Adolfo Delorenzo
49a37e30e8
Image signing: - Ed25519 sign/verify package (pure Go stdlib, zero deps) - genkey and sign CLI subcommands for build system - Optional --pubkey flag for verifying updates on apply - Signature URLs in update metadata (latest.json) Portainer Edge Agent: - cloud-init portainer.go module writes K8s manifest - Auto-deploys Edge Agent when portainer.edge-agent.enabled - Full RBAC (ServiceAccount, ClusterRoleBinding, Deployment) - 5 Portainer tests in portainer_test.go Production tooling: - SSH debug extension builder (hack/build-ssh-extension.sh) - Boot performance benchmark (test/benchmark/bench-boot.sh) - Resource usage benchmark (test/benchmark/bench-resources.sh) - Deployment guide (docs/deployment-guide.md) Test results: 50 update agent tests + 22 cloud-init tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
76 lines
1.6 KiB
Go
76 lines
1.6 KiB
Go
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/portainer/kubesolo-os/update/pkg/signing"
|
|
)
|
|
|
|
// Sign creates Ed25519 signatures for update artifacts.
|
|
// Used during the build process, not on the target device.
|
|
//
|
|
// Usage:
|
|
//
|
|
// kubesolo-update sign --key <privkey.hex> <file> [file...]
|
|
func Sign(args []string) error {
|
|
var keyPath string
|
|
var files []string
|
|
|
|
for i := 0; i < len(args); i++ {
|
|
switch args[i] {
|
|
case "--key":
|
|
if i+1 < len(args) {
|
|
keyPath = args[i+1]
|
|
i++
|
|
}
|
|
default:
|
|
// Non-flag args are files to sign
|
|
if args[i] != "" && args[i][0] != '-' {
|
|
files = append(files, args[i])
|
|
}
|
|
}
|
|
}
|
|
|
|
if keyPath == "" {
|
|
return fmt.Errorf("--key is required (path to Ed25519 private key hex file)")
|
|
}
|
|
if len(files) == 0 {
|
|
return fmt.Errorf("at least one file to sign is required")
|
|
}
|
|
|
|
signer, err := signing.NewSignerFromFile(keyPath)
|
|
if err != nil {
|
|
return fmt.Errorf("loading private key: %w", err)
|
|
}
|
|
|
|
for _, f := range files {
|
|
sigPath := f + ".sig"
|
|
if err := signer.SignFile(f, sigPath); err != nil {
|
|
return fmt.Errorf("signing %s: %w", f, err)
|
|
}
|
|
fmt.Printf("Signed: %s → %s\n", f, sigPath)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// GenKey generates a new Ed25519 key pair for signing updates.
|
|
//
|
|
// Usage:
|
|
//
|
|
// kubesolo-update genkey
|
|
func GenKey(args []string) error {
|
|
pub, priv, err := signing.GenerateKeyPair()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
fmt.Printf("Public key (hex): %s\n", pub)
|
|
fmt.Printf("Private key (hex): %s\n", priv)
|
|
fmt.Println()
|
|
fmt.Println("Save the public key to /etc/kubesolo/update-pubkey.hex on the device.")
|
|
fmt.Println("Keep the private key secure and offline — use it only for signing updates.")
|
|
|
|
return nil
|
|
}
|