From 157ed6e3782ac2facd8b517d7c247713f36854ed Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Tue, 21 Jul 2026 19:07:49 +0800
Subject: [PATCH] bakery: rotate signing key, fix broken index-signature
 verification
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The old bakery-signing-key.minisign-sec on hestia was password-encrypted
and the password was lost, so scripts/gen-index.sh never actually signed
index.json (silent no-op warning). bakery/src/manifest.rs (0.3.0+) hard-
requires that signature, so every bakery command has been failing with
'fetching index.json.minisig — the index must be signed before it can be
trusted' since the signing enforcement shipped.

Generated a new no-password minisign keypair on hestia
(~/.secrets/bakery-signing-key-2.minisign-sec), updated the hardcoded
PUBKEY in manifest.rs and get.sh to match, wired
BAKERY_MINISIGN_SEC_KEY_PATH as a Forgejo Actions secret so future CI
releases sign automatically, and manually signed+published the current
index.json on hestia so bakery works immediately.
---
 Cargo.lock             | 8 ++++----
 Cargo.toml             | 2 +-
 bakery/src/manifest.rs | 2 +-
 scripts/get.sh         | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 92d225b..51ffd62 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -104,7 +104,7 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "bakery"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "chrono",
@@ -149,7 +149,7 @@ dependencies = [
 
 [[package]]
 name = "bread-onnx"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "bread-utils",
@@ -175,7 +175,7 @@ dependencies = [
 
 [[package]]
 name = "bread-theme"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "dirs",
  "gtk4",
@@ -185,7 +185,7 @@ dependencies = [
 
 [[package]]
 name = "bread-utils"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "bread-shared",
  "dirs",
diff --git a/Cargo.toml b/Cargo.toml
index 6675555..23f96e4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ members = ["bakery", "bread-theme", "bread-utils", "bread-onnx"]
 resolver = "2"
 
 [workspace.package]
-version = "0.3.0"
+version = "0.3.1"
 edition = "2021"
 license = "MIT"
 authors = ["Breadway <plasticbread849@gmail.com>"]
diff --git a/bakery/src/manifest.rs b/bakery/src/manifest.rs
index 2a8e7ac..35a9bbc 100644
--- a/bakery/src/manifest.rs
+++ b/bakery/src/manifest.rs
@@ -17,7 +17,7 @@ const CACHE_MAX_AGE: Duration = Duration::from_secs(24 * 3600);
 /// bytes are trusted or parsed. This is the single control point: the
 /// per-artifact `sha256` fields and `post_install` hook strings all live
 /// inside `index.json` itself, so a valid signature transitively covers them.
-const PUBKEY: &str = "RWRh2Zr5SUinvVFCtD7S7HwGjfrye6j31Xq2mYXRdkGFDWe3yHF7W11K";
+const PUBKEY: &str = "RWTBR8w/IJ+jaylOv80b52DzekKbSR2CvOVGvzB0ipGBaMhJPAOiEWq8";
 
 /// Verify `bytes` against `sig_text` (the contents of an `index.json.minisig`
 /// file) using the pinned [`PUBKEY`]. Returns an error on any failure —
diff --git a/scripts/get.sh b/scripts/get.sh
index a2df2eb..6a1707e 100755
--- a/scripts/get.sh
+++ b/scripts/get.sh
@@ -9,7 +9,7 @@ set -eu
 # index.json and the bakery binary itself). Do not source this from the
 # network — it must be baked into this script so a compromised dl server
 # can't swap it out along with a malicious binary.
-BAKERY_MINISIGN_PUBKEY="RWRh2Zr5SUinvVFCtD7S7HwGjfrye6j31Xq2mYXRdkGFDWe3yHF7W11K"
+BAKERY_MINISIGN_PUBKEY="RWTBR8w/IJ+jaylOv80b52DzekKbSR2CvOVGvzB0ipGBaMhJPAOiEWq8"
 
 BAKERY_VERSION="${BAKERY_VERSION:-latest}"
 BIN_DIR="${BAKERY_BIN_DIR:-$HOME/.local/bin}"