[Nic-dorman]

Linear issue

Closes V2-1802

The release notes tell users to verify downloads with ant-keygen verify --key release-signing-key.pub …. But sign/release-signing-key.pub hasn't been the release key since 2026-03-24:

• cc34270 (03-23) rotated both the file and the key embedded in src/upgrade/signature.rs.
• fda30ed (03-24) rotated the embedded key again, and left the file alone.

Nodes verify upgrades against the embedded key, so auto-upgrade was unaffected. Anyone verifying by hand would have seen every release since 03-24 fail.

Confirmed against v0.23.1 on dev2, using ant-keygen 0.1.0 (the latest release, which release.yml downloads) and ant-node's own verify_binary_signature*:

Archive	Embedded key	sign/release-signing-key.pub on main	.pub from this PR
ant-node-cli-linux-x64.tar.gz	valid	INVALID (ant-keygen exit 1)	valid (exit 0)
ant-node-cli-windows-x64.zip	valid	INVALID	valid

The changes:

• sign/release-signing-key.pub is regenerated byte for byte from RELEASE_SIGNING_KEY: it starts 55 ed f3 e1, sha256 163f903d…6643. The embedded key, which is what nodes trust, is not changed.
• New unit test test_published_key_file_matches_embedded_key: include_bytes! of the .pub must equal RELEASE_SIGNING_KEY. A rotation now has to change both copies. I kept the Rust array as the source rather than embedding the file with include_bytes!, so that a change to the key nodes trust stays a readable source diff, not "Binary file not shown".
• release.yml sign job: after signing, it verifies every archive's .sig with ant-keygen verify --key sign/release-signing-key.pub. The release fails on a mismatch, or if there are no archives. With the test above, this also shows nodes will accept the archives. Until now nothing checked the signatures the job produced. The job gets a sparse checkout of sign/ for this.
• The .pub is attached to each GitHub release, and the notes say it's attached and is the key nodes verify upgrades against. Before, users had to find it in the repo.

Not in scope: V2-1749 (release.yml downloads ant-keygen unpinned; verify-key doesn't verify).

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

T0 because the node's code and its embedded key are unchanged. This changes the published key file, a unit test and the release workflow. The reviewer should confirm, since it sits next to the upgrade mechanism.

Compatibility

• Wire: none
• Storage: none
• API: none

Semver impact

• breaking
• feature
• fix

Test evidence

On dev2 (Linux, stable 1.99.1):

• Against the real v0.23.1 archives, the table above: the new .pub verifies with both ant-keygen verify (the release.yml command) and ant-node's verify_binary_signature_with_key, and the old one is rejected.
• cargo fmt --all -- --check, cargo clippy --all-targets --all-features -- -D warnings, RUSTDOCFLAGS=-D warnings cargo doc --all-features --no-deps and cargo check --lib --no-default-features --locked are all clean.
• cargo test --lib --features test-utils upgrade::signature: 13 passed.
• Mutation: with main's old .pub restored, test_published_key_file_matches_embedded_key fails with "sign/release-signing-key.pub is not RELEASE_SIGNING_KEY; regenerate the file from the embedded key (or rotate both)".
• actionlint .github/workflows/release.yml: clean. The new verify step first runs on the next release, or on a dry_run dispatch, which runs sign too.

New dependency

none

ADR

n/a

Mitigation / rollback

Revert the PR. Nodes are unaffected either way, because the embedded key doesn't change. If the new verify step fails a release, it means a signature doesn't match the key nodes enforce. That release shouldn't ship.

🤖 Generated with Claude Code

[MaidSafe-Hermes]

APPROVE — reviewed head a8321ff (base 5413030). No blocking defects found in the three changed paths. The signing job uses the same archive patterns as its signing loop, fails on an empty archive set or any failed/missing signature, then includes the verified public key in the signed artifact and final release upload. The unit test binds the checked-in key bytes to the key embedded in node verification.

Verification: 2/2 independent seats reviewed (sol-1 gpt-6.1-sol xhigh; glm-1 z-ai/glm-5.3); both seats agree after checking their initial workflow-context questions against the full PR workflow. GitHub CI Gate and test/build jobs succeeded. Security Audit fails on RUSTSEC-2026-0387 (crypto-bigint 0.5.5); Cargo.lock is unchanged by this PR, so this is not introduced here and remains a separate merge gate. The focused local cargo test attempt timed out; no local test pass is claimed.

Non-blocking security note: a public key downloaded only from the same release as the artifact does not independently authenticate the release. Users still need a trusted way to establish that key (for example, compare it with the key in a trusted source checkout or an independently published fingerprint).