mram
e363c9e4e4
- internal/config: .env-style config file (gpu-turnstile.env next to the exe, -config flag or GPU_TURNSTILE_CONFIG); process env overrides file. - internal/service: Windows service via golang.org/x/sys/windows/svc — graceful SCM stop, 'service install/remove' commands, restart-on-failure recovery (also applies staged updates). First external dependency, Windows-only; Linux/Docker build unaffected (go.mod stays at 1.23). - internal/update: polls the Gitea releases API, verifies the Ed25519 signature of the downloaded binary against an embedded public key (openssl-signed by CI), swaps it in next to the running exe, and once the GPU lock is idle exits with code 3 so service recovery restarts onto the new version. Dev builds and empty pubkey never update. - CI: tag builds additionally produce gpu-turnstile.exe + .sig + .sha256 attached to a Gitea release. - LOG_FILE env var so the service has somewhere to log.
14 lines
502 B
Go
14 lines
502 B
Go
package update
|
|
|
|
// publicKeyPEM is the PEM-encoded Ed25519 public key that matches the
|
|
// SIGNING_KEY secret used by CI to sign release binaries. Generate a
|
|
// keypair once with:
|
|
//
|
|
// openssl genpkey -algorithm ed25519 -out private.pem
|
|
// openssl pkey -in private.pem -pubout -out public.pem
|
|
//
|
|
// Paste the contents of public.pem here and commit; store private.pem as
|
|
// the SIGNING_KEY repository secret. When empty, the updater refuses to
|
|
// update (e.g. development builds).
|
|
var publicKeyPEM = ""
|