Stella Ops signing key rotation - 2026-10-27
============================================

The release / image signing key (cosign) was rotated on 2026-10-27 as a
precaution after a security incident on the project's Git server
(Gitea CVE-2026-59774).

NEW cosign public key (ECDSA P-256)
  https://stella-ops.org/keys/cosign.pub
  sha256 of the PEM file: 6877ef5b7368aa855cff4343fb665b5b16c08ed053bf8c6050a1dd3193d32f0d

RETIRED cosign keys - do not trust signatures made with these after 2026-10-27
  sha256 7a2360cb704d54056515dc95e0b398973e6009cb64584967229402c97fda3f64  (v1.0.0-RC1 release key)
  sha256 505ef48c6e1585f6288b8adcee99519efaffd3b2c8b99786d47267eea0a2e61d  (v1.0.0 release key)
  The 2025 key whose private half was published in 2025 was already revoked on 2026-07-27.

Re-signed releases (https://get.stella-ops.org/releases/)
  v1.0.0, v1.0.0-RC1 and latest now carry a release-manifest.yaml.sig made with
  the new key. Only the manifest's signature keyId, release-signing.pub and
  the signature changed; every image digest and every other shipped file is
  byte-identical. Because the bundle archive embeds those three files, the
  archive checksums changed:
    stellaops-bundle-v1.0.0.tar.gz      see releases/v1.0.0/SHA256SUMS
    stellaops-bundle-v1.0.0-RC1.tar.gz  see releases/v1.0.0-RC1/SHA256SUMS

PGP key - unchanged
  The security contact key (fingerprint 4976 7614 4BBA 5DDB E2EA B5B8 5C1E CABB C9F3 1EA6)
  was not exposed and remains valid.

Questions: security@stella-ops.org