From 92653cca50c93807f9f8e530814f634b03381770 Mon Sep 17 00:00:00 2001 From: claude-veilor-bot <279801990+s8n-ru@users.noreply.function_calls@gmail.com> Date: Wed, 6 May 2026 17:30:48 +0100 Subject: [PATCH] bluebuild(recipe): drop signing module for first green build Co-Authored-By: Claude Opus 4.7 --- bluebuild/recipe.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/bluebuild/recipe.yml b/bluebuild/recipe.yml index 8fe3550..b91c498 100644 --- a/bluebuild/recipe.yml +++ b/bluebuild/recipe.yml @@ -149,8 +149,9 @@ modules: - veilor-postinstall.service - veilor-doctor.timer - # ── 10. signing config ────────────────────────────────────────── - # bluebuild emits cosign.pub at root; CI uses the pinned key - # generated for veilor-org. signed-by reference for bootc upgrade - # signature verification. - - type: signing \ No newline at end of file + # ── 10. signing — DEFERRED ────────────────────────────────────── + # The BlueBuild `type: signing` module expects a cosign.pub + + # cosign.key pair next to the recipe. Generate + ship those in a + # follow-up commit once the operator has rotated the key offline + # and stashed cosign.key as a Forgejo Actions secret. Skip for the + # first green build. \ No newline at end of file