OpenWrt 23.05.5 was signed with the wrong signing keys

[closewrter]

There were few topics before:

23.05.0 stable release builds signed with wrong PGP key?

I'm getting "The page you are looking for is temporarily unavailable" on the main site at the moment, but unless I'm totally mistaken, the stable builds of 23.05.0 are signed with the "PGP key for unattended snapshot builds". Furthermore, the page doesn't list any signing key for the 23.05 series, and was last modified in April. From past threads it seems like this isn't the first time that the page is lacking up-to-date keys. Given the security implications, shouldn't the pubkeys always be ava…

Is there supposed to be a 23.05 release key?

Similar to the situation I posted about in Has the signing policy on release builds changed so that releases are signed by the build tool? a few years ago, it seems that 23.05 builds are signed with the snapshot key. Is this intended, or was there supposed to be a 23.05 key?

Every 23.05 release contains the same note and promises that later release will have different key.

Could someone explain why the latest 23.05.5 has been signed with the wrong key?

[lleachii]

@closewrter

that later release will have different key.

That didn't mean version 24?

[closewrter]

@lleachii

That didn't mean version 24?

Release notes:

A later OpenWrt 23.05 service release will use a different key.

[closewrter]

So, does anybody know whether or not we are going to have any 23.05 release with the correct keys? And why the wrong keys have been used for a long period?

[XA-Hydra]

This seems very much a question worth asking. Anybody able to answer this?

[lantis1008]

I asked the same thing on .3

OpenWrt 23.05.3 - Service Release

No one working on this as far as I know.

No one is fixing the release workflow so it will continue to be wrong.

[hecatae]

Here's the answer:

GnuPG signing key for v23.05.x missing

And documentation:
https://openwrt.org/docs/guide-developer/releases/provision-nitrokey3

@ynezz do you want any assistance with the artifact signing REST API service?

[closewrter]

Thanks for pointing. At least I understand now what is the root of issue.

@ynezz, how can I help you to have correct keys used for the latest OpenWRT release?

[closewrter]

Just for information.

ynezz on Nov 9, 2024

We've just finished switching all buildmasters to the new key, so from now on, everything should be signed with the Universal GPG signing key from Nitrokey 3A key.