From 0014a8567ce943c2cd355b425d3a77dab9bec47e Mon Sep 17 00:00:00 2001
From: Sebastian Palencsar <hello@linuxcommand.dev>
Date: Tue, 23 Jun 2026 12:06:03 +0200
Subject: [PATCH] chore(flatpak): rotate GPG signing key to Bearwave App

Replace the legacy Flatpak repo key with Bearwave App
<dev@bearwave.app> (5BAA384577671E45) in bearwave.flatpakref,
build-flatpak.sh, and deploy-flatpak.sh.
---
 CHANGELOG.md              |  4 ++++
 bearwave.flatpakref       |  2 +-
 scripts/build-flatpak.sh  |  2 +-
 scripts/deploy-flatpak.sh | 14 ++++++++++++--
 4 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 16a5f25..003e666 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Flatpak repository signing key replaced with `Bearwave App <dev@bearwave.app>` (`5BAA384577671E45`).
+
 ## Version notes (1.0.3 → 1.0.5)
 
 - **1.0.3** — last GitHub release before the security/refactor batch.
diff --git a/bearwave.flatpakref b/bearwave.flatpakref
index 1b36240..93b9bbb 100644
--- a/bearwave.flatpakref
+++ b/bearwave.flatpakref
@@ -5,4 +5,4 @@ Title=BearWave
 Url=https://flatpak.bearwave.app/
 IsRuntime=false
 Suggestremote=bearwave-repo
-GPGKey=mQINBGhjencBEADg/plVOVCnowh/JxfmE6CVaDbvBur4euW5YXIQCtNzM2+tVg673otWBan0b6uKUkTJnMAHE3y0eQlGMgrcGj6/C6cJrZhuxoXrk9sPhWGpnvWI1yEb/vPNkCeAnXHvJDbp/CqcCiZZqEuJkpzWN/ZfuVpjCvrbGj+mrOVYvvQvWN3oNS8NiDiW39RJS4TNH8ce4zKNL0bglSJLptsy1mEF7izPT8q+5fyFU1OpkOlgM+6XZI20IKRKLLS6nIxMmLAvyRoyAftEWblG8/lqoy3uFbamhifoclBlbx2/5a6uN422KeXIpJk8+kRKY5dZWmYP1GalWBl78hMowBk05e3joP0qpnbF8ZhHllIclkyMGtB+po6PC3qB8UxCPsJf6wacJHKCLTHEzTMfx86oGNzs3avWDGpaF/hTlczGy9bObN2Yy3JzBBpfRBLdSENTHXUkbYZtq8pBgZd62D7pO0lhJIJAmwNyhLN49B0dwH0o6+A3ffraXIYSnnxOwNJGioJQv5VUg3yEnbfFyhdHfoKMQagZgiegf6COHK1rF2fdksdLD1U5ZsNzRP6pfGVcelIaAhJefNwaBYPapv1jz69feIiJIiJmkc33mfj6NqMuk/izMid7+yDgUoQe2YJwaOmK2ggSotYrvE3z29mkWWjEmZVMkEbdfRUrCGaqqJrssQARAQABtClTZWJhc3RpYW4gUGFsZW5jc2FyIDxoZWxsb0BwYWxlbmNzYXIucHJvPokCTQQTAQgANxYhBDN+LMziMXTvlre4paodLwFwgAhVBQJoY3p6BQkFo5qAAhsDBAsJCAcFFQgJCgsFFgIDAQAACgkQqh0vAXCACFWlwxAApEPb0y8ijGkYBZ5LV4QlTctofNZPvCBW46GBh0nKCgCi8HES997Ymbsx1bj+Z+363eUqizu2vmQaOFV0vdim5oTpJrgS8zAsrcl8uPDxB1o6PSGc/0Ee8KPU4WfQMCPKEZJwtPca/3xKlrWfaqZ0TaxXTI5XNkRYclTvZJoxlOt9ER2n4sgz4+OOdYWA+lsj+t2T8Tub18yk4K0R6ONrCoOr9CSF7yB7zXlZDIEDFm8q4YIwS4jIb0OlQySVVm6C0I35xrInw8+Eim/wa1m39z4+BFPqlEFcbRlgF7e5ZgTOXdVu/6eXF7r/iEwmV/1mBXxsCzNAI4EtNREMpGDaxQYJdXiGsodnU5fPqPGXAzFWKFYXMB/QWSb90863y65gZ8w/eBIcItamjn/cYOKFM0SLxQSMDXI793GL3yS6p/EESSNjs/edX7/Ey04g1HwZjgsc/nuwh8sRbM/ac8cHPGi07WojB8/0apwtE5H3etRLi4ZDjsY3pSw5A2b8koTc8kujDusWUPveaQX7YzmWYGuNUYQTmmtVUpwqCE2RmOPz8DHftfcPyu0qSffPbfrVhSD4642TZ7lhhzMluX5EfbjwL0+iakUQCM4VkF8u7mzMST5gMdm5Tga3d/9OVNxcDv+T9q+y3c9HfZPkyMctbwkIN2qp4h4IFF70pSMpeNa5Ag0EaGN6egEQALXp+m6nylI3P/YUgKPwdm9Y4yoqagmzz2WM4PQeIDve65xKlEmEvWvWnn1kQ6/NGGp437XoINKsTah0VdZvTda3qw1liziMWTNl3PNyb5G6DYEu4vwbWAA6H8oTG+so3KBbpAZLPHIptbtsoELXA/RgtrC20OMYNqFCmSd5EIKXIPIA95Td5Z+57s9bpF2YLt70v0CKm/F5rDAiGKjtK+soWgfm2/E95mzJq9MZtCiD34ehvk++LrmpyeqiJtFLmOIcqkOGF+d1ymWy605hdG5ZlpPBeVKzf64miimh+/UP41p9kfNG1oJpay5qKb7NzWjLgBwH2xoskZC3RxgPXL1dGJWK7YcinfaIcCSTtgWc/gO/ppygD/eTxnVK0eiEaJTqv2lHVxw/yj5lVVDg5RO3ub0zZz2n/oHlR9leU2Ym8dmbWebV/WYSsnYqfv7Exua+L7CKbGXW/IRYshChiiTwipueNW/c5k7qy5ZOR1h2lOPnkh45NPnYXNEgpo3nn5YKFrAbcIM61mY+OfJlfYJtPENq3i2cBj/bvMXh4uygq9LQjXxg1eyZZ+/cVr59V+P2OAgPOnP1IJb9o70At54V1PEMsPjsaaWouVja82YJJFlfXXFU10ptQX/9tA8gwQNBSLm+u3py65u9O6L2r9o2O6akVBi4DioThorCYUaTABEBAAGJAjwEGAEIACYWIQQzfizM4jF075a3uKWqHS8BcIAIVQUCaGN6ewUJBaOagAIbDAAKCRCqHS8BcIAIVQ+lD/9dcQq6Mev/bDNu1iYr+oBSgklgq54dvNv4vq/JnnY/28ZVeZ9Z4/A8BYkQsipNPVQMpNRXzcFGo4a+cEN1gxcDaFf2KaKGI8t64wFpA8bKxst3wIdEvbz7Gz2W8MaAjb3RTLrZt2Nwm40QJt9iwNt4JdkfNFJZcpJBnWNCww6v9j6bJfjiYmrC0kOmxbBFZpjswDd3zwr3HHBFk5U3iId7pavjYBoiXZGe5O6vMQ9Qaof69Q+7TxdgfB6b9HDgpXDnpE08rjRZmCJzY3iblx2SIFkUB5aR4hzNhJVI+dQsQd4vMM/cG0oNV+J9wf4WPy/8LyvJzO+wNTcZj/2Rtle//fHsiiJQTbrZfIcdtBldC8463FZVKo86Wuwmpyzwh2evzVTgHf+M93UvzuWjEEoawy3FLdwCDscBBm9Ktwz4vKG4tF8xu9P+JcGIm9nj4YrmuNuUaUpO/Rma3O1DScIB5QIDhi+flMWh9ozoJIVWDQyK+obnEURoISTN+njibH9QXTExcClKVp8BV2gLr0q/IwgGoMoOh/Qbb1USdhzGFeNeKZrb6TreZ2hPnoK3evvSygKla/apArAO/jwk2D2h3YLF4cTtmpTxJ8sgjL9DSIhDesPfMbSri57/92CywnRisTt7LgEu48AzrucGrjQCPkABCTIdXBUqqArgyEPn4A==
\ No newline at end of file
+GPGKey=mDMEajpZ7RYJKwYBBAHaRw8BAQdA/Wg0TOOuMYq+y/ufqE34XIhtPX84l9KBDnwPRTFLMGu0H0JlYXJ3YXZlIEFwcCA8ZGV2QGJlYXJ3YXZlLmFwcD6IlgQTFgoAPhYhBDDCBI8bRMt0awkXuVuqOEV3Zx5FBQJqOlntAhsDBQkFpOszBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEFuqOEV3Zx5FtPUA/jc7voKRe12TcyPDhwY7RRtkob/bRABRfz9VmYX96Lc4AP9GfJYvllUhP+J9dBT+kr3AzhyxC0e1VW0m19uAmG36C7g4BGo6We0SCisGAQQBl1UBBQEBB0DuKnrDVAPrR8l+rf56u9mbzoj2C8AggeEE1uQAWwwpBAMBCAeIfgQYFgoAJhYhBDDCBI8bRMt0awkXuVuqOEV3Zx5FBQJqOlntAhsMBQkFpOszAAoJEFuqOEV3Zx5FI9UBALIxCUdiyX/7I1mfAU0+d0qqU5zP2HpxvFNfMybQEn7WAP90+d/owmKLxuXNCFoNX24uQASQoobBj6rLHa43mb8tBw==
\ No newline at end of file
diff --git a/scripts/build-flatpak.sh b/scripts/build-flatpak.sh
index 3dd7af4..fde5c09 100755
--- a/scripts/build-flatpak.sh
+++ b/scripts/build-flatpak.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$root"
 
