix-doc/subscription","commits_url":"https://api.github.com/repos/matrix-org/matrix-doc/commits{/sha}","git_commits_url":"https://api.github.com/repos/matrix-org/matrix-doc/git/commits{/sha}","comments_url":"https://api.github.com/repos/matrix-org/matrix-doc/comments{/number}","issue_comment_url":"https://api.github.com/repos/matrix-org/matrix-doc/issues/comments{/number}","contents_url":"https://api.github.com/repos/matrix-org/matrix-doc/contents/{+path}","compare_url":"https://api.github.com/repos/matrix-org/matrix-doc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/matrix-org/matrix-doc/merges","archive_url":"https://api.github.com/repos/matrix-org/matrix-doc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/matrix-org/matrix-doc/downloads","issues_url":"https://api.github.com/repos/matrix-org/matrix-doc/issues{/number}","pulls_url":"https://api.github.com/repos/matrix-org/matrix-doc/pulls{/number}","milestones_url":"https://api.github.com/repos/matrix-org/matrix-doc/milestones{/number}","notifications_url":"https://api.github.com/repos/matrix-org/matrix-doc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/matrix-org/matrix-doc/labels{/name}","releases_url":"https://api.github.com/repos/matrix-org/matrix-doc/releases{/id}","deployments_url":"https://api.github.com/repos/matrix-org/matrix-doc/deployments","created_at":"2014-10-09T16:41:02Z","updated_at":"2018-11-08T11:57:23Z","pushed_at":"2018-11-12T14:02:59Z","git_url":"git://github.com/matrix-org/matrix-doc.git","ssh_url":"git@github.com:matrix-org/matrix-doc.git","clone_url":"https://github.com/matrix-org/matrix-doc.git","svn_url":"https://github.com/matrix-org/matrix-doc","homepage":null,"size":8535,"stargazers_count":171,"watchers_count":171,"language":"JavaScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":84,"mirror_url":null,"archived":false,"open_issues_count":517,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":84,"open_issues":517,"watchers":171,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/1714"},"html":{"href":"https://github.com/matrix-org/matrix-doc/pull/1714"},"issue":{"href":"https://api.github.com/repos/matrix-org/matrix-doc/issues/1714"},"comments":{"href":"https://api.github.com/repos/matrix-org/matrix-doc/issues/1714/comments"},"review_comments":{"href":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/1714/comments"},"review_comment":{"href":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/matrix-org/matrix-doc/pulls/1714/commits"},"statuses":{"href":"https://api.github.com/repos/matrix-org/matrix-doc/statuses/8fc23cd1df987d00929fabf006914d8ae474f109"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"richvdh"}}