SashegDev
874b6f20c2
Основа — Horizon (MIT). История апстрима не переносится: этот репозиторий ведёт свою.
23 lines
1.4 KiB
Bash
Executable File
23 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Makes a release signing key (docs/security.md, "Signed updates"): the private key goes straight from
|
|
# horizon-release-sign into the `release` environment's secret through a pipe (never on disk, never printed,
|
|
# never in the Agents vault); the public key is printed for crates/horizon-release-sign/release-keys.txt.
|
|
# Needs a gh login that may write the repository's environment secrets (the maintainer's), and the `release`
|
|
# environment to exist.
|
|
#
|
|
# tools/ci/new_release_key.sh # the first key: RELEASE_SIGNING_KEY
|
|
# tools/ci/new_release_key.sh RELEASE_SIGNING_KEY_NEXT # rotating: the next key, signed with alongside
|
|
set -euo pipefail
|
|
secret=${1:-RELEASE_SIGNING_KEY}
|
|
case "$secret" in RELEASE_SIGNING_KEY|RELEASE_SIGNING_KEY_NEXT) ;; *) echo "unknown secret $secret" >&2; exit 2 ;; esac
|
|
repo=${GITHUB_REPOSITORY:-horizon-rust/horizon}
|
|
cd "$(dirname "$0")/../.."
|
|
gh api "repos/$repo/environments/release" > /dev/null || {
|
|
echo "The release environment doesn't exist yet: create it first (docs/security.md)." >&2; exit 1; }
|
|
public=$(mktemp)
|
|
trap 'rm -f "$public"' EXIT
|
|
cargo run --quiet --locked -p horizon-release-sign -- keygen --public-out "$public" \
|
|
| gh secret set "$secret" --env release --repo "$repo"
|
|
echo "$secret is set in $repo's release environment. Its public key, for crates/horizon-release-sign/release-keys.txt:"
|
|
cat "$public"
|