justme/MoShiro
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

feat: trusted release keys setting; drop the duplicate release registration route [CI]
ci/woodpecker/push/main-amd64-build Pipeline was successful
Details

Browse Source 
The panel now lets the deployer decide which release keys it trusts. The
official CI key is built in and always trusted; an own P-256 public key can be
added (off by default, the private key is rejected) so manifests signed with it
are accepted too. Removing it drops the manifests only it signed. Changes are
audited and need update.confirm.

Admin UI: System > Trust > "Trusted release keys" with a collapsible guide on
generating a key pair and signing a manifest with openssl.

Registration now has one path, POST /api/release/offer (no token, signature
verified). The admin POST /releases route, the release.publish capability and
the ci-release preset are removed.
This commit is contained in:
justme committed 2026-10-08 18:50:16 +08:00
1 parent 904ea2b0ae
commit 0f8f3f9a54
24 files changed
+914 -325
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/openapi/v1.json
+241 -115
View File
@@ -1369,118 +1369,6 @@
}
}
},
"/api/admin/releases": {
"post": {
"tags": [
"admin-build"
],
"summary": "Register a CI-signed release manifest (the signature is checked against the release key); online nodes get it right away. Admin or release tokens",
"operationId": "releases_publish",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/PublishReleaseRequest"
}
}
},
"required": true
},
"responses": {
"201": {
"description": "Created",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReleaseDto"
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"409": {
"description": "Conflict",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "release.publish"
},
"get": {
"tags": [
"admin-build"
],
"summary": "The latest signed release manifest of each component",
"operationId": "releases_list",
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/PageDtoOfReleaseDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "update.read"
}
},
"/api/admin/auth/logout": {
"post": {
"tags": [
@@ -4412,6 +4300,48 @@
"x-moshiro-capability": "update.read"
}
},
"/api/admin/releases": {
"get": {
"tags": [
"admin-build"
],
"summary": "The latest signed release manifest of each component",
"operationId": "releases_list",
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/PageDtoOfReleaseDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "update.read"
}
},
"/api/admin/nodes/{id}/update": {
"post": {
"tags": [
@@ -4617,6 +4547,148 @@
"x-moshiro-capability": "update.read"
}
},
"/api/admin/release-key": {
"get": {
"tags": [
"admin-release-key"
],
"summary": "The release keys this panel trusts: the built-in official key and the optional own key",
"operationId": "release_key_get",
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReleaseKeysDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "update.read"
},
"put": {
"tags": [
"admin-release-key"
],
"summary": "Trust your own release public key (P-256 PEM; never the private key) in addition to the official one",
"operationId": "release_key_set",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SetReleaseKeyRequest"
}
}
},
"required": true
},
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReleaseKeysDto"
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "update.confirm"
},
"delete": {
"tags": [
"admin-release-key"
],
"summary": "Stop trusting your own release key; manifests only it signed are dropped",
"operationId": "release_key_clear",
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ReleaseKeysDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "update.confirm"
}
},
"/api/admin/links": {
"get": {
"tags": [
@@ -8575,6 +8647,43 @@
}
}
},
"ReleaseKeyDto": {
"required": [
"fingerprint",
"public_key"
],
"type": "object",
"properties": {
"fingerprint": {
"type": "string"
},
"public_key": {
"type": "string"
}
}
},
"ReleaseKeysDto": {
"required": [
"official",
"custom"
],
"type": "object",
"properties": {
"official": {
"$ref": "#/components/schemas/ReleaseKeyDto"
},
"custom": {
"oneOf": [
{
"type": "null"
},
{
"$ref": "#/components/schemas/ReleaseKeyDto"
}
]
}
}
},
"ScoreDto": {
"required": [
"score",
@@ -8737,6 +8846,20 @@
}
}
},
"SetReleaseKeyRequest": {
"required": [
"public_key"
],
"type": "object",
"properties": {
"public_key": {
"type": [
"null",
"string"
]
}
}
},
"SettingDto": {
"required": [
"key",
@@ -9343,9 +9466,6 @@
{
"name": "admin-auth"
},
{
"name": "admin-build"
},
{
"name": "admin-agents"
},
@@ -9379,6 +9499,12 @@
{
"name": "admin-users"
},
{
"name": "admin-build"
},
{
"name": "admin-release-key"
},
{
"name": "admin-links"
},