archy/scripts/sign-manifest.sh

#!/usr/bin/env bash
# One-step OTA-manifest signer (counterpart to sign-catalog.sh).
#
#   Run:   bash scripts/sign-manifest.sh
#   Then:  paste your 24-word release master mnemonic, press Enter, then Ctrl-D.
#
# Signs releases/manifest.json in place and cryptographically verifies the
# result against the pinned release-root anchor. The mnemonic is read from the
# terminal only (never stored, never in shell history, never passed to Claude).
#
# Normally create-release.sh signs the manifest inline; this script exists for
# re-signing (e.g. a manifest edited after creation) or signing on a box where
# the release run was non-interactive.
#
# ⚠ ROTATION IN FLIGHT (v1.7.122-alpha). This release must be signed with the
# OLD release root, because every node still runs a binary pinning it — but
# the signer built from THIS tree already pins the NEW root, so its own
# verification would reject a correct old-key signature. Pin the old anchor
# for the duration of the ceremony so signing and verification agree:
#
#   ARCHY_RELEASE_ROOT_PUBKEY=5d15cbee8a108f7dd288c02d29a1d9d71f198acc99186aad8008b4f28d469951 \
#     bash scripts/sign-manifest.sh
#
# That hex is the OLD root's PUBLIC key (verified to derive to
# did:key:z6Mkkid…q7ur); it is not secret and pins verification only.
# From v1.7.123 the override is unnecessary — drop it and this block.
set -euo pipefail

REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
MANIFEST="$REPO/releases/manifest.json"

# Use ONLY a prebuilt signer — never compile here (compiling caused hangs in
# the earlier catalog ceremony). Prefer the repo's release build.
BIN=""
for candidate in "$REPO/core/target/release/archipelago" /tmp/archy-sign-bin/release/archipelago; do
    if [[ -x "$candidate" ]]; then BIN="$candidate"; break; fi
done
if [[ -z "$BIN" ]]; then
    echo "⏳ No prebuilt signer found. Build one first:"
    echo "   (cd core && cargo build --release -p archipelago)"
    echo "   Nothing was changed."
    exit 0
fi

echo "════════════════════════════════════════════════════════════════"
echo "  Paste your 24-word release master mnemonic below, press Enter,"
echo "  then press Ctrl-D on a new line."
echo "════════════════════════════════════════════════════════════════"
"$BIN" ceremony sign "$MANIFEST"

echo
if "$BIN" ceremony verify "$MANIFEST"; then
    echo "✅ SUCCESS — manifest signed by the pinned release root."
    echo "   Commit + push releases/manifest.json (and release-manifest.json if present)."
    cp "$MANIFEST" "$REPO/release-manifest.json" 2>/dev/null || true
else
    echo "❌ Signature did NOT verify against the pinned release-root anchor."
    echo "   Do NOT commit. Check the mnemonic and re-run."
    exit 1
fi