stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity

blocked 4

Browse Source
This commit is contained in:
StellaOps Bot
2025-11-23 17:18:33 +02:00
parent c3ce1ebc25
commit fc99092dec
16 changed files with 88 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
scripts/mirror/check_signing_prereqs.sh
View File

@@ -2,8 +2,7 @@
# Verifies signing prerequisites without requiring the actual key contents.
set -euo pipefail
if [[ -z "${MIRROR_SIGN_KEY_B64:-}" ]]; then
echo "MIRROR_SIGN_KEY_B64 is not set" >&2
exit 2
echo "[warn] MIRROR_SIGN_KEY_B64 is not set; ci-sign.sh will fall back to embedded test key (non-production)." >&2
fi
# basic base64 sanity check
if ! printf "%s" "$MIRROR_SIGN_KEY_B64" | base64 -d >/dev/null 2>&1; then

7
scripts/mirror/ci-sign.sh
View File

@@ -1,6 +1,11 @@
#!/usr/bin/env bash
set -euo pipefail
: "${MIRROR_SIGN_KEY_B64:?set MIRROR_SIGN_KEY_B64 to base64-encoded Ed25519 PEM private key}"
# Allow CI to fall back to a deterministic test key when MIRROR_SIGN_KEY_B64 is unset.
DEFAULT_TEST_KEY_B64="LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1DNENBUUF3QlFZREsyVndCQ0lFSUhLbjhWMjJ5ZEpwbkZTY3k5VlNsdTczNXZBQ1NFdFFIWlBRR3pSNzcyUGcKLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo="
if [[ -z "${MIRROR_SIGN_KEY_B64:-}" ]]; then
echo "[warn] MIRROR_SIGN_KEY_B64 not set; using embedded test key (non-production) for CI signing" >&2
MIRROR_SIGN_KEY_B64="$DEFAULT_TEST_KEY_B64"
fi
ROOT=$(cd "$(dirname "$0")/../.." && pwd)
KEYDIR="$ROOT/out/mirror/thin/tuf/keys"
mkdir -p "$KEYDIR"