probe: add native OpenWrt deployment and signed automatic updates [CI]

backend/tests/MoShiro.Backend.Tests/InstallTests.cs

@@ -22,6 +22,21 @@ public sealed class InstallTests : IClassFixture<BackendFixture>
         return JsonNode.Parse(await response.Content.ReadAsStringAsync())!;
     }
 
+    [Fact]
+    public async Task OpenWrtScript_IsStaticAndContainsThePinnedReleasePublicKey()
+    {
+        string script = await _backend.Anonymous.GetStringAsync("/install/openwrt.sh");
+        string key = await _backend.Anonymous.GetStringAsync("/install");
+        Assert.Contains("BEGIN PUBLIC KEY", script, StringComparison.Ordinal);
+        Assert.Contains(MoShiro.Backend.Api.InstallScripts.ReleaseKey(), script, StringComparison.Ordinal);
+        Assert.Contains("--genesis", script, StringComparison.Ordinal);
+        Assert.Contains("--controllers", script, StringComparison.Ordinal);
+        Assert.Contains("openssl dgst -sha256 -verify", script, StringComparison.Ordinal);
+        Assert.DoesNotContain("BEGIN PRIVATE KEY", script + key, StringComparison.Ordinal);
+        JsonNode agent = await CreateAsync("agent");
+        Assert.Equal("", agent["install_commands"]!["openwrt"]!.GetValue<string>());
+    }
+
     [Theory]
     [InlineData("agent")]
     [InlineData("probe")]

backend/tests/MoShiro.Backend.Tests/TrustTests.cs

@@ -70,6 +70,15 @@ public sealed class TrustTests : IClassFixture<BackendFixture>
         Assert.Contains("shasum -a 256 -c -", commands["macos"]!.GetValue<string>(), StringComparison.Ordinal);
         string windowsSha = Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(await _backend.Anonymous.GetStringAsync("/install.ps1"))));
         Assert.Contains($"-ne '{windowsSha}'", commands["windows"]!.GetValue<string>(), StringComparison.Ordinal);
+        string openwrt = commands["openwrt"]!.GetValue<string>();
+        string nativeScript = await _backend.Anonymous.GetStringAsync("/install/openwrt.sh");
+        string nativeSha = Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(nativeScript)));
+        Assert.Contains($"echo \"{nativeSha}  $f\" | sha256sum -c -", openwrt, StringComparison.Ordinal);
+        Assert.Contains($"MOSHIRO_CODE='{code}'", openwrt, StringComparison.Ordinal);
+        Assert.Contains($"MOSHIRO_GENESIS='{op.Genesis}'", openwrt, StringComparison.Ordinal);
+        Assert.Contains(op.Passkey.Id, openwrt, StringComparison.Ordinal);
+        Assert.Contains("MOSHIRO_CHANNEL='release'", openwrt, StringComparison.Ordinal);
+        Assert.EndsWith("sh \"$f\" install", openwrt, StringComparison.Ordinal);
     }
 
     [Fact]