This change was announced on the Clear Linux dev mailing list:
You can subscribe to the Clear Linux mailing list at https://lists.clearlinux.org.
There is a recent change in swupd that can affect you if you are a mix maintainer. As we have previously announced swupd now checks for a correct signature of the lastest file (version/formatXX/latetest) created on every new release.
If you use any recent mixer (> v5.9.1), that file is already being signed and there’s no change expected on your side, but if you want to be sure, check if file version/formatXX/latest.sig is being created and test if swupd is able to update. Swupd will print error messages in case your signature is invalid.
Swupd updates from mixes where latest signature is missing is still going to work for now, but warning messages will be printed. Enforcement of latest file signature will be released in the following weeks, so if you are having this kind of problems it’s important to work on fixing it sooner than later.