Re-export both keys through the new update_distro_signing_key scripts to strip non-signing subkeys (encryption, authentication) and expired subkeys that had accumulated in the in-tree copies. Only the primary key and currently-valid signing subkeys are retained. archlinux.key: 1168B -> 673B (495B saved, auth+encrypt subkeys removed) tails.key: 21282B -> 7376B (13906B saved, expired+non-signing subkeys removed) Qubes OS keys (4.2, 4.3, weekly builds) were already minimal -- no change. Fixes linuxboot#2066. This class of manual update has been needed repeatedly in the past and was caught late each time, causing distro ISO verification failures in the field for Tails and other supported distros: linuxboot#1808 (issue: Tails key expired, ISOs unbootable) linuxboot#1631 (PR: update tails.key, replay of manual steps) linuxboot#1809 (PR: replay of linuxboot#1631 for next Tails rotation) linuxboot#2000 (PR: Tails 7.0 key, same manual process again) linuxboot#1457 (PR: Arch Linux key update) linuxboot#2033 (PR: Qubes OS 4.3 key addition) TODO: wire bin/update_distro_signing_keys.sh into CI (e.g. a scheduled workflow) so upstream key rotations are detected automatically before they break users. Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Uh oh!

Tails ISO reported to not boot from Heads (Tails 6.1.8) #1808

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions