What the developer wrote
Authored by ziggie
scripts: remove expired key
What changed, and why it matters
This commit removes an expired PGP public key belonging to a former release signer from the project's install verification script. It is a routine key hygiene change: keeping an expired key in the trusted key list could cause signature verification to fail or accept stale signatures, but the commit itself does not introduce any code vulnerability.
No action required beyond normal review. Users relying on verify-install.sh will automatically use the updated key list; ensure other release-signing keys remain current.
Security signals we found
Removal of expired PGP public key from release verification keyring
Routine key rotation / trust-set maintenance
Evidence from the diff
The diff deletes scripts/keys/ViktorTigerstrom.asc and removes the corresponding entry from the KEYS array in scripts/verify-install.sh. The commit message states the key was expired. No cryptographic weakness, malicious code, or vulnerability is present in the change; it is a maintenance update to the release-signature trust set.
Changed components
scripts/keys/ViktorTigerstrom.ascscripts/verify-install.shInspect captured patch +0 / −15
diff --git a/scripts/keys/ViktorTigerstrom.asc b/scripts/keys/ViktorTigerstrom.asc
deleted file mode 100644
index cfa03b7..0000000
--- a/scripts/keys/ViktorTigerstrom.asc
+++ /dev/null
@@ -1,14 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mDMEZH8cbRYJKwYBBAHaRw8BAQdAkitV+X9eSLEP4gG8hDRxGbQjGFF9LQAz80rx
-jpsbCG+0KlZpa3RvciBUaWdlcnN0csO2bSA8dnRpZ2Vyc3Ryb21AZ21haWwuY29t
-PoiZBBMWCgBBFiEEGH9q3ZOuOwzzNapquYRXCYBoTcwFAmR/HG0CGwMFCQPCZwAF
-CwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQuYRXCYBoTcyk2wEAz756kuHK
-0S6DKt3DkEE5sWChcwPzPF+ZLjppH8Xz+H0BAJCXbEYSZ/T0DB3VjDa3zmQAgvN3
-NNxRP8cUfZ+wK+cDuDgEZH8cbRIKKwYBBAGXVQEFAQEHQOWQjkKzCmUA4D89NxPn
-4Ek156kkaIouIevx+fzKW/FFAwEIB4h+BBgWCgAmFiEEGH9q3ZOuOwzzNapquYRX
-CYBoTcwFAmR/HG0CGwwFCQPCZwAACgkQuYRXCYBoTcxJ0AEAnKab3Q9GtN2VC2MM
-jUPhr+B05Arnk8BYqiqEzRVHlK4BANzpbLmkuBO6RG1237d122yX00z9RAzIQ0nd
-GTmOLCwI
-=8FyH
------END PGP PUBLIC KEY BLOCK-----
\ No newline at end of file
diff --git a/scripts/verify-install.sh b/scripts/verify-install.sh
index e2b0960..5c3aaed 100755
--- a/scripts/verify-install.sh
+++ b/scripts/verify-install.sh
@@ -26,7 +26,6 @@ KEYS+=("9FC6B0BFD597A94DBF09708280E5375C094198D8 bhandras")
KEYS+=("26984CB69EB8C4A26196F7A4D7D916376026F177 ellemouton")
KEYS+=("C97AAA1470F979878F7A6DEDC3440ACF100A33B4 ffranr")
KEYS+=("4DC235556B18694E08518DBB671103D881A5F0E4 sputn1ck")
-KEYS+=("187F6ADD93AE3B0CF335AA6AB984570980684DCC ViktorTigerstrom")
KEYS+=("E85497D2DBA0EB9ADB0024279BCD95C4FF296868 yyforyongyu")
KEYS+=("32F7EA1E7A0339F7D37164B9F82D456EA023C9BF hieblmi")
KEYS+=("5295A477FFC8064D7057B191FA7E65C951F12439 proofofkeags")
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.