Relay: its own image, binaries and signatures at release (RL-31) #271

Merged

jcoffey-dev merged 2 commits from relay/packaging into main 2026-10-31 00:43:34 +00:00

Conversation 0 Commits 2 Files Changed 7

+449 -16

2 Commits

Author	SHA1	Message	Date
jcoffey-dev	cbf6bd668a	Relay: the inbuxa release keys ... The CI key, which the RELAY_RELEASE_KEY secret holds, and the offline key, as tools/release/new-relay-keys.sh printed their public halves. A test checks the bytes against those strings.	2026-10-30 17:31:59 -07:00
jcoffey-dev	e11fdae372	Relay: its own image, binaries and signatures at release (RL-31) ... Dockerfile.relay builds inbuxa-relay alone, as a static musl binary, into a FROM-scratch image of about 12 MB: the binary, the CA roots and a state directory, run as uid 2001 with cap_net_bind_service only, and INBUXA_RELAY_CONTAINER set so the relay doesn't upgrade itself. A release tag builds it on whichever forge builds, under the server's tags, after checking that the image prints this version and holds no server binary (RL-T24). The release gets the two binaries, taken out of the image, in SHA256SUMS with the server's. Gitea's relay-sign job then signs them with the RELAY_RELEASE_KEY secret and attaches the .sig files; without the secret it warns and signs nothing. tools/release/new-relay-keys.sh makes the CI key and an offline backup key and prints only their public halves. resources/systemd has the unit for a host install: binary in /opt/inbuxa-relay/bin, owned by the relay's user so upgrades can replace it, Restart=always, sandboxed.	2026-10-30 17:10:21 -07:00