feat(ci): sign and publish the Windows agent #125
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/VA-123-windows-agent-sign-publish"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Bring the cross-compiled 64-bit Windows agent to publish parity with the Linux build-package.yml. VA-122 built vervain-agent.exe as a CI artifact only; this adds the Windows AgentId, age/XEdDSA signing, and the generic-package upload so vervain-server can fetch and self-update Windows agents.
Add AgentId::Win64 = 2, mirroring upstream agentcore.h AGENTID_WIN64_CONSOLE (the x86-64 console identifier), and return it from detect_agent_id() on windows/x86_64. A new protocol test pins every AgentId numeric value against agentcore.h so a wrong id, which silently mis-targets self-update, fails CI.
Extend release-windows.Dockerfile to also emit the lossless vervain-agent.exe.zst transport sidecar, using the same zstd compress plus zstd -d plus cmp round-trip proof as the Linux release build.
Rework build-windows.yml from build-only into a build, sign, and publish job that mirrors build-package.yml. The Windows .exe cannot run on the Linux runner, so a throwaway Linux vervain-agent (built here from release.Dockerfile) signs the Windows bytes via its own sign subcommand; signing is over file bytes and target-agnostic. It publishes vervainagent-2 plus its .sig, .version, and .zst sidecars and the descriptive vervain-agent-x86_64-pc-windows-gnu set to the pinned, stable, and latest channels, reusing the immutable and moving upload helpers. Filenames are disjoint from the Linux vervainagent-6 set, so both workflows share the vervain-agent package and channels without colliding. VA-122's ephemeral CI artifact upload is preserved.
Update docs/agent-package-distribution.md: add the Win64 = 2 row, note ids 2 and 6 are built today, and bump the recommended fetcher id pin to 2,6.
#VA-123