Update Hackage root keys

[jmct]

Hackage Security has one new key and one key needing removal. The new root.json should go live on hackage in the next week.

The new root.json is here: haskell-infra/hackage-root-keys#23 is you want to compare the key signatures.

See #9068 for a prior MR in this series.

• Patches conform to the coding conventions.
• Any changes that could be relevant to users have been recorded in the changelog.
• The documentation has been updated, if necessary.
• [N/A] Manual QA notes have been included.
• [N/A] Tests have been added. (Ask for help if you don’t know how to write them! Ask for an exemption if tests are too complex for too little coverage!)

[geekosaur]

This sounds like it should be backported to 3.14 and may warrant a point release in short order. I wonder if we should arrange for a point release containing only the key change for 3.12 as well?

[jmct]

While Tikhon's key was added, it was not used to sign this year's root.json.

Does that affect what's necessary here?

[geekosaur]

When does this become relevant, then? I still suspect we need to update versions of cabal that are in use at that point. (Arguably 3.10.3 is also in use, or at least I still hear of people using it, but I'm not sure that's in a releaseable state.)

Do we also need to tell people how to update their cabal config files since they have Hackage root keys in them?

[geekosaur]

(I should go look at the other PR but I'm on a call now so it'll have to wait a bit.)

[jmct]

I did not think it needed any action from the users, the previous PRs don't seem to mention that.

[jmct]

David C. (my predecessor and last person to do this) wrote the following for the Pantry/Stack part of it when new keys were added:

The new root key is authorized by the existing keyholders, so existing clients should give them the proper authority. However, new clients should have the current set of keyholders in the bootstrap set, which makes the system more robust against people leaving the process.

Unless cabal is doing something very different, I think this holds? So it is worth backporting for robustness but is not super urgent?

[geekosaur]

Okay, that sounds like it should be enough then. I was worried that the new key would cause rejections by the hackage-security framework, but if it takes cross-signing into account then it sounds like things are fine.