feat: signed releases, release feed, notification (read-only)
This commit is contained in:
fsylvain committed
1 parent
a49eec909c
commit
834493a4f5
49 files changed
+4191
-18
No files matched your search
@@ -0,0 +1,292 @@
|
||||
package releasesign
|
||||
|
||||
import (
|
||||
"RenewCMS/internal/infrastructure/update"
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const (
|
||||
exitOK = 0
|
||||
exitFailure = 1
|
||||
exitUsage = 2
|
||||
|
||||
signingKeyEnvVar = "RELEASE_SIGNING_KEY"
|
||||
signatureSuffix = ".sig"
|
||||
privateKeyFileMode = 0o600
|
||||
publicFileMode = 0o644
|
||||
repositoryMarker = ".git"
|
||||
checksumsFileName = "checksums.txt"
|
||||
usageText = "usage: releasesign keygen <private-key-path> [--pub-out <path>] | sign <file> [--key <path>] [--pub <path>] | verify <file> [--pub <path>] | checksums <dir> [--match <glob>]"
|
||||
publicKeyCommitHint = "commit the public key as internal/infrastructure/update/release.pub"
|
||||
)
|
||||
|
||||
var (
|
||||
errInsideRepository = errors.New("the private key path is inside the repository work tree, choose a path outside it")
|
||||
errKeyMismatch = errors.New("the private key does not match the public key in use")
|
||||
errPrivateKeyFormat = errors.New("the private key file is not a base64 encoded ed25519 private key")
|
||||
errSignatureFormat = errors.New("the signature file is not a base64 encoded ed25519 signature")
|
||||
errBadSignature = errors.New("the signature does not match the file: it was changed or signed with another key")
|
||||
errNoKeyPath = errors.New("no private key given: pass --key or set RELEASE_SIGNING_KEY")
|
||||
)
|
||||
|
||||
func Run(args []string, stdout, stderr io.Writer) int {
|
||||
if len(args) == 0 {
|
||||
fmt.Fprintln(stderr, usageText)
|
||||
return exitUsage
|
||||
}
|
||||
commands := map[string]func([]string, io.Writer) error{
|
||||
"keygen": keygen,
|
||||
"sign": sign,
|
||||
"verify": verify,
|
||||
"checksums": checksums,
|
||||
}
|
||||
command, known := commands[args[0]]
|
||||
if !known {
|
||||
fmt.Fprintln(stderr, usageText)
|
||||
return exitUsage
|
||||
}
|
||||
if err := command(args[1:], stdout); err != nil {
|
||||
fmt.Fprintln(stderr, "releasesign:", err)
|
||||
return exitFailure
|
||||
}
|
||||
return exitOK
|
||||
}
|
||||
|
||||
func parseArguments(name string, args []string, define func(*flag.FlagSet)) (string, error) {
|
||||
set := flag.NewFlagSet(name, flag.ContinueOnError)
|
||||
set.SetOutput(io.Discard)
|
||||
define(set)
|
||||
positional, flags := splitArguments(args)
|
||||
if err := set.Parse(flags); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if len(positional) != 1 {
|
||||
return "", errors.New(usageText)
|
||||
}
|
||||
return positional[0], nil
|
||||
}
|
||||
|
||||
func splitArguments(args []string) ([]string, []string) {
|
||||
var positional, flags []string
|
||||
for i := 0; i < len(args); i++ {
|
||||
if strings.HasPrefix(args[i], "--") {
|
||||
flags = append(flags, args[i])
|
||||
if !strings.Contains(args[i], "=") && i+1 < len(args) {
|
||||
i++
|
||||
flags = append(flags, args[i])
|
||||
}
|
||||
continue
|
||||
}
|
||||
positional = append(positional, args[i])
|
||||
}
|
||||
return positional, flags
|
||||
}
|
||||
|
||||
func keygen(args []string, stdout io.Writer) error {
|
||||
var pubOut string
|
||||
keyPath, err := parseArguments("keygen", args, func(set *flag.FlagSet) { set.StringVar(&pubOut, "pub-out", "", "") })
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := refuseInsideRepository(keyPath); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := os.Stat(keyPath); err == nil {
|
||||
return fmt.Errorf("%s already exists, it is not overwritten", keyPath)
|
||||
}
|
||||
publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
encodedPrivate := base64.StdEncoding.EncodeToString(privateKey) + "\n"
|
||||
if err := os.WriteFile(keyPath, []byte(encodedPrivate), privateKeyFileMode); err != nil {
|
||||
return err
|
||||
}
|
||||
encodedPublic := update.EncodePublicKey(publicKey)
|
||||
if pubOut != "" {
|
||||
if err := os.WriteFile(pubOut, []byte(encodedPublic+"\n"), publicFileMode); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
fmt.Fprintf(stdout, "private key written to %s: keep it outside the repository and never share it\n", keyPath)
|
||||
fmt.Fprintf(stdout, "public key: %s\n%s\n", encodedPublic, publicKeyCommitHint)
|
||||
return nil
|
||||
}
|
||||
|
||||
func refuseInsideRepository(path string) error {
|
||||
absolute, err := filepath.Abs(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for directory := filepath.Dir(absolute); ; directory = filepath.Dir(directory) {
|
||||
if _, err := os.Stat(filepath.Join(directory, repositoryMarker)); err == nil {
|
||||
return fmt.Errorf("%w (%s)", errInsideRepository, directory)
|
||||
