From 4ca935d82e1246e36fed472d2b48a7dcf165440f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 7 Nov 2026 16:55:37 +0000
Subject: [PATCH] pki: the StarshipOS Capsule Signing certificate, in place of
 snakeoil [skip ci]

Made on the CI box by ci/pki/make-ca.sh (2026-11-07 16:50 UTC): subject
O=StarshipOS, CN=StarshipOS Capsule Signing; issuer O=StarshipOS,
CN=StarshipOS Root CA; 2026-11-07 to 2036-11-06; CA:TRUE, pathlen:0;
Ed25519. SHA-256 of the DER
13a28dda4098ef4f11cba42823a30a9898fdaffdf0c15130126fd2fe029b9a6c. Its key
is the repository secret CAPSULE_SIGN_KEY; the root's stays on the box.
The snakeoil intermediate leaves the tree (its history is in git).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2
---
 capsules/pki/snakeoil-intermediate.der   | Bin 418 -> 0 bytes
 capsules/pki/starshipos-intermediate.der | Bin 0 -> 408 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 capsules/pki/snakeoil-intermediate.der
 create mode 100644 capsules/pki/starshipos-intermediate.der

diff --git a/capsules/pki/snakeoil-intermediate.der b/capsules/pki/snakeoil-intermediate.der
deleted file mode 100644
index cc4623c8ddd6efea7230fa2014c03a96bab6d424..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 418
zcmXqLVw`8t#2B!EnTe5!NyMBxp|F?F-tSh!N#)&h&si6Jdl6&6%EqjnT3}#eC~F|i
z#vIDR%p>BHS(1@o?3kCBmz}B*l%HRs;OuB9Y#<1d=HlTBE=epZ&d4nA4>ph!=QT1j
zurM+=FfcJTFpd)EH3o4_pj-ndLu~_1h^a~_rUvIFW~b(7<|ugPm82Hsrlw>jmZW00
zLksFeW<>^L*Xh-ks?w>F>znq?`Qf%l_LKD^y#>DeHw(uZ6iJ5PSe#~%Vju*xPga<b
z@jnZP0UMBFVq`Gj1Bvm2#8`kq(PkhE;`6bHv4}W7sr+R5_yVh~`jI;_@0WCcwOM0h
zAP<sOW|1%uYY>_CyLjfT)QLM}uSl*s?{=khlD9cK%tek2QoT}Xr&LuhB*ormR$Vn!
zP;7^utC;!Ynt8|at)_C6e3K10oH@tlcjw{fyCOEmyuZup`1_mo(r2qxjThdQ<6Oc7
E016y~cK`qY

diff --git a/capsules/pki/starshipos-intermediate.der b/capsules/pki/starshipos-intermediate.der
new file mode 100644
index 0000000000000000000000000000000000000000..e4c6ee349e6a00483d3b8225bb28ac363af19327
GIT binary patch
literal 408
zcmXqLVw_^o#OStwnTe5!Nkn(;2dgtmH*SCD7oWe5<D>L>Q&Cd`RyJns)B*z|Ltz6!
zHs(+kE*`GnlEk9ojLZW6U_)sGNsu5jj}SsoAt*n;M8Vn7Ku(<3$js2tz}(Qx)WFm%
zN}Sgi#5IF*4Xm)6scfJKF;fc3Oy|Uc;?kT{h2YHeyv)3G11+e-m=zh0oI83jM)-+k
z&(uR+vsX{@53?!$^(xN0h4I6Lr!QZ(zFC}RkYXSNG*VWWk?}tZhXEUqVq#=4-~);A
zgTz>X0nlb33*z&!h_Q%l*k{eqrfA`_eYVxTZ>#Pe*Z*_c$v_??t;`}}Al4xA^r?li
z{(<Q;Y&9oY{(7gZ73sD~8s;KLh8=DFH}Bk9$CTLgsq(pbQ-<CH4y({<>TEnLrC<5D
o14Hf}vTyW}+nv8+ea0^zE{=@bwPJ-lKNT;%F1gz;njXdo0Q?AnnE(I)

literal 0
HcmV?d00001