Rotate a key

Open Setup in tapster setup to replace keys in your browser. The terminal commands below do the same from a clone of your hub. The old key keeps working until the new one is stored, so releases do not stop in between.

Where your keys go

A new key goes the same way as the first: from your computer into your own hub or Cloudflare account, nowhere else.

Key	Command	When
Developer ID certificate	init --rotate certificate	Before it expires. doctor warns 30 days ahead.
App Store Connect API key	init --rotate notary	When you revoke the old key or it leaked.
Certificate of a single app	init --certificate <label>	Before it expires. doctor warns 30 days ahead. See Sign apps with another certificate.
Its App Store Connect API key	init --certificate <label> --notary	When you revoke the old key or it leaked.
tapster App key	init --rotate app	When it leaked or at your own interval.
Doorbell App key	init --rotate doorbell	When it leaked or after an upgrade. See Faster releases.
Linux signing key	init --rotate linux	See apt and dnf.
Sparkle key	next_key in tapster.yml	See Mac apps with Sparkle.

The Apple certificate

Renew the certificate in your Apple Developer account, export it as a .p12 as in Get your Apple credentials, then run:

bunx @doguyilmaz/tapster init --rotate certificate

tapster asks for the file and its password, checks them and replaces the secrets. Releases already published stay valid: notarized software keeps working after its certificate expires.

The notarization key

Create a new key in App Store Connect, then run:

bunx @doguyilmaz/tapster init --rotate notary

Once tapster says Notarization key stored, revoke the old key in App Store Connect.

The tapster App key

In Setup → Create the GitHub App, choose Replace the App key. Open the App’s settings, generate a private key and choose the downloaded .pem file. Store the App key verifies the App identity and its installation before replacing the secret. If the hub is missing its key, the same upload form appears automatically.

After storage succeeds, revoke the old keys in GitHub and delete the downloaded file.

From the terminal:

bunx @doguyilmaz/tapster init --rotate app

1. tapster opens the App’s settings page. Scroll to Private keys and click Generate a private key. Your browser downloads a .pem file.
2. Drag the file into the terminal and press Enter.

You should see

Stored the new key (SHA256:...).

Now delete every other key on that page so the old one stops working. Then delete <path>.

tapster checks that the key belongs to the hub’s App before it stores it.