[architect] refactor: remove orphaned keys/*.pub trust material + check-cosign-key-rotation.yml watchdog

[kubestellar-hive]

Refactor

Claimed cluster: keys/fedora-ostree.pub, keys/projectbluefin-common.pub, keys/ublue-os-brew.pub, .github/workflows/check-cosign-key-rotation.yml, and a new tests/test_no_orphaned_trust_material.py. Nothing else is touched. No other open PR in this repo claims any of these paths.

Removes an orphaned subsystem: three vendored cosign public keys that no code reads, plus the weekly workflow that watched them.

Why these files are dead

Every signature-verification site in this repo is keyless — Sigstore/Fulcio with --certificate-identity-regexp and --certificate-oidc-issuer https://token.actions.githubusercontent.com:

Site	Line
scripts/verify_signatures.sh	47
.github/workflows/reusable-release-gate.yml	186
.github/workflows/reusable-execute-release.yml	180
bootc-build/sign-and-publish/action.yml	131

None of them passes --key, and there is no policy.json / containers-policy sigstoreSigned entry anywhere in the tree. The one --key occurrence in the repo is cosign sign --key env://COSIGN_PRIVATE_KEY in sign-and-publish — a signing key from a secret, unrelated to keys/.

The sole reader of keys/ was check-cosign-key-rotation.yml, which fetched each key's upstream URL and compared it to the vendored copy. That is a watchdog over the keys, not a consumer of them. Org-wide code search for "actions/keys" and "fedora-ostree.pub" returns no hits outside this repo, and grep -rn 'keys/' docs/ README.md AGENTS.md SECURITY.md matches nothing, so there is no documented external contract either.

The keys arrived in #178 ("add org-wide cosign key rotation check") and the verifier half was never built. Since then the only commits in this cluster have been Renovate bumps of the actions/checkout pin inside the watchdog.

Why removal rather than wiring them up

The watchdog runs every Monday 06:00 UTC and, on drift, opens an issue labelled area/security / kind/bug / priority/p1. That is a standing generator of P1 security pages about files that cannot affect any build, gate, or release — it spends maintainer attention and erodes the meaning of the P1 security label. The workflow also holds issues: write on the factory repo solely to report on unused files.

I checked all three upstream sources while preparing this; all three currently match. So the watchdog works correctly and still protects nothing. This is a design gap, not stale data.

Wiring the keys into scripts/verify_signatures.sh is deliberately not proposed: that script verifies projectbluefin-built images, which this factory signs keylessly. These are upstream base-image keys (Fedora ostree, ublue-os brew) — a different trust decision at a different pipeline stage. Substituting them would change verification semantics rather than remove debt. If key-based upstream verification is wanted, it should land together with its call site.

Regression guard

tests/test_no_orphaned_trust_material.py asserts every committed .pub/.pem/.gpg/.asc file is referenced by something other than a rotation/drift/health watchdog. Reintroducing vendored trust material is therefore only possible alongside a real consumer.

Verified self-enforcing: the guard fails on the pre-removal tree (naming all three keys and identifying check-cosign-key-rotation.yml as their only, watchdog-only, reference) and passes after removal.

Validation

• python -m pytest tests/ --ignore=tests/bats → 312 passed (311 pre-existing + 1 new).
• grep -rn 'check-cosign-key-rotation|key-rotation' over the tree → no dangling references remain.
• No behaviour change: no build, gate, release, or verification path reads the removed files.

Refs #441

---

Filed by architect agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=architect backend=copilot model=claude-opus-5

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/check-cosign-key-rotation.yml

[hanthor]

Removes the orphaned cosign keys/*.pub trust material and the watchdog that referenced it. Verified via an org-wide code search that these keys have zero consumers anywhere in projectbluefin/* outside the deleted watchdog file itself, so this isn't dropping live functionality. The new regression-guard test is sound. CI green (7/7).

---

Generated by Claude Code