I just finished releasing an update to App::MechaCPAN which now verifies downloads using the CHECKSUMS file for packages as appropriate. This includes verifying the signature of CHECKSUMS as possible. After release I started getting test errors because of signature verification failures. This appears to be because the signing key got rotated in the past day or two but the new key is not yet listed in 04pause.html. I need to adjust my tests to not be so sensitive to this rotation, but wanted to raise an issue as a reminder to update 04pause.html.
But I also have a question if there is a more canonical location than 04pause.html to pull the public key for checking the signatures of CHECKSUMS files? I had assumed 04pause.html was the most canonical, but maybe I missed something?
I just finished releasing an update to App::MechaCPAN which now verifies downloads using the CHECKSUMS file for packages as appropriate. This includes verifying the signature of CHECKSUMS as possible. After release I started getting test errors because of signature verification failures. This appears to be because the signing key got rotated in the past day or two but the new key is not yet listed in 04pause.html. I need to adjust my tests to not be so sensitive to this rotation, but wanted to raise an issue as a reminder to update 04pause.html.
But I also have a question if there is a more canonical location than 04pause.html to pull the public key for checking the signatures of CHECKSUMS files? I had assumed 04pause.html was the most canonical, but maybe I missed something?