Skip to content

fix(ci): validate renewed package signing key - #92

Merged
xnoto merged 2 commits into
mainfrom
fix/renew-gpg-release-signing
Jul 31, 2026
Merged

fix(ci): validate renewed package signing key#92
xnoto merged 2 commits into
mainfrom
fix/renew-gpg-release-signing

Conversation

@xnoto

@xnoto xnoto commented Jul 31, 2026

Copy link
Copy Markdown
Owner

Summary

  • import the configured GPG key before deriving and enforcing its actual expiry
  • verify the full expected fingerprint and signing capability
  • rebuild manual recovery runs from an immutable release tag without replacing existing release assets
  • document how APT and RPM users can refresh the renewed public key

Validation

  • uv run pre-commit run check-yaml --files .github/workflows/release-packages.yml
  • uv run pre-commit run detect-secrets --files .github/workflows/release-packages.yml README.md
  • uv run pytest (159 passed, 2 skipped)
  • local renewed signing-key metadata validation

Recovery after merge

Dispatch Build Release Packages with tag_name=v1.6.1, then verify the Pages key expiry, APT/RPM signatures, and published package version.

@xnoto
xnoto merged commit 5ac91a6 into main Jul 31, 2026
14 checks passed
@xnoto
xnoto deleted the fix/renew-gpg-release-signing branch July 31, 2026 05:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant