Ludovic Marie
f32a91d793
crates/horizon-release-sign signs a release's checksums with an Ed25519 key that exists only as a secret of the `release` environment, and checks them as launchers will, against the public keys built in from release-keys.txt. Dry runs sign with a throwaway key. Until release-keys.txt lists a key, releases keep going out with SHA256SUMS alone and a warning; once it does, a missing or unknown key fails the release before anything is published. tools/ci/new_release_key.sh pipes a new key straight into the secret and prints only the public key. ring and base64 are already in the lockfile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
1.4 KiB
Bash
Executable File
23 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Makes a release signing key (docs/security.md, "Signed updates"): the private key goes straight from
|
|
# horizon-release-sign into the `release` environment's secret through a pipe (never on disk, never printed,
|
|
# never in the Agents vault); the public key is printed for crates/horizon-release-sign/release-keys.txt.
|
|
# Needs a gh login that may write the repository's environment secrets (the maintainer's), and the `release`
|
|
# environment to exist.
|
|
#
|
|
# tools/ci/new_release_key.sh # the first key: RELEASE_SIGNING_KEY
|
|
# tools/ci/new_release_key.sh RELEASE_SIGNING_KEY_NEXT # rotating: the next key, signed with alongside
|
|
set -euo pipefail
|
|
secret=${1:-RELEASE_SIGNING_KEY}
|
|
case "$secret" in RELEASE_SIGNING_KEY|RELEASE_SIGNING_KEY_NEXT) ;; *) echo "unknown secret $secret" >&2; exit 2 ;; esac
|
|
repo=${GITHUB_REPOSITORY:-ludovic111/horizon}
|
|
cd "$(dirname "$0")/../.."
|
|
gh api "repos/$repo/environments/release" > /dev/null || {
|
|
echo "The release environment doesn't exist yet: create it first (docs/security.md)." >&2; exit 1; }
|
|
public=$(mktemp)
|
|
trap 'rm -f "$public"' EXIT
|
|
cargo run --quiet --locked -p horizon-release-sign -- keygen --public-out "$public" \
|
|
| gh secret set "$secret" --env release --repo "$repo"
|
|
echo "$secret is set in $repo's release environment. Its public key, for crates/horizon-release-sign/release-keys.txt:"
|
|
cat "$public"
|