Repository navigation
chore: recut org signing anchors to current keys - #15
Merged
Merged
Conversation
Replace the minisign trust anchor and installer GPG fingerprint pins across the anchor SSOT, installer, bootstrap engine, Go embed, docs, and test fixtures. Generated by Muse Spark running Muse Code under supervision of [@3leapsdave](https://github.com/3leapsdave) Co-Authored-By: Muse Spark <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave@3leaps.net> [@3leapsdave]
minisign -G writes the key id byte-reversed in the untrusted comment (per the -W fixture); match that convention for the new key. Generated by Muse Spark running Muse Code under supervision of [@3leapsdave](https://github.com/3leapsdave) Co-Authored-By: Muse Spark <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave@3leaps.net> [@3leapsdave]
Tags at or below v0.4.11 verify against the previous org keys; newer tags verify against the current keys. One key per tag, no fallback. Covers the bootstrap engine and installer (minisign and GPG fallback), with regression tests for selection both ways and a sunset assert on the cutoff constant. Verification: make precommit green; live v0.4.11/v0.4.10 bootstrap and installer dry-run pass via the legacy anchor. Generated by Muse Spark running Muse Code under supervision of [@3leapsdave](https://github.com/3leapsdave) Co-Authored-By: Muse Spark <noreply@3leaps.net> Role: devlead Committer-of-Record: Dave Thompson <dave@3leaps.net> [@3leapsdave]
3leapsdave
force-pushed
the
chore/org-signing-anchor-recut
branch
from
September 17, 2026 13:10
5f48792 to
65a80d1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rotates the minisign trust anchor and installer GPG fingerprint pins across the anchor file, installer, bootstrap engine, docs, and test fixtures.
Single-key cutover: artifacts from earlier tags continue to verify with the key embedded in those tags. The release-tag references in the README install snippets move to the release signed with this key when that release is cut.
Verification:
make precommitand anchor byte-equality checks pass.