}
|
||||
if directory == filepath.Dir(directory) {
|
||||
return nil
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func sign(args []string, stdout io.Writer) error {
|
||||
var keyPath, pubPath string
|
||||
file, err := parseArguments("sign", args, func(set *flag.FlagSet) {
|
||||
set.StringVar(&keyPath, "key", "", "")
|
||||
set.StringVar(&pubPath, "pub", "", "")
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
publicKey, err := loadPublicKey(pubPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
privateKey, err := loadPrivateKey(keyPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !publicKeyOf(privateKey).Equal(publicKey) {
|
||||
return errKeyMismatch
|
||||
}
|
||||
content, err := os.ReadFile(file)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
signature := base64.StdEncoding.EncodeToString(ed25519.Sign(privateKey, content))
|
||||
if err := os.WriteFile(file+signatureSuffix, []byte(signature+"\n"), publicFileMode); err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Fprintf(stdout, "signed %s into %s\n", file, file+signatureSuffix)
|
||||
return nil
|
||||
}
|
||||
|
||||
func verify(args []string, stdout io.Writer) error {
|
||||
var pubPath string
|
||||
file, err := parseArguments("verify", args, func(set *flag.FlagSet) { set.StringVar(&pubPath, "pub", "", "") })
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
publicKey, err := loadPublicKey(pubPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
content, err := os.ReadFile(file)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
rawSignature, err := os.ReadFile(file + signatureSuffix)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
signature, err := base64.StdEncoding.DecodeString(strings.TrimSpace(string(rawSignature)))
|
||||
if err != nil || len(signature) != ed25519.SignatureSize {
|
||||
return errSignatureFormat
|
||||
}
|
||||
if !ed25519.Verify(publicKey, content, signature) {
|
||||
return errBadSignature
|
||||
}
|
||||
fmt.Fprintf(stdout, "%s is signed by the release key\n", file)
|
||||
return nil
|
||||
}
|
||||
|
||||
func checksums(args []string, stdout io.Writer) error {
|
||||
match := "*"
|
||||
dir, err := parseArguments("checksums", args, func(set *flag.FlagSet) { set.StringVar(&match, "match", "*", "") })
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
paths, err := filepath.Glob(filepath.Join(dir, match))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
sort.Strings(paths)
|
||||
var lines strings.Builder
|
||||
for _, path := range paths {
|
||||
line, err := checksumLine(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
lines.WriteString(line)
|
||||
}
|
||||
if lines.Len() == 0 {
|
||||
return fmt.Errorf("no file in %s matches %s", dir, match)
|
||||
}
|
||||
target := filepath.Join(dir, checksumsFileName)
|
||||
if err := os.WriteFile(target, []byte(lines.String()), publicFileMode); err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Fprintln(stdout, "wrote", target)
|
||||
return nil
|
||||
}
|
||||
|
||||
func checksumLine(path string) (string, error) {
|
||||
name := filepath.Base(path)
|
||||
if name == checksumsFileName || strings.HasSuffix(name, signatureSuffix) {
|
||||
return "", nil
|
||||
}
|
||||
info, err := os.Stat(path)
|
||||
if err != nil || info.IsDir() {
|
||||
return "", err
|
||||
}
|
||||
content, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
sum := sha256.Sum256(content)
|
||||
return fmt.Sprintf("%s %s\n", hex.EncodeToString(sum[:]), name), nil
|
||||
}
|
||||
|
||||
func loadPublicKey(pubPath string) (ed25519.PublicKey, error) {
|
||||
var key ed25519.PublicKey
|
||||
var err error
|
||||
if pubPath == "" {
|
||||
key, err = update.EmbeddedPublicKey()
|
||||
} else {
|
||||
var content []byte
|
||||
content, err = os.ReadFile(pubPath)
|
||||
if err == nil {
|
||||
key, err = update.ParsePublicKey(string(content))
|
||||
}
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if update.IsPlaceholderPublicKey(key) {
|
||||
return nil, update.ErrPlaceholderPublicKey
|
||||
}
|
||||
return key, nil
|
||||
}
|
||||
|
||||
func loadPrivateKey(keyPath string) (ed25519.PrivateKey, error) {
|
||||
if keyPath == "" {
|
||||
keyPath = os.Getenv(signingKeyEnvVar)
|
||||
}
|
||||
if keyPath == "" {
|
||||
return nil, errNoKeyPath
|
||||
}
|
||||
content, err := os.ReadFile(keyPath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
decoded, err := base64.StdEncoding.DecodeString(strings.TrimSpace(string(content)))
|
||||
if err != nil || len(decoded) != ed25519.PrivateKeySize {
|
||||
return nil, errPrivateKeyFormat
|
||||
}
|
||||
return ed25519.PrivateKey(decoded), nil
|
||||
}
|
||||
|
||||
func publicKeyOf(privateKey ed25519.PrivateKey) ed25519.PublicKey {
|
||||
return privateKey.Public().(ed25519.PublicKey)
|
||||
}
|
||||
Reference in new issue
Block a user