Ship the rotated public key as 0.1.1 #3

Merged

marcos-mendez merged 1 commit from keys/rotated-subkey into main

2026-09-27 03:14:52 -03:00

marcos-mendez commented

2026-09-26 22:39:14 -03:00

(Migrated from github.com)

Signing subkey 694DE5E8 was revoked on 2026-09-27 with the offline primary, reason compromised: its secret went through a chat channel on 2026-09-24 and never signed anything. The new signing subkey is 03041024F4B2C0C2F42DDDEA04906EAB77513310, Ed25519, expiring 2028-09-26.

This package ships the project's public key, so the revocation and the new subkey have to reach it. Otherwise a machine that installs the keyring trusts a key that cannot verify the archive it is about to read.

The primary AD0964BE3F09DED469A3B6B2148E951314703180 never left offline custody, so the fingerprint this package asserts is unchanged and a machine that already trusts the key keeps trusting it.

Test plan

The build asserts the primary fingerprint, which has not changed, so the package still builds.
The archive on the build host is now signed with the new subkey and verifies against this exact file, with both gpg (VALIDSIG 03041024...) and sqv.
Bats suite unchanged and green.

Signing subkey `694DE5E8` was revoked on 2026-09-27 with the offline primary, reason compromised: its secret went through a chat channel on 2026-09-24 and never signed anything. The new signing subkey is `03041024F4B2C0C2F42DDDEA04906EAB77513310`, Ed25519, expiring 2028-09-26. This package ships the project's public key, so the revocation and the new subkey have to reach it. Otherwise a machine that installs the keyring trusts a key that cannot verify the archive it is about to read. The primary `AD0964BE3F09DED469A3B6B2148E951314703180` never left offline custody, so the fingerprint this package asserts is unchanged and a machine that already trusts the key keeps trusting it. ## Test plan - The build asserts the primary fingerprint, which has not changed, so the package still builds. - The archive on the build host is now signed with the new subkey and verifies against this exact file, with both gpg (`VALIDSIG 03041024...`) and sqv. - Bats suite unchanged and green.