From 43e464525f7b03a558643b10ce2f6e9830d5a52f Mon Sep 17 00:00:00 2001 From: Douglas Teles Date: Tue, 23 Jun 2026 17:35:06 -0300 Subject: [PATCH] archr-keyring: ship the production ArchR master public key Master generated 2026-06-23 offline (ed25519 cert-only with ed25519 sign subkey expiring 2028-06-23). Private master lives on encrypted cold storage; the signer subkey is on the build workstation only. Revocation certificate kept offline in two physical locations. Fingerprint: 0CB282379EBB394EF380AEB98A762D5706C602A1 archr.gpg is the binary public keyring that pacman-key --populate archr walks; archr-trusted gives the master full ownertrust (level 4) so packages signed by its subkey are accepted; archr-revoked stays empty until a key is actually revoked. archr-keyring/package.mk already auto-detects these files (instead of the empty placeholders it shipped before) and includes them in the image. With the keyring populated, the next gen-pacman-repo run with SIGNER set will produce a properly signed archr.db and per-package .sig files that ArchR clients can verify. Co-Authored-By: Claude Opus 4.7 --- .../security/archr-keyring/keys/archr-revoked | 0 .../security/archr-keyring/keys/archr-trusted | 1 + .../security/archr-keyring/keys/archr.gpg | Bin 0 -> 524 bytes 3 files changed, 1 insertion(+) create mode 100644 projects/ArchR/packages/security/archr-keyring/keys/archr-revoked create mode 100644 projects/ArchR/packages/security/archr-keyring/keys/archr-trusted create mode 100644 projects/ArchR/packages/security/archr-keyring/keys/archr.gpg diff --git a/projects/ArchR/packages/security/archr-keyring/keys/archr-revoked b/projects/ArchR/packages/security/archr-keyring/keys/archr-revoked new file mode 100644 index 0000000000..e69de29bb2 diff --git a/projects/ArchR/packages/security/archr-keyring/keys/archr-trusted b/projects/ArchR/packages/security/archr-keyring/keys/archr-trusted new file mode 100644 index 0000000000..622a1d76cc --- /dev/null +++ b/projects/ArchR/packages/security/archr-keyring/keys/archr-trusted @@ -0,0 +1 @@ +0CB282379EBB394EF380AEB98A762D5706C602A1:4: diff --git a/projects/ArchR/packages/security/archr-keyring/keys/archr.gpg b/projects/ArchR/packages/security/archr-keyring/keys/archr.gpg new file mode 100644 index 0000000000000000000000000000000000000000..214fdac13753de5eef454df32a6f1f855fd7e1fb GIT binary patch literal 524 zcmbPX%#vmG%36$5n~jl$@s>M3BO|-RiN7`GZf{?yYKXsX|M{bHs;ahA>|f0Z=@;}m zxiT*FJ=h}aSd^R*q~M!aT#{O(V3VC%S?rKll$@bkq?eg**D--bSd5FoLQIi`XH%2; zyxo?5pBvWg>?+d@XFJBUkd+B!Ba<{ED>o+xI}@8I7bgcd6N?xVGb586Ba?Uo0~e4a^8~gE(Ba7qjoG1R?Pnbnc-Pmi=@MiDU z_{UQ>2t75K@6hp{MM8{=L4klbm>3!n&Mi}5krd-%kQGy8xn7?tEYTzOv_tHU3UAg? z{rmkwK@hKl{09@cwvUnF=Cwz&D^Je1X4TyOsem=*gVh_M&!%PU-<&cI|2Qo9uZQ6` z+e|A($)`8|TgJD{J7{vSWpmmSw{6j%4j4}h;c2=j$tGmO$Z#*fG4#7sIFry9H_zw% z2W<8`X&QPo@V_>T6q>Xu)y<2MVQzL`@9qZ``boOK?o7Q}_DO`Daaz_EyTV?b(&dYV Hzp(=Vw;9SX literal 0 HcmV?d00001