From 575ea1a3715af898c5e46dcf4d9dd0d04808e142 Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Mon, 20 Jul 2026 22:57:38 +0200 Subject: [PATCH] chore(index): repin to the operator-held signing key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bootstrap key generated during implementation was lost with its scratch directory. Nothing shipped pinning it, so this is a straight replacement of slot 0 rather than a rotation — the second slot stays reserved for a real one. The private half now lives only in the INDEX_SIGNING_KEY secret, so CI is the only thing that can sign. This push is what makes it do so: the committed signature is still the old key's, and the verify self-check will fail loudly if the secret does not match the public key pinned here. Co-Authored-By: Claude Fable 5 --- .gitea/workflows/publish.yml | 2 +- README.md | 2 +- tools/keys.ts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml index 1bd68de..1370a51 100644 --- a/.gitea/workflows/publish.yml +++ b/.gitea/workflows/publish.yml @@ -70,7 +70,7 @@ jobs: # auditor would use. Catches a key/host mismatch BEFORE it ships, rather # than as every host in the field silently rejecting the catalog. - name: Verify signature - run: bun run verify -- --pub "${{ vars.INDEX_PUBLIC_KEY || 'ed25519:n/KgBQSSDZqvyGHa8PkHWHZtV1zRXLk0BdQUi4/BD/w=' }}" + run: bun run verify -- --pub "${{ vars.INDEX_PUBLIC_KEY || 'ed25519:qK18TE2qygIyObtMlHxUI/G1gKby8tPxuieAfnEKgYE=' }}" - name: Commit signature to main run: | diff --git a/README.md b/README.md index 6001f6c..203f551 100644 --- a/README.md +++ b/README.md @@ -230,7 +230,7 @@ PR cannot get anything signed. The public key currently pinned in the host: ``` -ed25519:n/KgBQSSDZqvyGHa8PkHWHZtV1zRXLk0BdQUi4/BD/w= +ed25519:qK18TE2qygIyObtMlHxUI/G1gKby8tPxuieAfnEKgYE= ``` `bun run verify` defaults to this key, so anyone can audit a published index diff --git a/tools/keys.ts b/tools/keys.ts index 5ec3898..3da43ee 100644 --- a/tools/keys.ts +++ b/tools/keys.ts @@ -22,7 +22,7 @@ export const PUBKEY_PREFIX = "ed25519:"; * `verify` defaults to this so a signed index can be checked with no arguments. */ export const DEFAULT_PUBLIC_KEY = - "ed25519:n/KgBQSSDZqvyGHa8PkHWHZtV1zRXLk0BdQUi4/BD/w="; + "ed25519:qK18TE2qygIyObtMlHxUI/G1gKby8tPxuieAfnEKgYE="; /** Encode a node KeyObject public key as the host's `ed25519:` form. */ export function encodePublicKey(key: KeyObject): string {