# Release keys: who may sign a dx release.
#
# One key per line, in ssh-keygen's allowed-signers format:
#   dx-release namespaces="dx-release" ssh-ed25519 AAAA...
#
# A release is signed with `ssh-keygen -Y sign -n dx-release` (see
# scripts/sign-release.sh). An installed dx keeps this file beside itself and
# accepts an update only when its SHA256SUMS carries a good signature from one
# of these keys, so a site that is taken over can't swap the keys either: a new
# key set reaches users only in a release that an existing key signed.
#
# Two keys: the one that signs releases, and a backup generated and kept offline,
# so a lost or compromised signing key can be replaced by a release signed with
# the other. scripts/sign-release.sh refuses to build a release that isn't
# signed by a key listed here.

# Signs releases. Fingerprint SHA256:IX40JatXel3e+fATn+0ThRK74SWoBJlivGYQgVBVenw
dx-release namespaces="dx-release" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOxHo6ht+0Zge/5AADXIRRWIb6OBmv9+qQhoqPz2sCdo

# Backup, generated and kept offline. Fingerprint SHA256:W7T7y6D4xVnmY3bAQgOi1JcE8ieUvwBUDVSfXcMffHk
dx-release namespaces="dx-release" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGezj7d/ZjoeurMIcsYR6bWXd1fyDyucwDpMbbeUZjGQ
