DanS
eece57c025
Rewrite scripts/sign-xmrig-release.sh to use OpenSSL (>= 1.1.1) instead of PyNaCl, so signing needs no Python deps. OpenSSL's ed25519 is PureEdDSA (RFC 8032) — interop-verified against the wallet's libsodium crypto_sign_verify_detached (script-produced .sig -> VERIFY-OK; tamper -> VERIFY-FAIL). keygen/pubkey/sign subcommands; emits base64 raw-64-byte signatures as <file>.sig. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
67 lines
2.9 KiB
Bash
Executable File
67 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Sign DRG-XMRig release archives for the wallet's in-app updater (opt-in ed25519 signatures).
|
|
#
|
|
# The wallet verifies a detached ed25519 signature over the EXACT archive bytes against a public
|
|
# key pinned in src/util/xmrig_updater.h (kXmrigSignaturePublicKeyBase64). For each archive
|
|
# <name>.zip this produces <name>.zip.sig holding the base64 of the raw 64-byte ed25519 signature —
|
|
# upload that .sig next to the .zip as a release asset.
|
|
#
|
|
# Uses OpenSSL (>= 1.1.1) only — no Python/PyNaCl needed. OpenSSL's ed25519 is PureEdDSA (RFC 8032),
|
|
# the same primitive libsodium's crypto_sign_verify_detached checks, so signatures are compatible
|
|
# (verified by the wallet's unit tests + an interop check).
|
|
#
|
|
# Usage:
|
|
# scripts/sign-xmrig-release.sh keygen [out-prefix] # -> <prefix>.ed25519.{key,pub.b64}
|
|
# scripts/sign-xmrig-release.sh pubkey <secret.key> # print the base64 public key to pin
|
|
# scripts/sign-xmrig-release.sh sign <secret.key> <file>...# -> <file>.sig per file
|
|
#
|
|
# Keep the secret key (.ed25519.key) OFFLINE. Paste the base64 public key into
|
|
# kXmrigSignaturePublicKeyBase64 in src/util/xmrig_updater.h.
|
|
|
|
set -euo pipefail
|
|
die() { echo "error: $*" >&2; exit 1; }
|
|
command -v openssl >/dev/null || die "openssl not found (need >= 1.1.1 with ed25519)"
|
|
|
|
# Raw 32-byte ed25519 public key (base64) from a private key file. The DER SubjectPublicKeyInfo for
|
|
# ed25519 is a fixed 12-byte prefix + the 32-byte key, so the trailing 32 bytes are the raw key.
|
|
pubkey_b64() { openssl pkey -in "$1" -pubout -outform DER | tail -c 32 | openssl base64 -A; }
|
|
|
|
cmd="${1:-}"; shift || true
|
|
case "$cmd" in
|
|
keygen)
|
|
prefix="${1:-drg-xmrig}"
|
|
[ -e "$prefix.ed25519.key" ] && die "$prefix.ed25519.key already exists — refusing to overwrite"
|
|
openssl genpkey -algorithm ed25519 -out "$prefix.ed25519.key"
|
|
chmod 600 "$prefix.ed25519.key"
|
|
pub="$(pubkey_b64 "$prefix.ed25519.key")"
|
|
printf '%s\n' "$pub" > "$prefix.ed25519.pub.b64"
|
|
echo "secret key : $prefix.ed25519.key (KEEP OFFLINE, mode 600)"
|
|
echo "public key : $prefix.ed25519.pub.b64"
|
|
echo
|
|
echo "Pin this in src/util/xmrig_updater.h (kXmrigSignaturePublicKeyBase64):"
|
|
echo " $pub"
|
|
;;
|
|
pubkey)
|
|
[ $# -ge 1 ] || die "usage: pubkey <secret.key>"
|
|
pubkey_b64 "$1"
|
|
;;
|
|
sign)
|
|
[ $# -ge 2 ] || die "usage: sign <secret.key> <file>..."
|
|
key="$1"; shift
|
|
[ -f "$key" ] || die "no such key: $key"
|
|
for f in "$@"; do
|
|
[ -f "$f" ] || die "no such file: $f"
|
|
raw="$(mktemp)"
|
|
openssl pkeyutl -sign -inkey "$key" -rawin -in "$f" -out "$raw"
|
|
openssl base64 -A -in "$raw" > "$f.sig"
|
|
printf '\n' >> "$f.sig"
|
|
rm -f "$raw"
|
|
echo "signed: $f -> $f.sig"
|
|
done
|
|
echo "Upload each .sig as a release asset next to its archive."
|
|
;;
|
|
*)
|
|
die "usage: $0 {keygen [prefix] | pubkey <secret.key> | sign <secret.key> <file>...}"
|
|
;;
|
|
esac
|