Breadway/bread-ecosystem
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

bakery: rotate signing key, fix broken index-signature verification
Some checks failed
Mirror to GitHub / mirror (push) Failing after 1s
Details
release bakery / build (push) Failing after 44s
Details
release bread-theme / build (push) Failing after 15s
Details
Build and publish package / package (push) Successful in 1m13s
Details

Browse source 
The old bakery-signing-key.minisign-sec on hestia was password-encrypted
and the password was lost, so scripts/gen-index.sh never actually signed
index.json (silent no-op warning). bakery/src/manifest.rs (0.3.0+) hard-
requires that signature, so every bakery command has been failing with
'fetching index.json.minisig — the index must be signed before it can be
trusted' since the signing enforcement shipped.

Generated a new no-password minisign keypair on hestia
(~/.secrets/bakery-signing-key-2.minisign-sec), updated the hardcoded
PUBKEY in manifest.rs and get.sh to match, wired
BAKERY_MINISIGN_SEC_KEY_PATH as a Forgejo Actions secret so future CI
releases sign automatically, and manually signed+published the current
index.json on hestia so bakery works immediately.
This commit is contained in:
Breadway 2026-07-21 19:07:49 +08:00
parent 8e82d2d833
commit 157ed6e378
4 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Cargo.toml
View file

@ -3,7 +3,7 @@ members = ["bakery", "bread-theme", "bread-utils", "bread-onnx"]
resolver = "2"
[workspace.package]
version = "0.3.0"
version = "0.3.1"
edition = "2021"
license = "MIT"
authors = ["Breadway <plasticbread849@gmail.com>"]