pki: the StarshipOS CA, made on the CI box; capsules signed in CI

Ruled by Captain Bob, 2026-11-07: "New root CA on the CI box. Valid
StarshipOS rather than snake oil intermediate."

- ci/pki/make-ca.sh makes the StarshipOS Root CA (its key stays on the CI
  box) and the StarshipOS Capsule Signing intermediate it issues, and
  stores the signing key as the secret CAPSULE_SIGN_KEY.
- The kernel finds the signing certificate by one name,
  CAPSULE_SIGNING_CERT_NAME = pki:starshipos-intermediate.der. The
  certificate itself lands once make-ca.sh has run; until then the
  snakeoil intermediate is in the tree under its old name and the
  capsules check as "no root key" (a warning, as "missing" was).
- mkcapsule refuses a signing key that is not that certificate's.
- SIGN_KEY has no default; acceptance, build, nightly and release set it
  from the secret.

FABRIC-3.md XLVI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

.gitea/workflows/acceptance.yml

@@ -37,6 +37,18 @@ jobs:
           fetch-depth: 0          # the SBOM's version is git describe
           lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither
 
+      - name: The capsule-signing key
+        env:
+          KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
+        run: |                    # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
+          if [ -n "$KEY" ]; then
+            f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
+            (umask 077; printf '%s\n' "$KEY" > "$f")
+            echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
+          else
+            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
+          fi
+
       - name: Acceptance amd64
         run: scripts/nightly.sh accept amd64
       - name: Acceptance aarch64

.gitea/workflows/build.yml

@@ -34,6 +34,18 @@ jobs:
           fetch-depth: 0          # the SBOM's version is git describe
           lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither
 
+      - name: The capsule-signing key
+        env:
+          KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
+        run: |                    # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
+          if [ -n "$KEY" ]; then
+            f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
+            (umask 077; printf '%s\n' "$KEY" > "$f")
+            echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
+          else
+            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
+          fi
+
       - name: Boot image
         run: make boot_image TARGET=${{ matrix.board }}
 
@@ -62,5 +74,17 @@ jobs:
         with:
           lfs: false
 
+      - name: The capsule-signing key
+        env:
+          KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
+        run: |                    # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
+          if [ -n "$KEY" ]; then
+            f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
+            (umask 077; printf '%s\n' "$KEY" > "$f")
+            echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
+          else
+            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
+          fi
+
       - name: make -C v4 test
         run: make -C v4 test

.gitea/workflows/nightly.yml

@@ -39,6 +39,18 @@ jobs:
           fetch-depth: 0          # the SBOM's version is git describe
           lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither
 
+      - name: The capsule-signing key
+        env:
+          KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
+        run: |                    # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
+          if [ -n "$KEY" ]; then
+            f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
+            (umask 077; printf '%s\n' "$KEY" > "$f")
+            echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
+          else
+            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
+          fi
+
       - name: Acceptance amd64
         run: scripts/nightly.sh accept amd64
       - name: Acceptance aarch64

.gitea/workflows/release.yml

@@ -33,6 +33,18 @@ jobs:
           fetch-depth: 0
           lfs: false
 
+      - name: The capsule-signing key
+        env:
+          KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
+        run: |                    # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
+          if [ -n "$KEY" ]; then
+            f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
+            (umask 077; printf '%s\n' "$KEY" > "$f")
+            echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
+          else
+            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
+          fi
+
       - name: The tag names the tree's version
         run: |
           tree="v$(sed -n 's/^LITHOS_VERSION *?= *//p' kernel/Makefile)"