feat: the one-line installer verifies the CI-signed release manifest and pulls the image by digest [CI]

backend/tests/MoShiro.Backend.Tests/InstallTests.cs

@@ -56,6 +56,37 @@ public sealed class InstallTests
         Assert.DoesNotContain("@@", powershell, StringComparison.Ordinal);
     }
 
+    [Fact]
+    public async Task TheScript_GetsTheSignedManifestOfItsRole_ByteForByte_AndNothingWithoutAValidCode()
+    {
+        string manifest = """{"schema":1,"component":"probe","channel":"dev","image":"registry.example/moshiro-dev/moshiro-probe","digest":"sha256:0000000000000000000000000000000000000000000000000000000000000000","tag":"dev-1","version":"0.1.1","commit":"abc","built_at":"2026-10-06T00:00:00Z","seq":1}""";
+        using HttpResponseMessage published = await _backend.Admin.PostAsync("/api/admin/releases", BackendFixture.Json(new JsonObject { ["manifest"] = manifest, ["signature"] = "MEUCIQDc" }));
+        Assert.True(published.StatusCode is HttpStatusCode.Created or HttpStatusCode.Conflict, await published.Content.ReadAsStringAsync());
+
+        string code = (await CreateAsync("probe"))["plaintext"]!.GetValue<string>();
+        using HttpResponseMessage served = await _backend.Anonymous.GetAsync("/install/manifest?code=" + code);
+        Assert.Equal(HttpStatusCode.OK, served.StatusCode);
+        Assert.Equal("no-store", served.Headers.CacheControl?.ToString());
+        string body = await served.Content.ReadAsStringAsync();
+        Assert.Contains("\"component\":\"probe\"", body, StringComparison.Ordinal); // 签名对象是原始字节，面板一个字节也不改
+        using HttpResponseMessage signature = await _backend.Anonymous.GetAsync("/install/manifest.sig?code=" + code);
+        Assert.Equal(HttpStatusCode.OK, signature.StatusCode);
+        Assert.False(string.IsNullOrWhiteSpace(await signature.Content.ReadAsStringAsync()));
+
+        Assert.Equal(HttpStatusCode.NotFound, (await _backend.Anonymous.GetAsync("/install/manifest?code=jt_wrong")).StatusCode);
+        Assert.Equal(HttpStatusCode.NotFound, (await _backend.Anonymous.GetAsync("/install/manifest.sig")).StatusCode);
+    }
+
+    [Fact]
+    public async Task TheScript_CarriesTheReleaseKey_ToVerifyTheManifest()
+    {
+        string code = (await CreateAsync("agent"))["plaintext"]!.GetValue<string>();
+        string script = await _backend.Anonymous.GetStringAsync("/install?code=" + code);
+        Assert.Contains("-----BEGIN PUBLIC KEY-----", script, StringComparison.Ordinal);
+        Assert.DoesNotContain("@@", script, StringComparison.Ordinal);
+        Assert.Contains("install/manifest?code=", script, StringComparison.Ordinal);
+    }
+
     [Fact]
     public async Task Codes_RecordWhoCreatedThem()
     {