probe: add native OpenWrt deployment and signed automatic updates [CI]

backend/tests/MoShiro.Backend.Tests/InstallTests.cs

@@ -22,6 +22,21 @@ public sealed class InstallTests : IClassFixture<BackendFixture>
         return JsonNode.Parse(await response.Content.ReadAsStringAsync())!;
     }
 
+    [Fact]
+    public async Task OpenWrtScript_IsStaticAndContainsThePinnedReleasePublicKey()
+    {
+        string script = await _backend.Anonymous.GetStringAsync("/install/openwrt.sh");
+        string key = await _backend.Anonymous.GetStringAsync("/install");
+        Assert.Contains("BEGIN PUBLIC KEY", script, StringComparison.Ordinal);
+        Assert.Contains(MoShiro.Backend.Api.InstallScripts.ReleaseKey(), script, StringComparison.Ordinal);
+        Assert.Contains("--genesis", script, StringComparison.Ordinal);
+        Assert.Contains("--controllers", script, StringComparison.Ordinal);
+        Assert.Contains("openssl dgst -sha256 -verify", script, StringComparison.Ordinal);
+        Assert.DoesNotContain("BEGIN PRIVATE KEY", script + key, StringComparison.Ordinal);
+        JsonNode agent = await CreateAsync("agent");
+        Assert.Equal("", agent["install_commands"]!["openwrt"]!.GetValue<string>());
+    }
+
     [Theory]
     [InlineData("agent")]
     [InlineData("probe")]