Invalid signature with `zig-0.14.0-index.json.minisig`

[erikarvstedt]

My usual zig update workflow fails with an invalid signature for Zig 0.14.0.

The workflow:

• Fetch https://ziglang.org/download/index.json
• Verify index.json with minisig obtained at https://ziglang.org/builds/zig-${master_version}-index.json.minisig, where $master_version is the value of master.version in index.json.

Reproduce

#!/usr/bin/env nix-shell
#!nix-shell -i bash -p minisign curl jq

tmpdir=$(mktemp -d /tmp/zig-sig.XXX)
pushd "$tmpdir"

curl -fsS 'https://ziglang.org/download/index.json' > index.json
master_version=$(<index.json jq -r .master.version)
echo "master_version: $master_version"
curl -fsS "https://ziglang.org/builds/zig-${master_version}-index.json.minisig" > minisig
zig_pubkey="RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U"

# Fails with 'Signature verification failed'
minisign -V -P "$zig_pubkey" -x minisig -m index.json

[erikarvstedt]

This also causes a update failure in mitchellh/zig-overlay.
cc @mitchellh

[erikarvstedt]

The signature is now working again for the current index.json (still with master.version == "0.14.0").
I'm leaving this issue open so that ziglang.org maintainers can close it when the root cause has been fixed.