justme
904ea2b0ae
ci/woodpecker/push/main-amd64-build Pipeline was successful
The hash a node reports about itself cannot be trusted (a swapped binary can copy the old hash), so the runtime binding only caught files that were replaced by something that did not lie. Provenance stays where it can be verified: the signed release manifest (digest) and the signed SHA256SUMS. - Remove BinaryBindingService, the node_bindings table (schema v15 drops it), BinaryPolicy, the handshake hash/manifest fields and the admin binary column. - Drop the per-platform "binaries" list from the release manifest, the hash scripts and the updater's installed.manifest copy. - ReleaseService.PublishAsync now verifies the release signature, so the admin POST /releases route is no longer an unsigned path; tests sign with a test key. - Docs: section 16 explains why the runtime check is gone.
22 lines
919 B
C#
22 lines
919 B
C#
using System.Security.Cryptography;
|
|
using System.Text;
|
|
using MoShiro.Backend.Application;
|
|
|
|
namespace MoShiro.Backend.Tests;
|
|
|
|
/// <summary>
|
|
/// 测试用的发布密钥：真正的 CI 私钥不在仓库里，测试后端用这把公钥验签（<see cref="BackendFixture"/> 替换了内嵌的那把），
|
|
/// 登记清单的用例用它签名——和 CI 一样是 DER 编码的 ECDSA P-256 / SHA-256，签名对象是清单的原始字节。
|
|
/// </summary>
|
|
public sealed class TestReleaseKey : IReleaseKey
|
|
{
|
|
private static readonly ECDsa s_key = ECDsa.Create(ECCurve.NamedCurves.nistP256);
|
|
|
|
public static TestReleaseKey Instance { get; } = new();
|
|
|
|
public string Pem => s_key.ExportSubjectPublicKeyInfoPem();
|
|
|
|
public static string Sign(string manifest) =>
|
|
Convert.ToBase64String(s_key.SignData(Encoding.UTF8.GetBytes(manifest), HashAlgorithmName.SHA256, DSASignatureFormat.Rfc3279DerSequence));
|
|
}
|