diff --git a/docs/security/security.md b/docs/security/security.md index 84aaa8956cd4..6088d12bea53 100644 --- a/docs/security/security.md +++ b/docs/security/security.md @@ -22,7 +22,16 @@ guidelines at https://bugcrowd.com/squareopensource ## Verifying Artifacts -We sign our artifacts using this [key][signing_key]: +We sign our artifacts using [this key][signing_key_2026]: + +``` +pub (4)eddsa263/5dd80b0ddccbe005f0a47fd66751e1a6e2001b8d 2026-07-21T22:42:04Z + +uid lysine.dev +sig cert 6751e1a6e2001b8d 2026-07-21T22:42:04Z 2076-07-08T22:42:04Z ____________________ [selfsig] +``` + +Prior to 2026-07-21, we used [this key][signing_key_2021]. ``` pub rsa4096/dbd744ace7ade6aa50dd591f66b50994442d2d40 2021-07-09T14:50:19Z @@ -36,4 +45,5 @@ The best way to verify artifacts is [automatically with Gradle][gradle_verificat [gradle_verification]: https://docs.gradle.org/current/userguide/dependency_verification.html#sec:signature-verification -[signing_key]: https://keyserver.ubuntu.com/pks/lookup?op=hget&search=a79b48fd6a1f31699c788b50c97d0b98 +[signing_key_2021]: https://keyserver.ubuntu.com/pks/lookup?search=dbd744ace7ade6aa50dd591f66b50994442d2d40&fingerprint=on&op=index +[signing_key_2026]: https://keyserver.ubuntu.com/pks/lookup?search=5dd80b0ddccbe005f0a47fd66751e1a6e2001b8d&fingerprint=on&op=index