From 68362e54084035e45da69d20c8a23aadb7945911 Mon Sep 17 00:00:00 2001
From: AskaEth <i@yeij.top>
Date: Wed, 11 Nov 2026 21:35:10 +0800
Subject: [PATCH] =?UTF-8?q?feat(core):=20=E9=92=89=E5=85=A5=E7=94=9F?=
 =?UTF-8?q?=E4=BA=A7=E7=AD=BE=E5=90=8D=E5=85=AC=E9=92=A5=EF=BC=88key=5Fid?=
 =?UTF-8?q?=20ull-release=EF=BC=89+=20.gitignore=20=E9=98=B2=E7=A7=81?=
 =?UTF-8?q?=E9=92=A5=E5=85=A5=E5=BA=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore                      | 5 +++++
 crates/core/src/update/trust.rs | 1 +
 2 files changed, 6 insertions(+)

diff --git a/.gitignore b/.gitignore
index 7568856..e01e8ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,8 @@ __pycache__/
 # OS
 Thumbs.db
 .DS_Store
+
+# 签名私钥：绝不入库（M255 手册产出的本地副本）
+.signing/
+**/signing-secret*.json
+**/ull-signing/
diff --git a/crates/core/src/update/trust.rs b/crates/core/src/update/trust.rs
index c7aab6a..94f26f7 100644
--- a/crates/core/src/update/trust.rs
+++ b/crates/core/src/update/trust.rs
@@ -60,6 +60,7 @@ pub(crate) struct PinnedKey {
 /// （`packaging/sign_manifest.py --check-pinned-keyring` 按标记解析这一段，标记变了它就找不到表）。
 pub(crate) const PRODUCTION: &[PinnedKey] = &[
     // >>> PINNED-KEYS >>>
+    PinnedKey { key_id: "ull-release", public_key_hex: "1c3687ecd656a29fda87a7afb56e07d2b9e223b62cf3a6f1a901fb499a97b122" },
     // <<< PINNED-KEYS <<<
 ];