feat: every agent and probe must have an owner passkey, enforced by the panel, the installers and fleet-enroll [CI]

packaging/install/install.ps1

@@ -113,6 +113,11 @@ YOrtO3Vso/QNdSMmepQlx1Q3v+KkN7ro3AY3I6DT2Q2txJu5pS7qzutSQA==
     # Docker Desktop 没有宿主网络：Agent 把端口发布出来（面板里的地址需要指向这台机器的公网地址）
     if ($role -eq 'agent') { $arguments += @('-p', '7443:7443/tcp', '-p', '7443:7443/udp', '-p', '7444:7444/tcp') }
     $arguments += @('-e', "MOSHIRO_SERVER=$server", '-e', "MOSHIRO_JOIN=$code", '-e', "MOSHIRO_NAME=$name")
+    # 每个节点都必须有属主（passkey）：命令里的信任根指纹和属主缺一个就不装（面板的命令总是带着；只有没有信任根的老面板才需要 MOSHIRO_ALLOW_NO_OWNER=1）
+    if ((-not $env:MOSHIRO_GENESIS -or -not $env:MOSHIRO_CONTROLLERS) -and $env:MOSHIRO_ALLOW_NO_OWNER -ne '1') {
+        Write-Error 'this node has no owner: MOSHIRO_GENESIS and MOSHIRO_CONTROLLERS are required (copy the complete command from the panel; set up the trust root first)'
+        return
+    }
     # 命令里带着信任根指纹和属主（公开值）：节点在注册时验证面板的操作员集合并把它们固定在本地
     if ($env:MOSHIRO_GENESIS) {
         if (($env:MOSHIRO_GENESIS + $env:MOSHIRO_CONTROLLERS) -notmatch '^[A-Za-z0-9_,-]+$') { Write-Error 'MOSHIRO_GENESIS or MOSHIRO_CONTROLLERS has unexpected characters'; return }

packaging/install/install.sh

@@ -109,6 +109,10 @@ elif [ "$ROLE" = agent ]; then
   set -- "$@" -p 7443:7443/tcp -p 7443:7443/udp -p 7444:7444/tcp
 fi
 set -- "$@" -e "MOSHIRO_SERVER=$SERVER" -e "MOSHIRO_JOIN=$CODE" -e "MOSHIRO_NAME=$name"
+# 每个节点都必须有属主（passkey）：命令里的信任根指纹和属主缺一个就不装（面板的命令总是带着；只有没有信任根的老面板才需要 MOSHIRO_ALLOW_NO_OWNER=1）
+if [ -z "${MOSHIRO_GENESIS:-}" ] || [ -z "${MOSHIRO_CONTROLLERS:-}" ]; then
+  [ "${MOSHIRO_ALLOW_NO_OWNER:-}" = 1 ] || die "this node has no owner: MOSHIRO_GENESIS and MOSHIRO_CONTROLLERS are required (copy the complete command from the panel; set up the trust root first)"
+fi
 if [ -n "${MOSHIRO_GENESIS:-}" ]; then
   case "$MOSHIRO_GENESIS${MOSHIRO_CONTROLLERS:-}" in *[!A-Za-z0-9_,-]*) die "MOSHIRO_GENESIS or MOSHIRO_CONTROLLERS has unexpected characters" ;; esac
   set -- "$@" -e "MOSHIRO_GENESIS=$MOSHIRO_GENESIS" -e "MOSHIRO_CONTROLLERS=${MOSHIRO_CONTROLLERS:-}"