justme
a2f88a344b
Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP]
42 lines
3.2 KiB
Bash
42 lines
3.2 KiB
Bash
#!/usr/bin/env bash
|
||
# 生成并签名一个镜像的发布清单：ci/release-manifest.sh <组件> <镜像仓库> <digest> <tag> <通道> <输出目录>
|
||
# 签名私钥从环境变量 RELEASE_SIGNING_KEY（PEM 内容）读取，只写进一个 600 权限的临时文件，用完即删；私钥只放在 CI 密钥里，不进仓库、不上传面板。
|
||
# 换发布密钥：把新公钥（PEM）放进环境变量 RELEASE_NEXT_KEY，清单里就会带 "next_key"（SPKI DER 的 base64）；这份清单仍由旧密钥签名，
|
||
# 宿主机更新器验过之后改认新密钥。下一个版本起把 RELEASE_SIGNING_KEY 换成新私钥、去掉 RELEASE_NEXT_KEY，并把安装脚本和 release-key.pub.pem 里的公钥换成新的。
|
||
# 输出：<输出目录>/manifest.json（扁平 JSON，签名对象是它的原始字节）和 manifest.sig（base64 的 DER ECDSA 签名）。
|
||
set -euo pipefail
|
||
|
||
component="${1:?usage: release-manifest.sh <component> <repository> <digest> <tag> <channel> <outdir>}"
|
||
repository="${2:?}"; digest="${3:?}"; tag="${4:?}"; channel="${5:?}"; outdir="${6:?}"
|
||
[[ "$component" =~ ^(agent|probe|backend)$ ]] || { echo "unsupported component: $component" >&2; exit 2; }
|
||
[[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] || { echo "digest must look like sha256:<64 hex>" >&2; exit 2; }
|
||
[[ "$repository" =~ ^[a-z0-9./_-]+$ && "$tag" =~ ^[A-Za-z0-9._-]+$ && "$channel" =~ ^[a-z0-9._-]+$ ]] || { echo "unexpected characters in repository, tag or channel" >&2; exit 2; }
|
||
[[ -n "${RELEASE_SIGNING_KEY:-}" ]] || { echo "RELEASE_SIGNING_KEY is required" >&2; exit 2; }
|
||
|
||
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
|
||
commit="$(git -C "$root" rev-parse --short=10 HEAD 2>/dev/null || true)"
|
||
built_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||
seq="$(date +%s)"
|
||
# 静态安装脚本的 SHA-256：面板给的命令会先核对它再执行；记在签名的清单里，面板和用户都能拿它和这份构建对照
|
||
install_sh="$(sha256sum "$root/packaging/install/install.sh" | cut -d" " -f1)"
|
||
install_ps1="$(sha256sum "$root/packaging/install/install.ps1" | cut -d" " -f1)"
|
||
|
||
next_key=""
|
||
if [[ -n "${RELEASE_NEXT_KEY:-}" ]]; then
|
||
next_key="$(printf '%s\n' "$RELEASE_NEXT_KEY" | openssl pkey -pubin -inform PEM -outform DER | base64 -w0 2>/dev/null || true)"
|
||
[[ -n "$next_key" ]] || { echo "RELEASE_NEXT_KEY is not a public key" >&2; exit 2; }
|
||
fi
|
||
|
||
mkdir -p "$outdir"
|
||
printf '{"schema":1,"component":"%s","channel":"%s","image":"%s","digest":"%s","tag":"%s","version":"%s","commit":"%s","built_at":"%s","seq":%s,"install_sh":"%s","install_ps1":"%s"%s}' \
|
||
"$component" "$channel" "$repository" "$digest" "$tag" "$version" "$commit" "$built_at" "$seq" "$install_sh" "$install_ps1" "${next_key:+,\"next_key\":\"$next_key\"}" > "$outdir/manifest.json"
|
||
|
||
key="$(mktemp)"
|
||
trap 'rm -f "$key" "$outdir/manifest.sig.bin"' EXIT
|
||
chmod 600 "$key"
|
||
printf '%s\n' "$RELEASE_SIGNING_KEY" > "$key"
|
||
openssl dgst -sha256 -sign "$key" -out "$outdir/manifest.sig.bin" "$outdir/manifest.json"
|
||
base64 -w0 "$outdir/manifest.sig.bin" > "$outdir/manifest.sig" 2>/dev/null || base64 "$outdir/manifest.sig.bin" | tr -d '\n' > "$outdir/manifest.sig"
|
||
echo "signed $component $tag ($digest) seq=$seq"
|