SSHSIG release-signing transition — promote arc/23-24 (blocked: SSH_RELEASE_KEY + Operator-held keys) #26

New issue

Open

opened 2026-10-07 17:44:21 +00:00 by jsutter · 0 comments

jsutter commented

2026-10-07 17:44:21 +00:00

Owner

Already done (observed):

arc/23-24-installer-rescue (worktree repos/dit-releases-23-24): installer checks SSHSIG first, minisign second; a present-but-failing signature never falls back to the other verifier; trusted-key lines still hold placeholders (~380-391)
dit-client .forgejo/workflows/release.yml: SSHSIG signing step + release check exist; both no-op until the SSH_RELEASE_KEY secret is set
dit-client self_update.rs + dit-operator runbook.rs: already prefer .sshsig, refuse to fall through to minisign

Work needed (Operator-gated — key custody):

Operator creates the SSH release signing key, sets the SSH_RELEASE_KEY Forgejo secret on dit-client (dit-operator when its pipeline signs)
Replace placeholder trusted keys in install.sh, install.ps1, dit-client/src/signing.rs, dit-operator/src/signing.rs
Merge arc/23-24; add an SSHSIG section to docs/skills/release-signing.md
Cut a ditc release; reconverge tenants so start pages re-pin

Effect: fresh-machine installs verify with stock ssh-keygen (no minisign, no brew); dit-operator spec 013's agent-prompt minisign-bootstrap clause retires automatically (VerifiedVia-conditioned). Windows keeps the hash-pinned minisign fallback (OpenSSH client not guaranteed there).

Assisted-by: deepnet:synthetic/hf:zai-org/GLM-5.3-Flash

Every current release (ditc + dito) carries only SHA256SUMS.minisign, so install.sh on main hard-gates on minisign before any network access (dit-releases#216) — every fresh machine fails verify-failed until minisign is installed. The replacement verifier is written but dormant. **Already done** (observed): - arc/23-24-installer-rescue (worktree repos/dit-releases-23-24): installer checks SSHSIG first, minisign second; a present-but-failing signature never falls back to the other verifier; trusted-key lines still hold placeholders (~380-391) - dit-client .forgejo/workflows/release.yml: SSHSIG signing step + release check exist; both no-op until the SSH_RELEASE_KEY secret is set - dit-client self_update.rs + dit-operator runbook.rs: already prefer .sshsig, refuse to fall through to minisign **Work needed** (Operator-gated — key custody): 1. Operator creates the SSH release signing key, sets the SSH_RELEASE_KEY Forgejo secret on dit-client (dit-operator when its pipeline signs) 2. Replace placeholder trusted keys in install.sh, install.ps1, dit-client/src/signing.rs, dit-operator/src/signing.rs 3. Merge arc/23-24; add an SSHSIG section to docs/skills/release-signing.md 4. Cut a ditc release; reconverge tenants so start pages re-pin **Effect**: fresh-machine installs verify with stock ssh-keygen (no minisign, no brew); dit-operator spec 013's agent-prompt minisign-bootstrap clause retires automatically (VerifiedVia-conditioned). Windows keeps the hash-pinned minisign fallback (OpenSSH client not guaranteed there). Assisted-by: deepnet:synthetic/hf:zai-org/GLM-5.3-Flash

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

deepnet/dit-releases#26

No description provided.

Rows
Columns