I would suggest using a key that's clearly intended to be cycled, but not per release.
I would suggest a key like Fedora IoT 2018.

if we can get the upstream issue fixed in a timely manner (i.e. the next month) can we prefer that solution over this one?

I think we should just modify gpgkeypath to accept a directory and specify the directory where the rpm gpg keys are like is done by dnf.

@dustymabe if we can get proper key rollover fixed in time for F-29 GA sure, I have timelines that make time frames that are hand wavey like "timely manner" a problem.

I don't think it will happen for f29 GA, which is a week away. How do you propose to solve the rotation problem with a key like Fedora IoT 2018? Are you proposing to never rotate it ?

@dustymabe We have one key until we can do key roll overs and then we roll it over to the Fedora release key.

I think what we need to do is bring the file in /etc/ostree/remotes.d/ under control of rpm (or make a read-only /usr/lib/ostree/remotes.d/ for files delivered by rpms) so that we can update the gpgkeypath without the user having to run a command. I think the one key until we can do key roll overs doesn't help us because the mechanism for doing the rollover (i.e.updating the ostree/remotes.d file) isn't in place.

I think the solution to this is two pronged.

1. bring the /etc/ostree/remotes.d file under rpm control so it can be updated
2. make it so multiple keys can be added to the file (or a directory)

I think 1 will help us in this cause more than creating a static key. So if we do 1 for you for f29 iot then you don't really need a static key because we can do 2 before Fedora 30.

Talked with peter today. The concerns I mentioned above can be taken care of by an ansible run that will update the ostree remote configuration; I previously did not think this was an option. The current plan is to use an iot key for fedora 29 and then hopefully switch back to the release based keys for fedora 30. The iot key allows for a contingency plan in case the rolling of keys is not ready by fedora 30.

@kevin or @mohanboddu can you create this please, call it fedora-iot-2019 or similar

@pbrobinson : @kevin is working on moving the signing vault to new hardware. He thinks it should be done today or by end of this week. I hope that is okay.

Sorry to hold you up.

@kevin @mohanboddu no probs, ping me when you're ready to do it but before you do.

@pbrobinson FYI, we are planning to make the iot key on Monday.

fedora-iot-2019 key is created.

Closing the ticket and please open if anything else needed.

Thanks.