jcoffey-dev
658bf324ef
A relay release binary comes with a signature file: version, target and
SHA-256, signed with Ed25519 by the inbuxa release key, whose public half
is compiled into relay-proto. tools/release/sign-relay.sh makes the file
with openssl.
inbuxa:Relay/set takes an update with upgrade: {blobId, signature}. The
server checks the signature, uploads the binary over this node's link and
calls Relay/upgrade. The relay refuses it in a container image, while
another upgrade is on its way, and for a bad signature, another target or
a version that isn't newer. Otherwise it runs the new binary's --version,
keeps the old one as inbuxa-relay.previous, swaps it in and exits with 75
for its supervisor to restart it.
inbuxa:Relay gains olderThanServer, from each link's last relay version.
No release key is set yet: that and signing in the release workflow come
with packaging (step 6), so for now every upgrade is refused.
46 lines
1.5 KiB
Bash
Executable File
46 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-FileCopyrightText: 2026 Coffey Labs LLC
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
#
|
|
# Sign an inbuxa-relay release binary (relay spec, RL-29):
|
|
#
|
|
# tools/release/sign-relay.sh KEY.pem BINARY VERSION TARGET
|
|
#
|
|
# KEY.pem is the inbuxa release key (Ed25519, PKCS#8 PEM, as
|
|
# `openssl genpkey -algorithm ed25519` makes it). VERSION is the Cargo
|
|
# version the binary's `--version` prints (27.1.0-rc.5), TARGET its target
|
|
# (x86_64-linux-musl). Writes BINARY.sig, which the relay checks against the
|
|
# key's public half compiled into crates/relay-proto/src/release.rs.
|
|
#
|
|
# tools/release/sign-relay.sh --public KEY.pem
|
|
#
|
|
# prints that public half, base64url, for RELEASE_KEYS.
|
|
#
|
|
# openssl 3 and coreutils only, so it runs in a plain release image.
|
|
|
|
set -euo pipefail
|
|
|
|
b64url() { basenc --base64url -w0 | tr -d '='; }
|
|
|
|
if [ "${1:-}" = "--public" ] && [ $# -eq 2 ]; then
|
|
# The raw key is the last 32 bytes of the DER public key
|
|
openssl pkey -in "$2" -pubout -outform DER | tail -c 32 | b64url
|
|
echo
|
|
exit 0
|
|
fi
|
|
|
|
if [ $# -ne 4 ]; then
|
|
sed -n '5,19p' "$0" | sed 's/^# \{0,1\}//'
|
|
exit 2
|
|
fi
|
|
|
|
key=$1 binary=$2 version=$3 target=$4
|
|
sha=$(sha256sum "$binary" | cut -d' ' -f1)
|
|
signed=$(mktemp)
|
|
trap 'rm -f "$signed"' EXIT
|
|
printf 'inbuxa-relay release 1\nversion %s\ntarget %s\nsha256 %s\n' \
|
|
"$version" "$target" "$sha" > "$signed"
|
|
signature=$(openssl pkeyutl -sign -inkey "$key" -rawin -in "$signed" | b64url)
|
|
{ cat "$signed"; printf 'signature %s\n' "$signature"; } > "$binary.sig"
|
|
echo "$binary.sig"
|