New PGP signing key?

Browser Support Desktop Support
1

Older key:

pub   rsa4096 2022-12-19 [SC] [expires: 2032-12-16]
      10A714FCA3C829A605E686A5C479D18E038EAF42
uid           [ unknown] Brave Checksums Release (Brave Checksums Release) <[email protected]>

New key:

pub   rsa4096 2025-03-11 [SC] [expires: 2035-03-09]
      7FE68A2E3754FA350A45F0AB68E5C22615F0E249
uid           [ unknown] Brave Checksums Release (Brave Checksums Release) <[email protected]>

Should we delete the old key or should we still trust it? If the old still trustworthy, why was a new one created?

2

Please edit your Original Post (“OP”) above, in order to include:

  • Brave Browser version numbers
  • Operating System version numbers

Please describe what the keys pertain to (a certificate?, an installer?), and where you find them - in detail.

3

This is not specific to my OS or Browser version.

The zip files you distribute for Linux distros here: https://github.com/brave/brave-browser/releases/tag/v1.76.82 are now signed with the new PGP/GPG key, while the previous versions were using the older key. Both keys can be found here: https://brave.com/signing-keys/#checksums-release-channel

I’m just trying to confirm that the change is intentional, and I’d also like to know if we should now stop trusting the older key. (Perhaps you changed keys because it was compromised? Or did you just lose the old one? Because the key strength is the same so I’m not sure why you’d change keys.)

4

@Mattches you have any clues?

5

This change was indeed intentional. We added redundancy in order to continue to be able to sign new Linux binaries should the AWS HSM fail. Unfortunately, it was not possible to turn an existing key into a multi-region key. So both keys are okay and neither is compromised.

If you are using our official packages, then you shouldn’t have to change anything since the brave-keyring package will handle key rotations automatically for you. If you are verifying packages manually, then you can safely keep both keys in your keyring.

4 Likes
6

Thank you for the explanation! I am on a distro that you don’t release packages for so I’ve made my own GPG verification and installation script to upgrade Brave.

7

@Tritonio Which distro is that if you don’t mind me asking?

8

Void Linux! It’s not based on any other distro, rolling but very stable, runit instead of systemd, top rated in distrowatch, and packaging AFAIK is easily done, e.g this way for Firefox. Brave installed from the zipfile runs awesomely on it.

9

Cool. That’s one we’ve already started thinking about:

2 Likes