BE-M0-32 · The local signing key out of git, and a new one

ID BE-M0-32 · Level L0 · Pack Pack A · Local stack settings · Run order row 18a · Issue #69

Goal

supabase/signing_keys.json is git-ignored and no longer tracked, and the local stack signs with a new key made on this Mac. Pull request #6 committed the file, a private ES256 key, and supabase/.gitignore never got its line, so every clone shared one key (D13, FE-R4). The key only signed tokens for local stacks, so nothing is rewritten in git history; the old key is never used again.

Before

• Pack A is Done. Nothing else has to come first: this step can run before pack B.
• You are in ~/opleet-v2/opleet, git status --short prints nothing, and Docker Desktop is running.

Run

1 · Note the current key's ID, which isn't secret, to compare at the end

cd ~/opleet-v2/opleet
git switch main && git pull
python3 -c 'import json; print(json.load(open("supabase/signing_keys.json"))[0]["kid"])'

2 · A branch; ignore the key file and stop tracking it (the file stays on disk for now)

git switch -c supabase/untrack-signing-key
cat >> supabase/.gitignore <<'EOF'

# Local-only ES256 signing key, made by pnpm db:signing-key (D13). Never commit it.
signing_keys.json
EOF
git rm --cached supabase/signing_keys.json
git check-ignore -v supabase/signing_keys.json
git status --short

3 · Commit, push and open the pull request

git add supabase/.gitignore
git commit -m "build(supabase): stop tracking the local signing key"
git push -u origin supabase/untrack-signing-key
gh pr create --title "build(supabase): stop tracking the local signing key" --body "BE-M0-32. #6 committed supabase/signing_keys.json; it is now ignored and untracked. Closes #69."
gh pr checks --watch

4 · Merge, then pull. The pull deletes the old key from disk, because main no longer tracks it

gh pr merge --squash --delete-branch
git switch main
git pull
ls supabase/signing_keys.json

5 · Make a new key, restart the stack, and read the key it publishes

Signing in again is needed afterwards: tokens signed with the old key no longer verify.

pnpm db:signing-key
pnpm supabase stop
pnpm supabase start
python3 -c 'import json; print(json.load(open("supabase/signing_keys.json"))[0]["kid"])'
eval "$(pnpm supabase status -o env)"
curl -s "$API_URL/auth/v1/.well-known/jwks.json" -H "apikey: $PUBLISHABLE_KEY" | python3 -c 'import json, sys; k = json.load(sys.stdin)["keys"]; print(len(k), k[0]["kid"], k[0]["alg"], "d" in k[0])'

Expect

• Block 1: “Already on 'main'”, then one key ID (a UUID-like string). Keep it for block 5.
• Block 2: “Switched to a new branch 'supabase/untrack-signing-key'”, then rm 'supabase/signing_keys.json', then supabase/.gitignore:11:signing_keys.json supabase/signing_keys.json (the line number may differ), then M supabase/.gitignore and D supabase/signing_keys.json.
• Block 3: ✔️ commitlint, then the commit line with 2 files changed; the pull request's URL; checks and pr-title pass.
• Block 4: “✓ Squashed and merged pull request #…”, the pull lists supabase/signing_keys.json as deleted, and ls prints “No such file or directory”.
• Block 5: JWT signing key appended to: supabase/signing_keys.json (now contains 1 keys); the stack stops and starts; then a key ID different from block 1's; then 1 <that ID> ES256 False.

Check

git ls-files supabase/signing_keys.json
git check-ignore -q supabase/signing_keys.json && echo ignored
git status --short
git log --oneline -1

Nothing, then “ignored”, then nothing, then “build(supabase): stop tracking the local signing key (#…)” on main.

If it fails

• Block 2's git rm --cached says “did not match any files”: the key isn't tracked on your main. Stop and paste the output of git log --oneline -3 -- supabase/signing_keys.json.
• Block 2's check-ignore prints nothing: the ignore line didn't land. Paste the output of tail -5 supabase/.gitignore. Don't commit.
• Block 4's ls still shows the file: paste the output of git log --oneline -2 and git status --short. Don't make a new key until the file is gone or ignored.
• Block 5's start fails to read the signing keys: run pnpm db:signing-key again, then pnpm supabase start.
• The key ID in block 5 matches block 1's: the old file was kept. Stop and paste both lines.

Undo

Before merging: gh pr close --delete-branch, then git switch main. The key file is still on disk and the stack is unchanged. After merging there is nothing to undo: keep the new key, and never put the old one back.

Runs

Not run yet. Log each run as a comment on #69.