fix: remove dead TRITON_MANAGE_JWT_SIGNING_KEY, sync from triton #14

Merged

amiryahaya merged 2 commits from sync-607-remove-jwt-signing-key into main

2026-08-09 04:49:38 +02:00

amiryahaya commented

2026-08-07 11:35:06 +02:00

Owner

compose.yaml, env.template: remove TRITON_MANAGE_JWT_SIGNING_KEY
install.sh: stop generating it, bump SCRIPT_VERSION
install.ps1: same for the Windows path (no SCRIPT_VERSION var there)

Nothing has read this key cryptographically since triton's #600 replaced JWT sessions with opaque httpOnly-cookie tokens.

Syncs triton PR #608 (closes triton#607)'s removal of the dead JWT signing key from the manage-server installer's source of truth (triton/scripts/deploy/manage-server/) to this distribution copy, per CLAUDE.md's installer-scripts-sync rule. - compose.yaml, env.template: remove TRITON_MANAGE_JWT_SIGNING_KEY - install.sh: stop generating it, bump SCRIPT_VERSION - install.ps1: same for the Windows path (no SCRIPT_VERSION var there) Nothing has read this key cryptographically since triton's #600 replaced JWT sessions with opaque httpOnly-cookie tokens.

amiryahaya added 1 commit

2026-08-07 11:35:06 +02:00

fix: remove dead TRITON_MANAGE_JWT_SIGNING_KEY, sync from triton source of truth c61ef3c309

triton's manage-server session auth moved to httpOnly cookies with opaque
server-side tokens (#600), leaving Config.JWTSigningKey and the env var
that provisioned it dead code — removed on the triton side in PR #608
(closes triton#607). Mirrors that removal here: compose.yaml,
env.template, install.sh's key-generation step (SCRIPT_VERSION bumped to
match), and install.ps1's Windows equivalent (no SCRIPT_VERSION var to
bump there).

Source of truth: triton/scripts/deploy/manage-server/ per CLAUDE.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

amiryahaya added 1 commit

2026-08-09 04:49:19 +02:00

Merge branch 'main' into sync-607-remove-jwt-signing-key 3d8540819e

amiryahaya merged commit 42b0ca1bea into main

2026-08-09 04:49:38 +02:00

amiryahaya referenced this pull request from a commit

2026-08-09 04:49:38 +02:00

Merge pull request 'fix: remove dead TRITON_MANAGE_JWT_SIGNING_KEY, sync from triton' (#14) from sync-607-remove-jwt-signing-key into main