Again... Snapshot repo GPG key expired

[peci1]

Post-mortem: ROS GPG Key Expiration Incident

Authors: @Katherine_Scott @nuclearsandwich Reviewed by: @cottsay @tfoote Incident team: @cottsay @gbiggs @Katherine_Scott @nuclearsandwich @tfoote Last week the published GPG public key which is used for the ROS and ROS 2 repositories expired causing repository verification errors when updating or installing packages from the ROS apt and rpm repositories. We created the current signing keypair as part of the total redeployment of the ROS build farm in 2018 as a precautionary measure following…

3. Devise a key rotation schedule for the deployment subkeys based on either calendar time or target platform in order to reduce the blast radius of a possible compromise of one of the deployed subkeys.

4. Update our internal incident response procedures based on employee feedback from our internal debriefing of this incident.

We hope these measures will prevent all future key expiration issues.

So, did the Intrinsic transition break some of these measures? I thought this is still the work of Open Robotics, so I hoped these processes will not be affected.