From 9ce9f300aefcf388e219dec4307915f26416b764 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?=
 <zhangyanghaha0407@outlook.com>
Date: Mon, 24 Aug 2026 18:18:38 -0400
Subject: [PATCH] Add OmarchyCN release signing public key and verification
 docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QKxGW1raAWaqeU8WdHsMsp
---
 cn/keys/omarchycn-release.asc | 16 ++++++++++++++++
 docs/release-signing.md       | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 cn/keys/omarchycn-release.asc
 create mode 100644 docs/release-signing.md

diff --git a/cn/keys/omarchycn-release.asc b/cn/keys/omarchycn-release.asc
new file mode 100644
index 00000000..705f0573
--- /dev/null
+++ b/cn/keys/omarchycn-release.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEaozDJhYJKwYBBAHaRw8BAQdA3l2d/6gj2z96cit0NGYg419BmDDFH6SYhkzL
+3OMVCem0PU9tYXJjaHlDTiBSZWxlYXNlIFNpZ25pbmcgS2V5IDx6aGFuZ3lhbmdo
+YWhhMDQwN0BvdXRsb29rLmNvbT6ImQQTFgoAQRYhBARJDwZfat0mKnJDUG7fe4YD
+tdJHBQJqjMMmAhsBBQkDwmcABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJ
+EG7fe4YDtdJHuSMBAI3/samJVmhfdr/HYS8y266Xq82tof9lL9izImd/YibkAQCQ
+Fjw97J4LPnPQEm93j/3kmHC+EGTQu3EDbXEoI/AUC7gzBGqMwyYWCSsGAQQB2kcP
+AQEHQCRBOFrQ9UQVtv3XawZIMm93j3IV45K8kk5AGLg+JnMUiPUEGBYKACYWIQQE
+SQ8GX2rdJipyQ1Bu33uGA7XSRwUCaozDJgIbAgUJA8JnAACBCRBu33uGA7XSR3Yg
+BBkWCgAdFiEEUarKC/SJIll7SA5+IRubguF8+2cFAmqMwyYACgkQIRubguF8+2cP
+FQD6A6Xgt7L5bXR/kSJXvDHEgjsQG5xfAEEaZ8/VZ0clWxwA/ikOgsx8VQkZhwrJ
+Hb/3iG5mb138yHf3Ug00N1GwL6gOHn0A/3OSdXKvdmQhMEUf8TpZNf/ouRal2NsI
+BB1FBGxZWCYGAQDJRR2W0FEYbEuzUj9XGCHb8O9TjabNN0QduQj78ZNNAQ==
+=Awb4
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/docs/release-signing.md b/docs/release-signing.md
new file mode 100644
index 00000000..ba39ee58
--- /dev/null
+++ b/docs/release-signing.md
@@ -0,0 +1,35 @@
+# Release 签名与验证
+
+OmarchyCN 发布产物（ISO、SHA256SUMS、release.json）使用 PGP 签名。
+
+## 当前密钥
+
+| 用途 | 指纹 | 有效期 |
+|---|---|---|
+| 主钥（仅认证） | `04490F065F6ADD262A7243506EDF7B8603B5D247` | 2026-08-24 → 2028-08-23 |
+| 发布签名子钥 | `51AACA0BF48922597B480E7E211B9B82E17CFB67` | 同上 |
+
+公钥文件：[`cn/keys/omarchycn-release.asc`](../cn/keys/omarchycn-release.asc)
+
+## 验证下载
+
+```bash
+gpg --import cn/keys/omarchycn-release.asc
+gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt
+sha256sum -c SHA256SUMS.txt
+```
+
+确认签名者指纹与上表一致。
+
+## 密钥保管
+
+- 主钥私钥离线保存（不进服务器、不进 CI），仅用于签发/吊销子钥
+- 日常签名只使用签名子钥
+- 私钥与吊销证书不入 Git；仓库只含公钥
+
+## 轮换流程
+
+1. 用主钥吊销旧签名子钥，签发新子钥
+2. 更新 `cn/keys/omarchycn-release.asc` 与本文档指纹表
+3. 在下一个 Release Notes 中公告轮换
+4. 主钥泄露时：发布吊销证书、启用全新主钥、公告并重签最近产物