Key Rotation Guide

Note

If you have stumbled upon this guide randomly, you can ignore it. These steps are used in cases where you have been explicitly sent here, for example by an announcement informing you that we have rotated our keys.

Caution

Have your recovery key ready, you will need it.

1. Replace the ESP with the signed upstream files:

   curl -fsSLO https://code.astros-linux.org/AstrOS/AstrOS-definitions/raw/branch/main/astros-esp-update.sh
   
   # Recommended: Take a close look at the script. Blindly running scripts is dangerous.
   less astros-esp-update.sh
   
   sudo bash astros-esp-update.sh

2. Update to the latest version containing the new keys and reboot the system:

   updatectl update && reboot

3. Set Secure Boot to Setup Mode.

4. Enroll the new keys to firmware.

5. Re-enroll to the tpm2 chip.