Release signing key rotation (2026-10-27)

Audience: operators who downloaded or mirror a Stella Ops release bundle.

What changed

• On 2026-10-27 the Cosign release-signing key was rotated as a precaution after a security incident on the project’s Git server (Gitea CVE-2026-59774). The rotation notice is the public record.

• The new key is ECDSA P-256, served at https://stella-ops.org/keys/cosign.pub. Its key ID, the SHA-256 of that PEM file, is 6877ef5b7368aa855cff4343fb665b5b16c08ed053bf8c6050a1dd3193d32f0d.

• Retired on 2026-10-27; do not trust a signature made with either key after that date:

  • 7a2360cb704d54056515dc95e0b398973e6009cb64584967229402c97fda3f64, the v1.0.0-RC1 release key;
  • 505ef48c6e1585f6288b8adcee99519efaffd3b2c8b99786d47267eea0a2e61d, the v1.0.0 release key.

• The published v1.0.0, v1.0.0-RC1 and latest bundles were re-signed with the new key. In each, only three files changed: release-manifest.yaml (its signature.keyId), release-manifest.yaml.sig and release-signing.pub. Every image digest and every other file in the bundle is unchanged. Because the archive contains those three files, the archive checksums changed:

  Bundle	SHA-256 now	Bytes now	SHA-256 before 2026-10-27	Bytes before
  v1.0.0	2b0a30463764aa855d7be3d1fc8e8332280792bd1a8eebe633077ea2310f7e94	1,114,809	9b23398bd5468053ad7b296be264803a787eb0150f843cfd97b927ab187db00f	1,122,525
  v1.0.0-RC1 and latest	4e6b0a2f59f03ef94cc001870823adf4ce9491ff18466690401f08de35b9b5bd	537,686	e04dc3242a97d95266fee98c5b2f8d0ad8113f88e9be1ddd4b2a8a005a4864ec	541,149

• Image digests did not change, so a digest-pinned installation keeps running the same images. The 31 images pinned by the v1.0.0 bundle carry a signature from the new key. The v1.0.0-RC1 image tags were withdrawn on 2026-09-24; the new key does not vouch for those images, and their earlier signatures remain as history.

Verify a re-signed bundle offline

Download the bundle archive and the SHA256SUMS file of the release from get.stella-ops.org, and obtain the release public key over a separate channel: the website key at /keys/cosign.pub above, saved outside the bundle as public-release-signing.pub. Then, with no further network access:

sha256sum --check --ignore-missing SHA256SUMS
tar -xzpf stellaops-bundle-v1.0.0.tar.gz
cd stellaops-bundle-v1.0.0
cmp ../public-release-signing.pub release-signing.pub
sha256sum release-signing.pub   # 6877ef5b7368aa855cff4343fb665b5b16c08ed053bf8c6050a1dd3193d32f0d
cosign verify-blob --insecure-ignore-tlog=true --key ../public-release-signing.pub \
  --signature release-manifest.yaml.sig release-manifest.yaml
python tools/verify-bundle.py --require-signature --require-digests

Use stellaops-bundle-v1.0.0-RC1 for the RC1 bundle. cmp must print nothing and cosign verify-blob must print Verified OK. The bundle verifier then checks every file against the signed manifest and reports every image digest as pinned. The release uses a pinned offline key without a transparency-log entry; --insecure-ignore-tlog=true skips only that online lookup, not the signature check.

To check an image signature, which needs read access to the registry or a mirror of it, use an exact digest from docker-compose.pinned.yml:

cosign verify --insecure-ignore-tlog=true --key ../public-release-signing.pub \
  registry.stella-ops.org/stellaops/<repository>@sha256:<digest>

A bundle whose release-signing.pub has one of the retired key IDs, or whose manifest signature verifies only with a retired key, predates the rotation. Download the current archive and compare it with the table above.

Related

• Security hardening guide
• Release bundle procedure