6 Commits

Include renames

Author	SHA1	Message	Date
justme	0f8f3f9a54	feat: trusted release keys setting; drop the duplicate release registration route [CI] ... The panel now lets the deployer decide which release keys it trusts. The official CI key is built in and always trusted; an own P-256 public key can be added (off by default, the private key is rejected) so manifests signed with it are accepted too. Removing it drops the manifests only it signed. Changes are audited and need update.confirm. Admin UI: System > Trust > "Trusted release keys" with a collapsible guide on generating a key pair and signing a manifest with openssl. Registration now has one path, POST /api/release/offer (no token, signature verified). The admin POST /releases route, the release.publish capability and the ci-release preset are removed.	2026-10-08 18:50:16 +08:00
justme	904ea2b0ae	refactor: remove the runtime binary binding; every release registration path verifies the CI signature [CI] ... The hash a node reports about itself cannot be trusted (a swapped binary can copy the old hash), so the runtime binding only caught files that were replaced by something that did not lie. Provenance stays where it can be verified: the signed release manifest (digest) and the signed SHA256SUMS. - Remove BinaryBindingService, the node_bindings table (schema v15 drops it), BinaryPolicy, the handshake hash/manifest fields and the admin binary column. - Drop the per-platform "binaries" list from the release manifest, the hash scripts and the updater's installed.manifest copy. - ReleaseService.PublishAsync now verifies the release signature, so the admin POST /releases route is no longer an unsigned path; tests sign with a test key. - Docs: section 16 explains why the runtime check is gone.	2026-10-08 18:30:05 +08:00
justme	a2f88a344b	feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity ... Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP]	2026-10-08 03:21:44 +08:00
justme	310b2b5b19	feat: the one-line installer verifies the CI-signed release manifest and pulls the image by digest [CI]	2026-10-07 23:01:45 +08:00
justme	359313a57b	feat: record who created join codes and who added each node [CI]	2026-10-07 22:12:15 +08:00
justme	af2962fc58	feat: one-line install for agents and probes from one shared script (curl | bash, zsh, PowerShell) [CI]	2026-10-07 20:02:38 +08:00