ci/pki/make-ca.sh

@@ -3,7 +3,10 @@
 # 2026-11-07: "New root CA on the CI box. Valid StarshipOS rather than snake oil intermediate").
 #
 #   StarshipOS Root CA              Ed25519, 20 years, self-signed. Its key never leaves this box:
-#                                   not in the repository, not in Gitea, not in any image.
+#                                   not in the repository, not in Gitea, not in any image. Its
+#                                   certificate (public) is ci/pki/starshipos-root-ca.pem, made on
+#                                   2026-11-07, SHA-256 in starshipos-root-ca.sha256; every release
+#                                   attaches it.
 #   StarshipOS Capsule Signing      Ed25519, 10 years, signed by the root; CA:TRUE, pathlen:0.
 #                                   Its certificate is built into every image (capsules/pki/
 #                                   starshipos-intermediate.der) and checks each capsule at boot;

ci/pki/starshipos-root-ca.pem

@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBaDCCARqgAwIBAgIUCwt1JkPxCfwr9PTCOadol/m9PCQwBQYDK2VwMDIxEzAR
+BgNVBAoMClN0YXJzaGlwT1MxGzAZBgNVBAMMElN0YXJzaGlwT1MgUm9vdCBDQTAe
+Fw0yNjExMDcxNjUwNTZaFw00NjExMDcxNjUwNTZaMDIxEzARBgNVBAoMClN0YXJz
+aGlwT1MxGzAZBgNVBAMMElN0YXJzaGlwT1MgUm9vdCBDQTAqMAUGAytlcAMhANcn
+fPpowbNgzMPtDEA7EYJoSkBLPljM6dEBFONfrhHso0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU5eU4Iy/Al5g9KZI5+u4jKllG
+shswBQYDK2VwA0EAjRK1ybZE/VaH31dt3sc8DgqJVTPB6CYovdqWKcJMXC8UKfYJ
+co9o8MhiIauvSCgZZA2+5VMv4zlke7Lu5TNLDg==
+-----END CERTIFICATE-----

ci/pki/starshipos-root-ca.sha256

@@ -0,0 +1 @@
+DA:A7:40:56:65:41:1A:FE:E6:08:85:3F:6E:AD:83:3A:38:30:83:E6:F0:6D:69:A6:A8:9E:92:BD:85:93:39:81