-gpg_key_id="${BEARWAVE_FLATPAK_GPG_KEY:-AA1D2F0170800855}"
+gpg_key_id="${BEARWAVE_FLATPAK_GPG_KEY:-5BAA384577671E45}"
 mode="build"
 deploy=false
 
diff --git a/scripts/deploy-flatpak.sh b/scripts/deploy-flatpak.sh
index 1484866..f69924d 100755
--- a/scripts/deploy-flatpak.sh
+++ b/scripts/deploy-flatpak.sh
@@ -23,5 +23,15 @@ rsync -avz \
   flatpak_repo/ \
   "${deploy_target}"
 
-echo "Deployed flatpak_repo/ to ${deploy_target}"
-echo "bearwave.flatpakrepo on the server is left unchanged."
\ No newline at end of file
+for ref_file in bearwave.flatpakref flatpak_repo/bearwave.flatpakref flatpak_repo/bearwave.flatpakrepo; do
+  if [[ -f "${ref_file}" ]]; then
+    rsync -avz \
+      -e 'ssh -o RemoteCommand=none -o RequestTTY=no' \
+      --no-group --no-owner \
+      "${ref_file}" \
+      "${deploy_target}$(basename "${ref_file}")"
+    echo "Deployed ${ref_file} to ${deploy_target}"
+  fi
+done
+
+echo "Deployed flatpak_repo/ to ${deploy_target}"
\ No newline at end of file