mrambossekandClaude Opus 5
a49bef5821
Self-update now verifies SHA256SUMS.sig (ed25519, relsign package) against a public key baked into the binary; the private key exists only in the CI secret store, so a compromised release host can withhold updates but not inject one. CI signs on every server-v* tag and hard-fails without the secret. Operators with their own pipeline override the key via ECHOLOT_SELF_UPDATE_PUBKEY (mint a pair with release-sign -gen). Startup also now proves 80/443 are actually free on the reserved measurement addresses by asking the OS (throwaway bind), not the config - CheckReserved could never see a stray process, and the adb-beacon receiver on 0.0.0.0:443 was exactly that. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
118 lines
6.1 KiB
YAML
118 lines
6.1 KiB
YAML
# Server RELEASE: on server-v* tags, builds static binaries and attaches them
|
|
# to a Gitea release (the artifact --self-update consumes), and separately
|
|
# builds + pushes the container image to the Gitea registry.
|
|
#
|
|
# Two independent jobs on purpose: the release job needs only Go + curl and
|
|
# must succeed on any runner; the image job needs a Docker-capable runner and
|
|
# may fail without taking the release down with it.
|
|
#
|
|
# Tags are namespaced (server-v1.2.3) so app releases (v*) and server
|
|
# releases don't trigger each other's pipelines.
|
|
#
|
|
# Required secrets:
|
|
# REGISTRY_TOKEN personal access token with read+write package scope —
|
|
# the built-in Actions token is NOT accepted by the
|
|
# container registry (docker login → unauthorized).
|
|
# Create: user Settings → Applications → Generate token.
|
|
# REGISTRY_USER optional; defaults to the pushing actor's username.
|
|
# RELEASE_SIGNING_KEY base64 ed25519 seed that signs SHA256SUMS. Self-updating
|
|
# servers verify the signature against the public key baked
|
|
# into the binary (selfupdate.DefaultPublicKeyB64) and REFUSE
|
|
# unsigned releases, so this job hard-fails without it —
|
|
# a release nobody can install is better failed loudly here.
|
|
# Mint a pair with: go run ./cmd/release-sign -gen
|
|
# The release job otherwise needs only the built-in GITHUB_TOKEN.
|
|
|
|
name: server-release
|
|
on:
|
|
push:
|
|
tags: ["server-v*.*.*"]
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with: { go-version: "1.26", cache-dependency-path: server/go.mod }
|
|
|
|
- name: Derive version
|
|
id: meta
|
|
run: echo "version=${GITHUB_REF_NAME#server-}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build static binaries (linux amd64+arm64)
|
|
working-directory: server
|
|
run: |
|
|
for arch in amd64 arm64; do
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -trimpath \
|
|
-ldflags "-s -w -X main.Version=${{ steps.meta.outputs.version }}" \
|
|
-o "../dist/echolot-server_linux_${arch}" ./cmd/echolot-server
|
|
done
|
|
(cd ../dist && sha256sum * > SHA256SUMS)
|
|
|
|
- name: Sign SHA256SUMS
|
|
working-directory: server
|
|
env:
|
|
RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
|
|
run: |
|
|
[ -n "$RELEASE_SIGNING_KEY" ] || { echo "::error::secret RELEASE_SIGNING_KEY is missing — self-updating servers refuse unsigned releases, so publishing one would strand the fleet. Add it under Settings → Actions → Secrets."; exit 1; }
|
|
go run ./cmd/release-sign ../dist/SHA256SUMS
|
|
# Verify with the key baked into the binary we just built — catches a
|
|
# secret that does not match DefaultPublicKeyB64 before it ships.
|
|
PUB=$(grep -o 'DefaultPublicKeyB64 = "[^"]*"' internal/selfupdate/selfupdate.go | cut -d'"' -f2)
|
|
go run ./cmd/release-sign -verify -pub "$PUB" ../dist/SHA256SUMS
|
|
|
|
- name: Create release + attach binaries
|
|
env:
|
|
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
|
|
run: |
|
|
# Create the release; if it already exists (re-run), fetch it by tag.
|
|
if ! REL=$(curl -sf -X POST "$API/releases" \
|
|
-H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
|
|
-d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\"}"); then
|
|
REL=$(curl -sf "$API/releases/tags/$GITHUB_REF_NAME" -H "Authorization: token $TOKEN")
|
|
fi
|
|
# jq-free id extraction. grep -o, NOT greedy sed: a greedy leading .*
|
|
# matches the LAST "id" in the payload (a nested user/repo id) and
|
|
# the uploads 404 — that broke the first v0.1.0 release run.
|
|
ID=$(echo "$REL" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
|
|
for f in dist/*; do
|
|
# Tolerate re-runs: an existing asset of the same name may 4xx.
|
|
curl -sf -X POST "$API/releases/$ID/assets?name=$(basename "$f")" \
|
|
-H "Authorization: token $TOKEN" -F "attachment=@$f" \
|
|
|| echo "::warning::upload of $(basename "$f") failed (already attached?)"
|
|
done
|
|
|
|
image:
|
|
# Dedicated docker-capable repo runner ("compilesau-echolot").
|
|
runs-on: echolot
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Derive version + registry coords
|
|
id: meta
|
|
run: |
|
|
echo "version=${GITHUB_REF_NAME#server-}" >> "$GITHUB_OUTPUT"
|
|
# GITHUB_SERVER_URL inside the runner is the INTERNAL url
|
|
# (http://app:3000); the registry needs the public host so pulled
|
|
# image references work outside. Env var overrides if it changes.
|
|
HOST="${ECHOLOT_REGISTRY_HOST:-git.rambossek.at}"
|
|
echo "host=$HOST" >> "$GITHUB_OUTPUT"
|
|
echo "image=$HOST/${GITHUB_REPOSITORY,,}-server" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build + push image (needs a Docker-capable runner)
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
command -v docker >/dev/null || { echo "::error::no docker on this runner — image skipped; binaries/release are unaffected"; exit 1; }
|
|
[ -n "$REGISTRY_TOKEN" ] || { echo "::error::secret REGISTRY_TOKEN missing — the registry rejects the built-in Actions token. Create a PAT with package read/write scope and add it under Settings → Actions → Secrets."; exit 1; }
|
|
echo "$REGISTRY_TOKEN" | docker login "${{ steps.meta.outputs.host }}" -u "$REGISTRY_USER" --password-stdin
|
|
docker build server \
|
|
--build-arg VERSION=${{ steps.meta.outputs.version }} \
|
|
-t "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}" \
|
|
-t "${{ steps.meta.outputs.image }}:latest"
|
|
docker push "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}"
|
|
docker push "${{ steps.meta.outputs.image }}:latest"
|