feat(ci): publish minisign-signed meshagent-<id> to the Forgejo package #63

Merged

David merged 1 commit from feat/VA-57-minisign-signed-packages into main

2026-06-16 13:26:20 +02:00

David commented

2026-06-16 00:19:45 +02:00

Owner

The vervain-server fetcher pulls each agent from the Forgejo generic package under the MeshCentral-style filename meshagent-<AgentId> and verifies a detached minisign signature meshagent-<id>.minisig against an operator-supplied public key. Server-side verification is mandatory (the public key is required, not optional), so the previously published artifacts (named vervain-agent-x86_64-unknown-linux-gnu, unsigned) could not be consumed.

Add a signing step to build-package.yml that copies the built binary to meshagent-6 (AgentId::Linux64, the only target built today) and signs it with minisign inside a pinned alpine container, keeping the host dependency to just Docker. The password-less signing key comes from the new CI secret VERVAIN_AGENT_MINISIGN_SECRET_KEY and is written only to the container tmpfs, never to the published out/ dir. The upload step now also publishes meshagent-6 and meshagent-6.minisig alongside the existing descriptive-named artifact and its sha256.

Document owner/package/version, the public key (with provisioning steps), and the full AgentId-to-filename mapping in docs/agent-package-distribution.md for server-side configuration. Verified the signing flow end-to-end locally: a password-less key signs meshagent-6 via the identical container step and minisign -V confirms the signature against the published public key. Key custody and rotation are designed in VA-58.

#VA-57

The vervain-server fetcher pulls each agent from the Forgejo generic package under the MeshCentral-style filename `meshagent-<AgentId>` and verifies a detached minisign signature `meshagent-<id>.minisig` against an operator-supplied public key. Server-side verification is mandatory (the public key is required, not optional), so the previously published artifacts (named `vervain-agent-x86_64-unknown-linux-gnu`, unsigned) could not be consumed. Add a signing step to build-package.yml that copies the built binary to `meshagent-6` (AgentId::Linux64, the only target built today) and signs it with minisign inside a pinned alpine container, keeping the host dependency to just Docker. The password-less signing key comes from the new CI secret `VERVAIN_AGENT_MINISIGN_SECRET_KEY` and is written only to the container tmpfs, never to the published `out/` dir. The upload step now also publishes `meshagent-6` and `meshagent-6.minisig` alongside the existing descriptive-named artifact and its sha256. Document owner/package/version, the public key (with provisioning steps), and the full AgentId-to-filename mapping in docs/agent-package-distribution.md for server-side configuration. Verified the signing flow end-to-end locally: a password-less key signs `meshagent-6` via the identical container step and `minisign -V` confirms the signature against the published public key. Key custody and rotation are designed in VA-58. #VA-57

David added 1 commit

2026-06-16 00:19:45 +02:00

feat(ci): publish minisign-signed meshagent-<id> to the Forgejo package

Check / clippy + fmt + tests (pull_request) Successful in 3m56s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

5cf2260074

The vervain-server fetcher pulls each agent from the Forgejo generic package under the MeshCentral-style filename `meshagent-<AgentId>` and verifies a detached minisign signature `meshagent-<id>.minisig` against an operator-supplied public key. Server-side verification is mandatory (the public key is required, not optional), so the previously published artifacts (named `vervain-agent-x86_64-unknown-linux-gnu`, unsigned) could not be consumed.

Add a signing step to build-package.yml that copies the built binary to `meshagent-6` (AgentId::Linux64, the only target built today) and signs it with minisign inside a pinned alpine container, keeping the host dependency to just Docker. The password-less signing key comes from the new CI secret `VERVAIN_AGENT_MINISIGN_SECRET_KEY` and is written only to the container tmpfs, never to the published `out/` dir. The upload step now also publishes `meshagent-6` and `meshagent-6.minisig` alongside the existing descriptive-named artifact and its sha256.

Document owner/package/version, the public key (with provisioning steps), and the full AgentId-to-filename mapping in docs/agent-package-distribution.md for server-side configuration. Verified the signing flow end-to-end locally: a password-less key signs `meshagent-6` via the identical container step and `minisign -V` confirms the signature against the published public key. Key custody and rotation are designed in VA-58.

#VA-57