feat: cargo binstall with minisign-signed release assets - #44
Open
cuihtlauac wants to merge 1 commit into
Open
Conversation
Add cargo-binstall metadata so `cargo binstall sudo-proxy` fetches the prebuilt static tarball from GitHub Releases instead of compiling, with per-target overrides (x86_64 linux musl/gnu) pointing at the published asset and a source-build fallback on every other target. Require a minisign signature: the release workflow signs the tarball with a dedicated release-signing key (held only as the MINISIGN_SECRET_KEY Actions secret), self-verifies it, and uploads the .sig; cargo-binstall verifies it against the embedded public key before installing, so a bad or missing signature aborts the install. Also refine crate discovery metadata: swap the generic "proxy" keyword for "ai-agent" and add the os::unix-apis category. Document the signed `cargo binstall` path in the README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
cargo binstallinstall path backed by signature verification, plus small crate-discovery metadata tweaks.Changes
Cargo.toml[package.metadata.binstall]— fetch the prebuilt static tarball from GitHub Releases;pkg-urloverrides forx86_64-unknown-linux-{musl,gnu}point at the published asset,bin-dirresolves all four binaries under the tarball's top-level dir. Any other target has nopkg-urland falls back tocargo install.[package.metadata.binstall.signing]— minisign, with the embedded public key.cargo binstalldownloads<asset>.sigand verifies it before installing; a bad/missing signature aborts.proxyforai-agent; addedos::unix-apiscategory..github/workflows/release.yml— installrsign2, sign the tarball with the dedicated release key (MINISIGN_SECRET_KEYActions secret), self-verify against the public key (fails the release if signing is wrong), and upload the.sigalongside the tarball.README.md— document the signedcargo binstallpath in Quickstart.Key model
A dedicated release-signing minisign keypair (key ID
A6F84B53410B83FB). Public key is embedded inCargo.toml(public by design); the secret key is held only as theMINISIGN_SECRET_KEYrepo secret and used solely by the release workflow.Verification
Signed the real v1.0.0 tarball and verified against the public key (pass); tampered tarball correctly rejected.
cargo metadatareads the signing block;release.ymlis valid YAML.Notes
cargo binstallfalls back to source until then — no broken intermediate state.cargo install rsign2(release-only).🤖 Generated with Claude Code