fix(install): sync release-signing pubkey to production [0] key (#34) #6

Merged

jsutter merged 1 commit from fix-34-sync-pubkey into main 2026-08-10 19:28:08 +00:00

Conversation 0 Commits 1 Files changed 1 +1 -1

jsutter commented 2026-08-10 19:27:12 +00:00

Owner

Copy link

install.sh still embedded the retired key (DITO_RELEASE_PUBKEYS[1]) after the 2026-08-08 signing-key rotation — its own line-148 comment said to track [0].

With the stale key, pre-rotation binaries (e.g. 1.4.0, built 08-06) fail-closed on dito self-update to v1.5.1 (issue #34), and a minisign-equipped fresh install rejected the production-signed release.

Swap to the production [0] key RWRsgZkHfdWJcuF8OjSvIDpe7aGiGtCSXHPbcvt8JIlK+oKZUupRFFHX. KEEP IN SYNC with dit-operator src/signing.rs DITO_RELEASE_PUBKEYS[0].

install.ps1 has no minisign path (SHA256-only) — no key to sync.

install.sh still embedded the retired key (DITO_RELEASE_PUBKEYS[1]) after the 2026-08-08 signing-key rotation — its own line-148 comment said to track [0]. With the stale key, pre-rotation binaries (e.g. 1.4.0, built 08-06) fail-closed on dito self-update to v1.5.1 (issue #34), and a minisign-equipped fresh install rejected the production-signed release. Swap to the production [0] key RWRsgZkHfdWJcuF8OjSvIDpe7aGiGtCSXHPbcvt8JIlK+oKZUupRFFHX. KEEP IN SYNC with dit-operator src/signing.rs DITO_RELEASE_PUBKEYS[0]. install.ps1 has no minisign path (SHA256-only) — no key to sync.

jsutter added 1 commit 2026-08-10 19:27:12 +00:00

fix(install): sync release-signing pubkey to production [0] key (#34) ... e32c45d5b5

install.sh still embedded the retired key (DITO_RELEASE_PUBKEYS[1]) after
the 2026-08-08 signing-key rotation — its own line-148 comment said to
track [0]. With the stale key, pre-rotation binaries (e.g. 1.4.0, built
08-06) fail-closed on `dito self-update` to v1.5.1 (issue #34), and a
minisign-equipped fresh install rejected the production-signed release
with "signature accepted by none of the configured key(s)".

Swap to the production [0] key
RWRsgZkHfdWJcuF8OjSvIDpe7aGiGtCSXHPbcvt8JIlK+oKZUupRFFHX.
KEEP IN SYNC with dit-operator src/signing.rs DITO_RELEASE_PUBKEYS[0].

install.ps1 has no minisign path (SHA256-only) — no key to sync.

jsutter merged commit 2b7026faee into main 2026-08-10 19:28:08 +00:00

jsutter referenced this pull request from a commit 2026-08-10 19:28:09 +00:00

Merge pull request 'fix(install): sync release-signing pubkey to production [0] key (#34)' (#6) from fix-34-sync-pubkey into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

deepnet/dit-releases!6

No description provided.