security(release): rotate the Ed25519 release signing key - #32
Conversation
The signer required a 64-byte seed+pub and rejected anything else. The org secret GLYNDOR_RELEASE_ED25519_KEY is a raw 32-byte seed -- that is what podup's signer reads, and what signed podup 1.9.1 -- so pointing this workflow at the shared key (#32) is not enough on its own: the sign step dies with "key size 32, want 64" and the release never publishes. Verified by running it, not by reading it: with a 32-byte seed the signer previously exited 1; it now signs, and the signature verifies against the public key derived from that seed -- which is exactly the check updater.go performs in the field. Accept both forms. ed25519.NewKeyFromSeed expands a 32-byte seed into the 64-byte private key, and the 64-byte form still works untouched, so no existing caller breaks. A wrong length is still refused. This mismatch is likely why unitpm drifted onto a release key of its own while the docs described one shared key: the shared key could not be used here at all. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Unifies the signing key with podup, helmly and helmly-agent for the first time -- despite the documented shared-key design, this repo had its own, third distinct embedded key. Every binary from before this rotation cannot update in-band; reinstall required. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
4d41a20 to
f67a5c6
Compare
|
Rebased onto current The secret rename is already on The README commit had to go. It conflicted, and rebasing it would have reverted #35 — Ordering matters, and it is counterintuitive: #38 (making the signer accept the org's 32-byte seed) must not merge before this one. Today the size mismatch makes the release fail closed at the signing step — accidental protection. Fix the signer first and unitpm goes from "cannot release" to "publishes a release its own updater rejects". #32 before or with #38, never #38 alone. Verified the key itself, running Go rather than reading it: |
The signer required a 64-byte seed+pub; the org secret GLYNDOR_RELEASE_ED25519_KEY is a raw 32-byte seed, so the sign step died with 'key size 32, want 64' and no release could publish. This mismatch is likely why unitpm drifted onto a release key of its own while the docs described one shared key. Accept both forms via ed25519.NewKeyFromSeed; the 64-byte form still works. Verified by running it: with a 32-byte seed the signer now signs, and the signature verifies against the public key derived from that seed — the same check updater.go performs in the field. Merged after #32 deliberately: fixing the signer before the key rotation would have taken unitpm from 'cannot release' to 'publishes a release its own updater rejects'. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
1 participant
Unifies the signing key with podup, helmly and helmly-agent for the first time -- this repo had its own, third distinct embedded key despite the shared-key design. Requires the org secret GLYNDOR_RELEASE_ED25519_KEY (scoped to epistle, helmly, helmly-agent, podup, unitpm; RELEASE_SIGN_KEY retired). Breaks in-band self-update for every existing install; reinstall required.