From 1b2369a80e38cb5bc79d286c5e921893048dfb78 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 17 Jun 2025 15:22:35 +0200
Subject: [PATCH] bash: Improve patch signing key fetching and verification

Get it from a more directly trusted source and update md5 -> sha256

Running the script still works with all signature verifications
succeeding
---
 pkgs/shells/bash/update-patch-set.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/shells/bash/update-patch-set.sh b/pkgs/shells/bash/update-patch-set.sh
index ee785cc83123..721b867c3bf8 100755
--- a/pkgs/shells/bash/update-patch-set.sh
+++ b/pkgs/shells/bash/update-patch-set.sh
@@ -22,11 +22,13 @@ set -e
 
 rm -vf "$PATCH_LIST"
 
-wget "https://tiswww.case.edu/php/chet/gpgkey.asc"
-echo "4ef5051ce7200241e65d29c11eb57df8  gpgkey.asc" > gpgkey.asc.md5
-md5sum -c gpgkey.asc.md5
+# https://savannah.gnu.org/projects/bash/: Group Admins: Chet Ramey
+# https://savannah.gnu.org/users/chet: Download GPG Key
+wget "https://savannah.gnu.org/people/viewgpg.php?user_id=2590" -O gpgkey.asc
+echo "db4041b4d3896b9f21250e6c29861958bd5d4781f521f06beda849a9ed79fae8  gpgkey.asc" > gpgkey.asc.sha256
+sha256sum -c gpgkey.asc.sha256
 gpg --import ./gpgkey.asc
-rm gpgkey.asc{,.md5}
+rm gpgkey.asc{,.sha256}
 
 ( echo "# Automatically generated by \`$(basename "$0")'; do not edit." ;	\
   echo "" ;								\