From de9ba1c621639a2f161133ec7360a925c1e502d7 Mon Sep 17 00:00:00 2001
From: Andrew Lytvynov <awly@tailscale.com>
Date: Thu, 24 Aug 2023 16:24:26 -0600
Subject: [PATCH] clientupdate/distsign/roots: add temporary dev root key
 (#9080)

Adding a root key that signs the current signing key on
pkgs.tailscale.com. This key is here purely for development and should
be replaced before 1.50 release.

Updates #8760

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
---
 clientupdate/distsign/roots.go                                  | 2 +-
 .../roots/{to-be-replaced.pub => distsign-dev-root-pub.pem}     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename clientupdate/distsign/roots/{to-be-replaced.pub => distsign-dev-root-pub.pem} (57%)

diff --git a/clientupdate/distsign/roots.go b/clientupdate/distsign/roots.go
index ed6330ca1..d5b47b7b6 100644
--- a/clientupdate/distsign/roots.go
+++ b/clientupdate/distsign/roots.go
@@ -34,7 +34,7 @@ func parseRoots() ([]ed25519.PublicKey, error) {
 		if !f.Type().IsRegular() {
 			continue
 		}
-		if filepath.Ext(f.Name()) != ".pub" {
+		if filepath.Ext(f.Name()) != ".pem" {
 			continue
 		}
 		raw, err := rootsFS.ReadFile(path.Join("roots", f.Name()))
diff --git a/clientupdate/distsign/roots/to-be-replaced.pub b/clientupdate/distsign/roots/distsign-dev-root-pub.pem
similarity index 57%
rename from clientupdate/distsign/roots/to-be-replaced.pub
rename to clientupdate/distsign/roots/distsign-dev-root-pub.pem
index 293fec3fd..f21d898a0 100644
--- a/clientupdate/distsign/roots/to-be-replaced.pub
+++ b/clientupdate/distsign/roots/distsign-dev-root-pub.pem
@@ -1,3 +1,3 @@
 -----BEGIN ROOT PUBLIC KEY-----
-xFykOJAkOlBoMOXA4UKYtaSGYsOY8r1+0wJzQE5mzUo=
+Muw5GkO5mASsJ7k6kS+svfuanr6XcW9I7fPGtyqOTeI=
 -----END ROOT PUBLIC KEY-----