🐈‍⬛David Sommerseth on Nostr: Yeah, that's unfortunate - and they have been working to resolve this. But this is ...

Yeah, that's unfortunate - and they have been working to resolve this. But this is not an issue in CalyxOS itself.

This issue is an organizational challenge where they lacked control mechanisms to revoke access properly and in due time - which affected the build infrastructure CalyxOS is built on.

From the URL you point at:

> First, we want to assure you that we have no reason to believe the security of CalyxOS and its signing keys have been compromised.

> As you know, we announced a recent leadership transition. When senior personnel have access to signing keys and leave a team, it is security best practice to update signing keys and conduct audits. So in accordance with that, we are using this transition period to update our security protocols, including updating the signing keys and taking other steps to further protect our users.