Breadway/bread-ecosystem
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity Actions

bakery: rotate signing key, fix broken index-signature verification
Some checks failed
Mirror to GitHub / mirror (push) Failing after 1s
Details
release bakery / build (push) Failing after 44s
Details
release bread-theme / build (push) Failing after 15s
Details
Build and publish package / package (push) Successful in 1m13s
Details

Browse source 
The old bakery-signing-key.minisign-sec on hestia was password-encrypted
and the password was lost, so scripts/gen-index.sh never actually signed
index.json (silent no-op warning). bakery/src/manifest.rs (0.3.0+) hard-
requires that signature, so every bakery command has been failing with
'fetching index.json.minisig — the index must be signed before it can be
trusted' since the signing enforcement shipped.

Generated a new no-password minisign keypair on hestia
(~/.secrets/bakery-signing-key-2.minisign-sec), updated the hardcoded
PUBKEY in manifest.rs and get.sh to match, wired
BAKERY_MINISIGN_SEC_KEY_PATH as a Forgejo Actions secret so future CI
releases sign automatically, and manually signed+published the current
index.json on hestia so bakery works immediately.
This commit is contained in:
Breadway 2026-07-21 19:07:49 +08:00
parent 8e82d2d833
commit 157ed6e378
4 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Cargo.lock generated
View file

@ -104,7 +104,7 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
[[package]]
name = "bakery"
version = "0.3.0"
version = "0.3.1"
dependencies = [
"anyhow",
"chrono",
@ -149,7 +149,7 @@ dependencies = [
[[package]]
name = "bread-onnx"
version = "0.3.0"
version = "0.3.1"
dependencies = [
"anyhow",
"bread-utils",
@ -175,7 +175,7 @@ dependencies = [
[[package]]
name = "bread-theme"
version = "0.3.0"
version = "0.3.1"
dependencies = [
"dirs",
"gtk4",
@ -185,7 +185,7 @@ dependencies = [
[[package]]
name = "bread-utils"
version = "0.3.0"
version = "0.3.1"
dependencies = [
"bread-shared",
"dirs",

2
Cargo.toml
View file

@ -3,7 +3,7 @@ members = ["bakery", "bread-theme", "bread-utils", "bread-onnx"]
resolver = "2"
[workspace.package]
version = "0.3.0"
version = "0.3.1"
edition = "2021"
license = "MIT"
authors = ["Breadway <plasticbread849@gmail.com>"]

2
bakery/src/manifest.rs
View file

@ -17,7 +17,7 @@ const CACHE_MAX_AGE: Duration = Duration::from_secs(24 * 3600);
/// bytes are trusted or parsed. This is the single control point: the
/// per-artifact `sha256` fields and `post_install` hook strings all live
/// inside `index.json` itself, so a valid signature transitively covers them.
const PUBKEY: &str = "RWRh2Zr5SUinvVFCtD7S7HwGjfrye6j31Xq2mYXRdkGFDWe3yHF7W11K";
const PUBKEY: &str = "RWTBR8w/IJ+jaylOv80b52DzekKbSR2CvOVGvzB0ipGBaMhJPAOiEWq8";
/// Verify `bytes` against `sig_text` (the contents of an `index.json.minisig`
/// file) using the pinned [`PUBKEY`]. Returns an error on any failure —

2
scripts/get.sh
View file

@ -9,7 +9,7 @@ set -eu
# index.json and the bakery binary itself). Do not source this from the
# network — it must be baked into this script so a compromised dl server
# can't swap it out along with a malicious binary.
BAKERY_MINISIGN_PUBKEY="RWRh2Zr5SUinvVFCtD7S7HwGjfrye6j31Xq2mYXRdkGFDWe3yHF7W11K"
BAKERY_MINISIGN_PUBKEY="RWTBR8w/IJ+jaylOv80b52DzekKbSR2CvOVGvzB0ipGBaMhJPAOiEWq8"
BAKERY_VERSION="${BAKERY_VERSION:-latest}"
BIN_DIR="${BAKERY_BIN_DIR:-$HOME/.local/bin}"