Documentation
¶
Overview ¶
Package release verifies Ed25519 signatures on release artifacts.
The release workflow signs the SHA256SUMS file (which lists the hash of every binary in the release) with an Ed25519 private key stored as a GitHub Actions secret. The agent embeds the matching public key at build time and verifies the signature before trusting any binary it downloads for an auto-update.
Key custody and rotation: see ../../README.md and the upstream docs/release-signing.md.
Index ¶
Constants ¶
const PublicKeyHex = "af463b2689f87712ce60446e0f82f3817f3c26269e0fccb978bd59a25a182ab6"
PublicKeyHex is the hex-encoded Ed25519 public key (32 raw bytes → 64 hex characters). Populated once by “go run ./scripts/gen-signing-key“; the matching private key lives as the GitHub Actions secret GHOSTPSY_RELEASE_SIGNING_KEY_HEX.
Variables ¶
var ErrSigningNotConfigured = errors.New(
"release signing not configured: no public key compiled in (set PublicKeyHex or " +
"GHOSTPSY_RELEASE_PUBKEY_HEX)",
)
ErrSigningNotConfigured is returned when no public key is embedded and no override is set. The caller should refuse to install the artifact.
Functions ¶
func HashBinary ¶
HashBinary returns the lowercase hex SHA256 of “data“, the format produced by “sha256sum“ and used in the SHA256SUMS file.
func VerifyBinaryHash ¶
VerifyBinaryHash checks that “data“ matches the entry for “filename“ in a SHA256SUMS file. Lines look like “<hex> <name>“; surrounding whitespace and “*“ (binary mode) are ignored.
func VerifyShaSums ¶
VerifyShaSums checks that “signatureHex“ is a valid Ed25519 signature over “shaSumsContent“ produced by the release private key.
“signatureHex“ is the textual content of the “SHA256SUMS.sig“ file: 64 hex bytes (128 characters), optionally surrounded by whitespace.
Types ¶
This section is empty.
Source Files