gen-signing-key

Overview ¶

gen-signing-key prints a fresh Ed25519 keypair for signing releases.

Run once during initial setup or when rotating the key:

go run ./scripts/gen-signing-key

1. Copy the printed PublicKeyHex into “internal/release/pubkey.go“ and commit it.
2. Save the printed private key as the GitHub Actions secret GHOSTPSY_RELEASE_SIGNING_KEY_HEX in the agent-linux repo settings.
3. Discard the local copy of the private key after saving — there is no need to keep it on a workstation.

The output is plain hex (no extra prefix), so paste only the digits into the secret value field.