Repository navigation
chore(apt): re-key APT repo signing key (6326A34C retired → 3DDEADD3) - #15
Merged
Merged
Conversation
The old signing key (6326A34C, created 2026-09-04) is being retired and replaced with a new 4096-bit RSA key: fingerprint: 3DDEADD34827571266C41601C3BB61613B110128 UID: TelcoSec Package Signing Key <repo@telcochisel.com> Updated every client-side reference to the new fingerprint (TELCOSEC_FPR in 00-install-all-packages.sh, telcosec-pkg, install-apt-key.sh, install-telcochisel-repo.sh; OfficialRepoKeyFingerprint + test in the Go CLI). GPG UID email moved repo@telcosec.net -> repo@telcochisel.com to match the new meta.telcochisel.com domain (deploy-apt.yml export, conf/distributions SignWith, ci-setup-gpg.sh). Vendored ci-setup-gpg.sh synced to the fail-loud version (verifies EXPECTED_FPR, never generates a throwaway key). Go test passes; shell scripts parse. The matching private key must be set as the GPG_PRIVATE_KEY secret on TelcoChisel/telcosec-cli before deploying. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Retires the old APT signing key (6326A34C, created 2026-09-04) and adopts a new 4096-bit RSA key.
New key
3DDEADD34827571266C41601C3BB61613B110128TelcoSec Package Signing Key (TelcoChisel Official APT Repository) <repo@telcochisel.com>repo@telcosec.net→repo@telcochisel.comto match the new domain.This repo — every client-side reference updated:
TELCOSEC_FPRin 00-install-all-packages.sh, telcosec-pkg, install-apt-key.sh, install-telcochisel-repo.shOfficialRepoKeyFingerprint+ test in the Go CLI (test passes)The live telcosec-cli repo was re-keyed in parallel via API (operations.go, packages_test.go, conf/distributions, ci-setup-gpg.sh, deploy-apt.yml) — zero old-key refs remain in either repo.
Why a new key: the original 6326A34C private key was unavailable; CI had been silently generating throwaway keys. New key generated fresh; fail-loud guard now prevents any future accidental re-key.
The new PRIVATE key is saved locally at
.keys-DO-NOT-COMMIT/(gitignored). Set it + Cloudflare creds, then deploy:Then verify the served key is
3DDEADD3…. Store the private key securely and delete.keys-DO-NOT-COMMIT/.🤖 Generated with Claude Code