Remove stale bootstrap registry signing key #198

New issue

Closed

opened 2026-06-01 14:42:42 +00:00 by steve · 0 comments

steve commented

2026-06-01 14:42:42 +00:00

Owner

Remove the old bootstrap registry signing public key now that the active
registry key is lapis-registry-2026-06 and the bootstrap private key is not
owned by the current publishing setup.

Problem

The app still trusts lapis-registry-bootstrap-2026-05 for official registry
metadata even though current signing uses lapis-registry-2026-06 and the
bootstrap private key is not available. Keeping an unowned key in the trusted
set widens the registry signing trust boundary.

Goal

Only trust the current registry signing key for app-side registry metadata
verification and keep the spec aligned with that operational policy.

Scope

Remove lapis-registry-bootstrap-2026-05 from app embedded registry trust.
Update registry distribution documentation to describe the current registry
signing key and bootstrap-key removal expectation.
Coordinate with the external registry repo trust-root removal in the same
session when possible.

Non-goals

Do not rotate plugin release signing keys.
Do not republish official plugin release assets.
Do not change runtime plugin install behavior beyond registry metadata trust.

Acceptance Criteria

EMBEDDED_PLUGIN_REGISTRY_KEYS contains lapis-registry-2026-06 and no
lapis-registry-bootstrap-2026-05 entry.
Plugin registry spec no longer implies the bootstrap key remains trusted.
The registry repo generated trust root removes the bootstrap registry role key.
Relevant API and registry validation commands pass.

Implementation Notes

The already-published plugin assets remain valid because plugin release
manifests use the separate lapis-plugin-release-2026-06 key. This task only
changes trusted keys for registry metadata.

Suggested Files or Specs To Inspect

packages/api/src/lib/plugin-distribution/manager.ts
spec/src/30-cross-package-contracts/plugin-registry.md
/Users/stevejuma/code/lapis-plugin-registry/generated/v1/trust/root.json
/Users/stevejuma/code/lapis-plugin-registry/entries and registry signing
scripts if the trust root is generated from source metadata

Validation Commands

pnpm --filter @lapis-notes/api check:all
make spec-lint
mdbook build spec
Registry repo: pnpm registry:generate
Registry repo: pnpm registry:sign
Registry repo: pnpm registry:verify-signatures
Registry repo: pnpm check

Follow-up to #197 — Render mutable registry README details

Follow-up Tasks

Implementation Summary

Removed the stale lapis-registry-bootstrap-2026-05 public key from app embedded registry trust, documented the current lapis-registry-2026-06-only trust policy, and coordinated the registry trust-root removal.

Remove the old bootstrap registry signing public key now that the active registry key is `lapis-registry-2026-06` and the bootstrap private key is not owned by the current publishing setup. ## Problem The app still trusts `lapis-registry-bootstrap-2026-05` for official registry metadata even though current signing uses `lapis-registry-2026-06` and the bootstrap private key is not available. Keeping an unowned key in the trusted set widens the registry signing trust boundary. ## Goal Only trust the current registry signing key for app-side registry metadata verification and keep the spec aligned with that operational policy. ## Scope - Remove `lapis-registry-bootstrap-2026-05` from app embedded registry trust. - Update registry distribution documentation to describe the current registry signing key and bootstrap-key removal expectation. - Coordinate with the external registry repo trust-root removal in the same session when possible. ## Non-goals - Do not rotate plugin release signing keys. - Do not republish official plugin release assets. - Do not change runtime plugin install behavior beyond registry metadata trust. ## Acceptance Criteria - `EMBEDDED_PLUGIN_REGISTRY_KEYS` contains `lapis-registry-2026-06` and no `lapis-registry-bootstrap-2026-05` entry. - Plugin registry spec no longer implies the bootstrap key remains trusted. - The registry repo generated trust root removes the bootstrap registry role key. - Relevant API and registry validation commands pass. ## Implementation Notes The already-published plugin assets remain valid because plugin release manifests use the separate `lapis-plugin-release-2026-06` key. This task only changes trusted keys for registry metadata. ## Suggested Files or Specs To Inspect - `packages/api/src/lib/plugin-distribution/manager.ts` - `spec/src/30-cross-package-contracts/plugin-registry.md` - `/Users/stevejuma/code/lapis-plugin-registry/generated/v1/trust/root.json` - `/Users/stevejuma/code/lapis-plugin-registry/entries` and registry signing scripts if the trust root is generated from source metadata ## Validation Commands - `pnpm --filter @lapis-notes/api check:all` - `make spec-lint` - `mdbook build spec` - Registry repo: `pnpm registry:generate` - Registry repo: `pnpm registry:sign` - Registry repo: `pnpm registry:verify-signatures` - Registry repo: `pnpm check` ## Related Issues - Follow-up to #197 — [Render mutable registry README details](../closed/197-render-mutable-registry-readme-details.md) ## Follow-up Tasks ## Implementation Summary Removed the stale lapis-registry-bootstrap-2026-05 public key from app embedded registry trust, documented the current lapis-registry-2026-06-only trust policy, and coordinated the registry trust-root removal.

steve added this to the Full Registry V1 milestone

2026-06-01 14:42:42 +00:00

steve

2026-06-01 14:42:42 +00:00