Rotating the Fifth Third release key on the Q4 batch
The current Fifth Third release key retires at the end of Q3 2026. Here is the rotation timeline, the pinning behaviour of the workspace app, and how to prepare an offline device.
Why we rotate
The Fifth Third release key is a per-quarter code-signing key. Rotating once per quarter caps the blast radius of any hypothetical compromise and forces us to keep the key-management runbook fresh. It also gives us an operational milestone to review the trust store pinned in the workspace app.
Timeline
- 2026-09-24 — the new key is generated in the HSM. Public certificate published at /security-whitepaper.
- 2026-10-01 — the workspace app rolls a soft update that pins the new certificate alongside the current one.
- 2026-10-08 — Fifth Third batch v5 signed with the current key (last one on this key).
- 2026-10-15 — Fifth Third batch v6 signed with the new key (first one on the new key).
- 2026-10-31 — the previous key retires. Modules already installed keep working; new installs require the new key.
Pinning behaviour
The workspace app pins both certificates from 2026-10-01 to 2026-10-31. Enrolled devices verify every downloaded module against both. An offline device that misses the rotation window continues to verify against the old key for the modules it already carries; the first time it comes online after 2026-10-31 the workspace app fetches the new certificate over TLS and updates the trust store.
Offline devices — what to do
If you run an air-gapped device on the Fifth Third Fleet tier, connect it to the network for at least one sync between 2026-10-01 and 2026-10-31 so the workspace app can pick up the rotation. If that is not possible, contact support@fifththirdstore.org and we will provide a signed offline manifest that can be flashed via ADB.
What does not change
The Fifth Third Wednesday cadence does not change. The module data sheets do not change. The marketplace API interface does not change. Only the signing key rotates.
The Fifth Third release-key rotation runbook is published at /security-whitepaper#rotation. Questions to support@fifththirdstore.org.