From a293eab1d4e934e8ffcef8a650f06bd99d3d7dc1 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 8 Nov 2026 02:36:45 +0000 Subject: [PATCH] pki: the StarshipOS Root CA's certificate, public, in the tree (#126) [skip ci] ci/pki/starshipos-root-ca.pem, made on the CI box by make-ca.sh (2026-11-07, Ed25519, to 2046-11-07; Captain Bob), and its SHA-256 DA:A7:40:56:65:41:1A:FE:E6:08:85:3F:6E:AD:83:3A:38:30:83:E6:F0:6D:69:A6:A8:9E:92:BD:85:93:39:81 in starshipos-root-ca.sha256. Verified: self-signed, CA:TRUE, and it issued capsules/pki/starshipos-intermediate.der (openssl verify: OK). Every release attaches it (gitea-release), and the Downloads page shows its fingerprint; it is also the anchor #139 would build into the kernel. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2 --- ci/pki/make-ca.sh | 5 ++++- ci/pki/starshipos-root-ca.pem | 10 ++++++++++ ci/pki/starshipos-root-ca.sha256 | 1 + 3 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 ci/pki/starshipos-root-ca.pem create mode 100644 ci/pki/starshipos-root-ca.sha256 diff --git a/ci/pki/make-ca.sh b/ci/pki/make-ca.sh index a1331597..d4e38937 100755 --- a/ci/pki/make-ca.sh +++ b/ci/pki/make-ca.sh @@ -3,7 +3,10 @@ # 2026-11-07: "New root CA on the CI box. Valid StarshipOS rather than snake oil intermediate"). # # StarshipOS Root CA Ed25519, 20 years, self-signed. Its key never leaves this box: -# not in the repository, not in Gitea, not in any image. +# not in the repository, not in Gitea, not in any image. Its +# certificate (public) is ci/pki/starshipos-root-ca.pem, made on +# 2026-11-07, SHA-256 in starshipos-root-ca.sha256; every release +# attaches it. # StarshipOS Capsule Signing Ed25519, 10 years, signed by the root; CA:TRUE, pathlen:0. # Its certificate is built into every image (capsules/pki/ # starshipos-intermediate.der) and checks each capsule at boot; diff --git a/ci/pki/starshipos-root-ca.pem b/ci/pki/starshipos-root-ca.pem new file mode 100644 index 00000000..78baf6c8 --- /dev/null +++ b/ci/pki/starshipos-root-ca.pem @@ -0,0 +1,10 @@ +-----BEGIN CERTIFICATE----- +MIIBaDCCARqgAwIBAgIUCwt1JkPxCfwr9PTCOadol/m9PCQwBQYDK2VwMDIxEzAR +BgNVBAoMClN0YXJzaGlwT1MxGzAZBgNVBAMMElN0YXJzaGlwT1MgUm9vdCBDQTAe +Fw0yNjExMDcxNjUwNTZaFw00NjExMDcxNjUwNTZaMDIxEzARBgNVBAoMClN0YXJz +aGlwT1MxGzAZBgNVBAMMElN0YXJzaGlwT1MgUm9vdCBDQTAqMAUGAytlcAMhANcn +fPpowbNgzMPtDEA7EYJoSkBLPljM6dEBFONfrhHso0IwQDAPBgNVHRMBAf8EBTAD +AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU5eU4Iy/Al5g9KZI5+u4jKllG +shswBQYDK2VwA0EAjRK1ybZE/VaH31dt3sc8DgqJVTPB6CYovdqWKcJMXC8UKfYJ +co9o8MhiIauvSCgZZA2+5VMv4zlke7Lu5TNLDg== +-----END CERTIFICATE----- diff --git a/ci/pki/starshipos-root-ca.sha256 b/ci/pki/starshipos-root-ca.sha256 new file mode 100644 index 00000000..2e72f39f --- /dev/null +++ b/ci/pki/starshipos-root-ca.sha256 @@ -0,0 +1 @@ +DA:A7:40:56:65:41:1A:FE:E6:08:85:3F:6E:AD:83:3A:38:30:83:E6:F0:6D:69:A6:A8:9E:92:BD:85:93:39:81