feat: signed releases, release feed, notification (read-only)

internal/infrastructure/update/publicKey.go

@@ -0,0 +1,38 @@
+package update
+
+import (
+	"bytes"
+	"crypto/ed25519"
+	_ "embed"
+	"encoding/base64"
+	"errors"
+	"strings"
+)
+
+//go:embed release.pub
+var embeddedPublicKey string
+
+var (
+	ErrPublicKeyFormat      = errors.New("the public key is not a base64 encoded 32 byte ed25519 key")
+	ErrPlaceholderPublicKey = errors.New("the placeholder public key has not been replaced: run task release:keygen and commit the real key as internal/infrastructure/update/release.pub")
+)
+
+func EmbeddedPublicKey() (ed25519.PublicKey, error) {
+	return ParsePublicKey(embeddedPublicKey)
+}
+
+func ParsePublicKey(text string) (ed25519.PublicKey, error) {
+	decoded, err := base64.StdEncoding.DecodeString(strings.TrimSpace(text))
+	if err != nil || len(decoded) != ed25519.PublicKeySize {
+		return nil, ErrPublicKeyFormat
+	}
+	return ed25519.PublicKey(decoded), nil
+}
+
+func IsPlaceholderPublicKey(key ed25519.PublicKey) bool {
+	return bytes.Equal(key, make([]byte, ed25519.PublicKeySize))
+}
+
+func EncodePublicKey(key ed25519.PublicKey) string {
+	return base64.StdEncoding.EncodeToString(key)
+}