archipelagoandClaude Fable 5
b92e16abc0
Demo images / Build & push demo images (push) Successful in 4m12s
The rotation commit pointed create-release.sh and publish-release-assets.sh at the NEW root in the same commit that pins it in the binary. But the release CARRYING the rotation must be signed with the OLD root: every node is still running the previous binary, which pins the old key. So the tooling would have rejected the only signature the fleet can accept, and the signature it demanded would have ended OTA fleet-wide. Both checks now expect the old DID for this cycle, with the flip to the new one called out for v1.7.123+. sign-manifest.sh documents the ARCHY_RELEASE_ROOT_PUBKEY override needed because the signer built from this tree already pins the new anchor and would fail to verify its own correct output. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
61 lines
2.9 KiB
Bash
Executable File
61 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# One-step OTA-manifest signer (counterpart to sign-catalog.sh).
|
|
#
|
|
# Run: bash scripts/sign-manifest.sh
|
|
# Then: paste your 24-word release master mnemonic, press Enter, then Ctrl-D.
|
|
#
|
|
# Signs releases/manifest.json in place and cryptographically verifies the
|
|
# result against the pinned release-root anchor. The mnemonic is read from the
|
|
# terminal only (never stored, never in shell history, never passed to Claude).
|
|
#
|
|
# Normally create-release.sh signs the manifest inline; this script exists for
|
|
# re-signing (e.g. a manifest edited after creation) or signing on a box where
|
|
# the release run was non-interactive.
|
|
#
|
|
# ⚠ ROTATION IN FLIGHT (v1.7.122-alpha). This release must be signed with the
|
|
# OLD release root, because every node still runs a binary pinning it — but
|
|
# the signer built from THIS tree already pins the NEW root, so its own
|
|
# verification would reject a correct old-key signature. Pin the old anchor
|
|
# for the duration of the ceremony so signing and verification agree:
|
|
#
|
|
# ARCHY_RELEASE_ROOT_PUBKEY=5d15cbee8a108f7dd288c02d29a1d9d71f198acc99186aad8008b4f28d469951 \
|
|
# bash scripts/sign-manifest.sh
|
|
#
|
|
# That hex is the OLD root's PUBLIC key (verified to derive to
|
|
# did:key:z6Mkkid…q7ur); it is not secret and pins verification only.
|
|
# From v1.7.123 the override is unnecessary — drop it and this block.
|
|
set -euo pipefail
|
|
|
|
REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
MANIFEST="$REPO/releases/manifest.json"
|
|
|
|
# Use ONLY a prebuilt signer — never compile here (compiling caused hangs in
|
|
# the earlier catalog ceremony). Prefer the repo's release build.
|
|
BIN=""
|
|
for candidate in "$REPO/core/target/release/archipelago" /tmp/archy-sign-bin/release/archipelago; do
|
|
if [[ -x "$candidate" ]]; then BIN="$candidate"; break; fi
|
|
done
|
|
if [[ -z "$BIN" ]]; then
|
|
echo "⏳ No prebuilt signer found. Build one first:"
|
|
echo " (cd core && cargo build --release -p archipelago)"
|
|
echo " Nothing was changed."
|
|
exit 0
|
|
fi
|
|
|
|
echo "════════════════════════════════════════════════════════════════"
|
|
echo " Paste your 24-word release master mnemonic below, press Enter,"
|
|
echo " then press Ctrl-D on a new line."
|
|
echo "════════════════════════════════════════════════════════════════"
|
|
"$BIN" ceremony sign "$MANIFEST"
|
|
|
|
echo
|
|
if "$BIN" ceremony verify "$MANIFEST"; then
|
|
echo "✅ SUCCESS — manifest signed by the pinned release root."
|
|
echo " Commit + push releases/manifest.json (and release-manifest.json if present)."
|
|
cp "$MANIFEST" "$REPO/release-manifest.json" 2>/dev/null || true
|
|
else
|
|
echo "❌ Signature did NOT verify against the pinned release-root anchor."
|
|
echo " Do NOT commit. Check the mnemonic and re-run."
|
|
exit 1
|
|
fi
|