release: commit the minisign public key #187

Merged

sirius merged 1 commit from release/signing-pubkey into main

2026-10-21 02:34:19 +00:00

sirius commented

2026-10-21 02:34:12 +00:00

Owner

The signing step had never run: no keypair existed, so there was no .pub in the tree and no MINISIGN_SECRET_KEY secret. scripts/sign-release.sh resolves .ci-tools/scripts/onionwire-signing.pub, so it exited on "no public key" before minisign was invoked. Release run 767 died there and its fail-closed cleanup deleted the tag it created - nothing was published.

This commits the public half of a fresh minisign -G -W pair (no passphrase: CI cannot answer a prompt). The secret half goes into the Forgejo Actions secret MINISIGN_SECRET_KEY and is not in this repository.

Public key: RWRWHhuty5VhgHpdAsbzMVNLmu1mztJblfxv06HjtVcrKHKS75792Jb+

The pair was checked before committing: sign a probe with the secret, verify against this file - Signature and comment signature verified.

The signing step had never run: no keypair existed, so there was no `.pub` in the tree and no `MINISIGN_SECRET_KEY` secret. `scripts/sign-release.sh` resolves `.ci-tools/scripts/onionwire-signing.pub`, so it exited on "no public key" before minisign was invoked. Release run 767 died there and its fail-closed cleanup deleted the tag it created - nothing was published. This commits the public half of a fresh `minisign -G -W` pair (no passphrase: CI cannot answer a prompt). The secret half goes into the Forgejo Actions secret `MINISIGN_SECRET_KEY` and is not in this repository. Public key: `RWRWHhuty5VhgHpdAsbzMVNLmu1mztJblfxv06HjtVcrKHKS75792Jb+` The pair was checked before committing: sign a probe with the secret, verify against this file - `Signature and comment signature verified`.

sirius added 1 commit

2026-10-21 02:34:12 +00:00

release: commit the minisign public key 37b08595a4

The signing step has never run: there was no keypair, so no .pub in the tree and
no MINISIGN_SECRET_KEY secret. scripts/sign-release.sh resolves its public key at
.ci-tools/scripts/onionwire-signing.pub, which is this path in the CI checkout,
so it exited on "no public key" before minisign was ever invoked. Release run 767
died here and its fail-closed cleanup deleted the tag it had created; nothing was
published.

Generated with `minisign -G -W` (no passphrase: CI cannot answer a prompt, and a
passphrase stored beside the key in the same secret store protects nothing). The
secret half lives only in the Forgejo Actions secret MINISIGN_SECRET_KEY; it is
not in this repository and never has been. Procedure: docs/VERIFY.md,
"Maintainer: the signing key".

Public key: RWRWHhuty5VhgHpdAsbzMVNLmu1mztJblfxv06HjtVcrKHKS75792Jb+

sirius merged commit 5d10cb3d00 into main

2026-10-21 02:34:19 +00:00

sirius referenced this pull request from a commit

2026-10-21 02:34:20 +00:00

Merge pull request 'release: commit the minisign public key' (#187) from release/signing-pubkey into main