feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]

ci/release-manifest.sh

@@ -28,9 +28,16 @@ if [[ -n "${RELEASE_NEXT_KEY:-}" ]]; then
   [[ -n "$next_key" ]] || { echo "RELEASE_NEXT_KEY is not a public key" >&2; exit 2; }
 fi
 
+# 官方二进制的哈希（逗号分隔的小写十六进制）：节点握手时上报正在运行的二进制的哈希，Backend 用这份签名的清单认「官方」
+binaries=""
+if [[ -n "${RELEASE_BINARIES:-}" ]]; then
+  [[ "$RELEASE_BINARIES" =~ ^[0-9a-f]{64}(,[0-9a-f]{64})*$ ]] || { echo "RELEASE_BINARIES must be comma-separated sha256 hashes" >&2; exit 2; }
+  binaries=",\"binaries\":\"$RELEASE_BINARIES\""
+fi
+
 mkdir -p "$outdir"
-printf '{"schema":1,"component":"%s","channel":"%s","image":"%s","digest":"%s","tag":"%s","version":"%s","commit":"%s","built_at":"%s","seq":%s,"install_sh":"%s","install_ps1":"%s"%s}' \
-  "$component" "$channel" "$repository" "$digest" "$tag" "$version" "$commit" "$built_at" "$seq" "$install_sh" "$install_ps1" "${next_key:+,\"next_key\":\"$next_key\"}" > "$outdir/manifest.json"
+printf '{"schema":1,"component":"%s","channel":"%s","image":"%s","digest":"%s","tag":"%s","version":"%s","commit":"%s","built_at":"%s","seq":%s,"install_sh":"%s","install_ps1":"%s"%s%s}' \
+  "$component" "$channel" "$repository" "$digest" "$tag" "$version" "$commit" "$built_at" "$seq" "$install_sh" "$install_ps1" "${next_key:+,\"next_key\":\"$next_key\"}" "$binaries" > "$outdir/manifest.json"
 
 key="$(mktemp)"
 trap 'rm -f "$key" "$outdir/manifest.sig.bin"' EXIT