Embed release public key; rename signing secret to RELEASE_SIGNING_KEY

.gitea/workflows/ci.yml

@@ -81,7 +81,7 @@ jobs:
 
       - name: Sign and checksum
         run: |
-          printf '%s\n' "${{ secrets.SIGNING_KEY }}" > key.pem
+          printf '%s\n' "${{ secrets.RELEASE_SIGNING_KEY }}" > key.pem
           chmod 600 key.pem
           openssl pkeyutl -sign -inkey key.pem -rawin \
             -in gpu-turnstile.exe -out gpu-turnstile.exe.sig

README.md

@@ -117,7 +117,7 @@ version. Disable with `AUTO_UPDATE=false`. Releases are signed by CI with
 OpenSSL; the matching public key lives in `internal/update/pubkey.go`
 (one-time setup: `openssl genpkey -algorithm ed25519 -out private.pem`,
 `openssl pkey -in private.pem -pubout -out public.pem`; private key goes
-to the `SIGNING_KEY` repo secret, public key is committed).
+to the `RELEASE_SIGNING_KEY` repo secret, public key is committed).
 
 ### Docker
 

SPEC.md

@@ -176,7 +176,7 @@ Docker.
   `dev` builds and builds without an embedded public key never update.
 - **Signing setup (one time)**: `openssl genpkey -algorithm ed25519 -out
   private.pem`; `openssl pkey -in private.pem -pubout -out public.pem`.
-  Private key → repo secret `SIGNING_KEY`; public key → committed into
+  Private key → repo secret `RELEASE_SIGNING_KEY`; public key → committed into
   `internal/update/pubkey.go`. CI signs release binaries with
   `openssl pkeyutl -sign -rawin`.
 
@@ -280,7 +280,7 @@ are new.
      `write:package` scope) because the automatic `GITEA_TOKEN` cannot push
      packages; the username is just `gitea.actor`.
   3. on a version tag: also build the Windows binary, sign it with OpenSSL
-     (`SIGNING_KEY` secret), and attach `gpu-turnstile.exe`, `.sig` and
+     (`RELEASE_SIGNING_KEY` secret), and attach `gpu-turnstile.exe`, `.sig` and
      `.sha256` to a Gitea release for the auto-updater.
 - Release: a git tag `vX.Y.Z` produces the versioned image and the signed
   Windows binary; the Open WebUI compose pins that tag. No images or

internal/update/pubkey.go

@@ -1,13 +1,16 @@
 package update
 
 // publicKeyPEM is the PEM-encoded Ed25519 public key that matches the
-// SIGNING_KEY secret used by CI to sign release binaries. Generate a
+// RELEASE_SIGNING_KEY secret used by CI to sign release binaries. Generate a
 // keypair once with:
 //
 //	openssl genpkey -algorithm ed25519 -out private.pem
 //	openssl pkey -in private.pem -pubout -out public.pem
 //
 // Paste the contents of public.pem here and commit; store private.pem as
-// the SIGNING_KEY repository secret. When empty, the updater refuses to
+// the RELEASE_SIGNING_KEY repository secret. When empty, the updater refuses
-// update (e.g. development builds).
+// to update (e.g. development builds).
-var publicKeyPEM = ""
+var publicKeyPEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA+gJbSvgeYX58woPQGbSC8x8Zw4OTDiiQ7/19seZKfSQ=
+-----END PUBLIC KEY-----
+`