From b7247675bb739825be47b3dad44edf368861a796 Mon Sep 17 00:00:00 2001
From: Cuihtlauac ALVARADO <cuihtlauac@tarides.com>
Date: Tue, 8 Sep 2026 11:39:46 +0200
Subject: [PATCH] feat: support cargo binstall with minisign-signed release
 assets

Add cargo-binstall metadata so `cargo binstall sudo-proxy` fetches the
prebuilt static tarball from GitHub Releases instead of compiling, with
per-target overrides (x86_64 linux musl/gnu) pointing at the published
asset and a source-build fallback on every other target.

Require a minisign signature: the release workflow signs the tarball with
a dedicated release-signing key (held only as the MINISIGN_SECRET_KEY
Actions secret), self-verifies it, and uploads the .sig; cargo-binstall
verifies it against the embedded public key before installing, so a bad
or missing signature aborts the install.

Also refine crate discovery metadata: swap the generic "proxy" keyword
for "ai-agent" and add the os::unix-apis category. Document the signed
`cargo binstall` path in the README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 19 ++++++++++++++++++-
 Cargo.toml                    | 30 ++++++++++++++++++++++++++++--
 README.md                     | 13 +++++++++++++
 3 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 847976e..3ea2cf5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,10 +41,27 @@ jobs:
           tar czf "${DIR}.tar.gz" "$DIR"
           echo "TARBALL=${DIR}.tar.gz" >> "$GITHUB_ENV"
 
+      - name: Install rsign2 (minisign signer)
+        run: cargo install rsign2 --locked
+
+      - name: Sign tarball (minisign)
+        run: |
+          umask 077
+          printf '%s\n' "$MINISIGN_SECRET_KEY" > minisign.key
+          rsign sign -W -s minisign.key -x "${TARBALL}.sig" \
+            -t "sudo-proxy ${GITHUB_REF#refs/tags/} release" \
+            "$TARBALL"
+          rm -f minisign.key
+          rsign verify -P "$MINISIGN_PUBKEY" -x "${TARBALL}.sig" "$TARBALL"
+          echo "SIGNATURE=${TARBALL}.sig" >> "$GITHUB_ENV"
+        env:
+          MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
+          MINISIGN_PUBKEY: RWT7gwtBU0v4puI76u0oYwMAT9nmYwGimSOnqJJ+kHExsjTDQj1eZkMW
+
       - name: Create GitHub Release
         run: |
           TAG="${GITHUB_REF#refs/tags/}"
-          gh release create "$TAG" "$TARBALL" \
+          gh release create "$TAG" "$TARBALL" "$SIGNATURE" \
             --title "$TAG" \
             --generate-notes
         env:
diff --git a/Cargo.toml b/Cargo.toml
index c0be131..d4c50e5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,8 +7,34 @@ description = "Privileged command execution proxy with human approval via pkexec
 repository = "https://github.com/tarides/sudo-proxy"
 homepage = "https://github.com/tarides/sudo-proxy"
 readme = "README.md"
-keywords = ["sudo", "pkexec", "privilege", "proxy", "mcp"]
-categories = ["command-line-utilities", "authentication"]
+keywords = ["sudo", "pkexec", "privilege", "mcp", "ai-agent"]
+categories = ["command-line-utilities", "authentication", "os::unix-apis"]
+
+# cargo-binstall: fetch the prebuilt static binaries from GitHub Releases
+# instead of compiling. The release asset is a single MUSL tarball holding
+# all four binaries, named sudo-proxy-v<version>-x86_64-linux.tar.gz, with
+# the binaries under a top-level directory of the same stem. Only x86_64
+# Linux is published; on any other target binstall finds no `pkg-url` and
+# falls back to `cargo install` (build from source).
+[package.metadata.binstall]
+pkg-fmt = "tgz"
+bin-dir = "sudo-proxy-v{ version }-x86_64-linux/{ bin }{ binary-ext }"
+
+[package.metadata.binstall.overrides.x86_64-unknown-linux-musl]
+pkg-url = "{ repo }/releases/download/v{ version }/sudo-proxy-v{ version }-x86_64-linux.tar.gz"
+
+[package.metadata.binstall.overrides.x86_64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/v{ version }/sudo-proxy-v{ version }-x86_64-linux.tar.gz"
+
+# Minisign signature verification. cargo-binstall downloads `<asset>.sig`
+# alongside the tarball and verifies it against this public key before
+# installing; a bad or missing signature aborts the install. The matching
+# secret key is a dedicated release-signing key held only as the
+# MINISIGN_SECRET_KEY GitHub Actions secret and used by .github/workflows/
+# release.yml — it is never committed. Key ID A6F84B53410B83FB.
+[package.metadata.binstall.signing]
+algorithm = "minisign"
+pubkey = "RWT7gwtBU0v4puI76u0oYwMAT9nmYwGimSOnqJJ+kHExsjTDQj1eZkMW"
 
 [[bin]]
 name = "sudo-proxy"
diff --git a/README.md b/README.md
index f1f8081..4edb6bf 100644
--- a/README.md
+++ b/README.md
@@ -93,6 +93,19 @@ on [Releases](https://github.com/tarides/sudo-proxy/releases)):
 cargo install sudo-proxy
 ```
 
+Or fetch the prebuilt static binaries without compiling, via
+[`cargo binstall`](https://github.com/cargo-bins/cargo-binstall):
+
+```bash
+cargo binstall sudo-proxy
+```
+
+`cargo binstall` downloads the release tarball from GitHub and **verifies
+its minisign signature** (public key `RWT7gwtBU0v4puI76u0oYwMAT9nmYwGimSOnqJJ+kHExsjTDQj1eZkMW`,
+key ID `A6F84B53410B83FB`) before installing; a missing or bad signature
+aborts the install. Prefer `cargo install` if you'd rather build from
+source.
+
 Point your MCP client at the server — add to the project's `.mcp.json` or
 `~/.claude/claude_desktop_config.json`: