server: refuse unsigned releases and polluted reserved addresses

Self-update now verifies SHA256SUMS.sig (ed25519, relsign package) against
a public key baked into the binary; the private key exists only in the CI
secret store, so a compromised release host can withhold updates but not
inject one. CI signs on every server-v* tag and hard-fails without the
secret. Operators with their own pipeline override the key via
ECHOLOT_SELF_UPDATE_PUBKEY (mint a pair with release-sign -gen).

Startup also now proves 80/443 are actually free on the reserved
measurement addresses by asking the OS (throwaway bind), not the config -
CheckReserved could never see a stray process, and the adb-beacon receiver
on 0.0.0.0:443 was exactly that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/cmd/echolot-server/main.go

@@ -113,7 +113,7 @@ func run() error {
 	case actions.MintEnrollToken != "":
 		return mintEnrollToken(cfg, actions.MintEnrollToken)
 	case actions.SelfUpdate:
-		return selfupdate.Run(cfg.SelfUpdateAPI, Version)
+		return selfupdate.Run(cfg.SelfUpdateAPI, cfg.SelfUpdatePubKey, Version)
 	}
 	return serve(cfg)
 }
@@ -166,6 +166,29 @@ func serve(cfg *config.Config) error {
 		map[bool]string{true: "container", false: "native"}[cfg.Docker],
 		"state_dir", cfg.StateDir)
 
+	// The reserved addresses' proof is only as good as 80/443 actually being free there.
+	// CheckReserved already keeps OUR listeners away, but a process outside this config pollutes
+	// them just as silently — the adb-beacon receiver on 0.0.0.0:443 did exactly that. So ask
+	// the OS, not the config. A hard stop for the same reason CheckReserved is one: the failure
+	// is invisible, and its first symptom is a measurement calling an intercepted network clean.
+	if reserved := cfg.ReservedIPs(); len(reserved) > 0 {
+		occupied, unverifiable := selftest.ReservedWebPortsFree(reserved)
+		if len(occupied) > 0 {
+			return fmt.Errorf(
+				"refusing to start: something outside this server is listening on reserved "+
+					"measurement address(es) %s\n"+
+					"The interception proof those addresses exist for is void while anything "+
+					"answers there.\nFind it with `ss -tlnp | grep -E ':(80|443) '`, stop it, "+
+					"or remove the address from ECHOLOT_RESERVED_ADDRS if it is no longer reserved",
+				strings.Join(occupied, ", "))
+		}
+		for _, u := range unverifiable {
+			// Not fatal: an address with a typo, or one this host no longer carries, is a
+			// config problem — refusing to serve over it would take the whole instrument down.
+			slog.Warn("could not verify a reserved web port is free", "addr", u)
+		}
+	}
+
 	st, err := store.Open(cfg.StateDir)
 	if err != nil {
 		return fmt.Errorf("state store: %w", err)

server/cmd/release-sign/main.go

@@ -0,0 +1,84 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// release-sign signs a release manifest (SHA256SUMS) with the project's ed25519 key, producing
+// the detached <file>.sig that self-updating servers verify before trusting the checksums.
+//
+//	release-sign -gen                    mint a keypair (seed on stdout — store it as the CI
+//	                                     secret RELEASE_SIGNING_KEY; publish the public key)
+//	release-sign <file>                  sign; key read from $RELEASE_SIGNING_KEY, writes <file>.sig
+//	release-sign -verify -pub <b64> <f>  check <f> against <f>.sig — what the updater will do
+//
+// Run from CI (build-server.yml); the private key exists only in the Actions secret store, never
+// on the release host, which is the property that makes the signature worth having.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"echo-lot.app/server/internal/relsign"
+)
+
+func main() {
+	gen := flag.Bool("gen", false, "generate a keypair and exit")
+	verify := flag.Bool("verify", false, "verify <file> against <file>.sig instead of signing")
+	pub := flag.String("pub", "", "public key (base64) for -verify")
+	flag.Parse()
+
+	if err := run(*gen, *verify, *pub, flag.Args()); err != nil {
+		fmt.Fprintln(os.Stderr, "release-sign:", err)
+		os.Exit(1)
+	}
+}
+
+func run(gen, verify bool, pub string, args []string) error {
+	if gen {
+		pubB64, seedB64, err := relsign.GenerateKey()
+		if err != nil {
+			return err
+		}
+		fmt.Printf("public key (embed / ECHOLOT_SELF_UPDATE_PUBKEY):\n%s\n\n"+
+			"private key (CI secret RELEASE_SIGNING_KEY — this is the only copy):\n%s\n",
+			pubB64, seedB64)
+		return nil
+	}
+	if len(args) != 1 {
+		return fmt.Errorf("usage: release-sign [-gen | -verify -pub <b64>] <file>")
+	}
+	file := args[0]
+	data, err := os.ReadFile(file)
+	if err != nil {
+		return err
+	}
+
+	if verify {
+		if pub == "" {
+			return fmt.Errorf("-verify needs -pub")
+		}
+		sig, err := os.ReadFile(file + ".sig")
+		if err != nil {
+			return err
+		}
+		if err := relsign.Verify(pub, data, string(sig)); err != nil {
+			return err
+		}
+		fmt.Printf("%s: signature OK\n", file)
+		return nil
+	}
+
+	seed := os.Getenv("RELEASE_SIGNING_KEY")
+	if seed == "" {
+		return fmt.Errorf("RELEASE_SIGNING_KEY is not set — refusing to produce an unsigned release")
+	}
+	sig, err := relsign.Sign(seed, data)
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(file+".sig", []byte(sig+"\n"), 0o644); err != nil {
+		return err
+	}
+	fmt.Printf("wrote %s.sig\n", file)
+	return nil
+}