Rails `signed_id` changes even though the signed_key_base does not

[sdubois (Sébastien Dubois)]

@brenogazzola I’m also very interested if you found anything. Our ActionText embedded images all broke recently and I didn’t get to the bottom of why.

NB: the default value of Rails.application.config.active_support.key_generator_hash_digest_class and Rails.application.config.active_support.hash_digest_class changed in Rails 7, maybe you kept the same Rails version but deleted your new_framework_defaults_7.0.rb or otherwise modified those values? (1, 2, 3, 4)

Below is the little info/questions I gathered about rotating secret_key_base and any other elements that might affect signed IDs:

How to rotate secrek_key_base without breaking ActiveStorage/ActionText attachments?

This unmerged PR makes the point that ActiveStorage URLs will break if the app’s secret_key_base gets changed (also see issues #40352, #40614). It suggests registering a rotator to update the old URLs. Is the below initializer the recommended way? # config/initializers/rotators.rb Rails.application.config.after_initialize do |app| old_secret_key_base = Rails.application.credentials.dig(:old_secret_key_base) ActiveStorage.verifier.rotate(old_secret_key_base, digest: "SHA256", serializer: Ma…