2026-11-07 17:46:02 +00:00
10 changed files with 29 additions and 0 deletions
@@ -6139,3 +6139,17 @@ tag names the kernel (`release.yml`: `v<LITHOS_VERSION>`), so:
 - Each v4 capsule logs `signature: no root key (cert not found/parseable)`: the kernel looks for the
  StarshipOS Capsule Signing certificate (XLVI), which is not in the tree until `ci/pki/make-ca.sh`
  has run. A warning, as "missing (unsigned)" was before; nothing is refused.
+
+### 3. The StarshipOS CA, and acceptance again (`4ca935d8`)
+
+`ci/pki/make-ca.sh` ran on the CI box (2026-11-07 16:50 UTC): the StarshipOS Root CA there, the
+signing key in the secret `CAPSULE_SIGN_KEY`, and the certificate -- O=StarshipOS, CN=StarshipOS
+Capsule Signing, issued by the root, 2026-11-07 to 2036-11-06, `CA:TRUE, pathlen:0`, SHA-256 of the
+DER `13a28dda...029b9a6c` -- in the tree as `capsules/pki/starshipos-intermediate.der`, the snakeoil
+intermediate out of it. The tree changed, so the protocol ran again here: amd64
+(`logs/20261107-165611`), aarch64 (`-165817`), riscv64 (`-170149`) -- POST 538/538,
+`dict_hash=0xfec8c47cfc6f437f` on all three; the stick loaded high (`-170326`); `test-32`, 39
+programs, 0 failures; the proofs (`-171020`). Each capsule now logs `signature: missing (unsigned)`:
+the kernel found and read the StarshipOS certificate (it said "no root key" without it), and this
+session has no key to sign with. CI signs with the secret: the PR's acceptance and the release are
+where every capsule first verifies.