feat: CI registers release manifests without a token; the panel verifies the CI signature instead [CI]

backend/src/MoShiro.Backend.Api/Admin/BuildEndpoints.cs

@@ -45,6 +45,31 @@ public static class BuildEndpoints
             .Requires(Capability.ReleasePublish);
     }
 
+    /// <summary>
+    /// CI 登记清单的入口，<b>不需要令牌</b>：请求里的清单必须带有效的 CI 发布签名（用 Backend 内嵌的发布公钥验）才收下。
+    /// 这样登记不依赖面板里的任何凭证（清库、重装、还没有 passkey 的时候照常工作），也没有一把能被偷的长期令牌；
+    /// 旧清单重放由 <c>seq</c> 递增挡住，节点的更新器还会用本机公钥再验一次。
+    /// </summary>
+    public static void MapOffer(IEndpointRouteBuilder app)
+    {
+        app.MapPost("/api/release/offer", OfferReleaseAsync)
+            .Api("release_offer", "Register a release manifest that carries a valid CI signature (no token needed)", "release")
+            .Returns<ReleaseDto>(StatusCodes.Status201Created).ProducesProblems(400, 403, 409);
+    }
+
+    private static async Task<IResult> OfferReleaseAsync(HttpContext http, ReleaseService releases, PublishReleaseRequest request)
+    {
+        string manifest = request.Manifest ?? "";
+        string signature = request.Signature ?? "";
+        if (manifest.Length is 0 or > ReleaseService.MaxManifestBytes || signature.Length is 0 or > ReleaseService.MaxSignatureBytes
+            || !ReleaseSignature.Verify(InstallScripts.ReleaseKey(), manifest, signature))
+        {
+            return Problems.Create(http, MoShiroErrors.Forbidden, "the manifest does not carry a valid release signature");
+        }
+
+        return await PublishReleaseAsync(http, releases, request);
+    }
+
     private static async Task<IResult> GetAsync(HttpContext http, NodeInfoService nodes, ReleaseService releases, BackendUpdates backendUpdates, CancellationToken ct)
     {
         var items = (await nodes.ListAsync(ct))

backend/src/MoShiro.Backend.Api/Admin/ReleaseSignature.cs

@@ -0,0 +1,25 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace MoShiro.Backend.Api;
+
+/// <summary>
+/// 发布清单的签名校验：用 Backend 内嵌的 CI 发布公钥（<c>packaging/update/release-key.pub.pem</c>）验 ECDSA P-256 / SHA-256（DER）签名，签名对象是清单的原始字节。
+/// 登记清单因此不需要任何令牌：能被登记的只有 CI 签过的清单，节点的更新器之后还会用本机的公钥再验一遍。
+/// </summary>
+public static class ReleaseSignature
+{
+    public static bool Verify(string publicKeyPem, string manifest, string signatureBase64)
+    {
+        try
+        {
+            using var key = ECDsa.Create();
+            key.ImportFromPem(publicKeyPem);
+            return key.VerifyData(Encoding.UTF8.GetBytes(manifest), Convert.FromBase64String(signatureBase64), HashAlgorithmName.SHA256, DSASignatureFormat.Rfc3279DerSequence);
+        }
+        catch (Exception ex) when (ex is FormatException or CryptographicException or ArgumentException)
+        {
+            return false;
+        }
+    }
+}

backend/src/MoShiro.Backend.Api/ApiModule.cs

@@ -118,6 +118,7 @@ public static class ApiModule
         LinkEndpoints.Map(guarded);
 
         OpsEndpoints.Map(app);
+        BuildEndpoints.MapOffer(app);
         app.MapOpenApi("/openapi/v1.json");
         app.MapStaticSite();
         return app;

backend/src/MoShiro.Backend.Application/Updates/ReleaseService.cs

@@ -12,7 +12,7 @@ public sealed record ReleaseOffer(string Component, long Seq, string Tag, string
 
 /// <summary>
 /// 发布清单的分发：CI 签名之后推给面板，面板存下来并原样转给在线的 Agent、Probe（节点连上时再补发一次）。
-/// <b>面板不验签、也不决定拉什么</b>：节点宿主机上的更新器用本机的发布公钥验签，并且只认本机配置的镜像仓库；
+/// 登记入口（<c>/api/release/offer</c>）只收带有效 CI 签名的清单；面板<b>不决定拉什么</b>：节点宿主机上的更新器用本机的发布公钥验签，并且只认本机配置的镜像仓库；
 /// 所以面板即使被攻破，也推不出一个能被装上的假镜像。面板只负责「通知」和「请求更新」，状态由节点随心跳报回来。
 /// </summary>
 public sealed partial class ReleaseService : IDisposable