feat: cargo binstall with minisign-signed release assets

.github/workflows/release.yml

@@ -41,10 +41,27 @@ jobs:
           tar czf "${DIR}.tar.gz" "$DIR"
           echo "TARBALL=${DIR}.tar.gz" >> "$GITHUB_ENV"
 
+      - name: Install rsign2 (minisign signer)
+        run: cargo install rsign2 --locked
+
+      - name: Sign tarball (minisign)
+        run: |
+          umask 077
+          printf '%s\n' "$MINISIGN_SECRET_KEY" > minisign.key
+          rsign sign -W -s minisign.key -x "${TARBALL}.sig" \
+            -t "sudo-proxy ${GITHUB_REF#refs/tags/} release" \
+            "$TARBALL"
+          rm -f minisign.key
+          rsign verify -P "$MINISIGN_PUBKEY" -x "${TARBALL}.sig" "$TARBALL"
+          echo "SIGNATURE=${TARBALL}.sig" >> "$GITHUB_ENV"
+        env:
+          MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
+          MINISIGN_PUBKEY: RWT7gwtBU0v4puI76u0oYwMAT9nmYwGimSOnqJJ+kHExsjTDQj1eZkMW
+
       - name: Create GitHub Release
         run: |
           TAG="${GITHUB_REF#refs/tags/}"
-          gh release create "$TAG" "$TARBALL" \
+          gh release create "$TAG" "$TARBALL" "$SIGNATURE" \
             --title "$TAG" \
             --generate-notes
         env:

Cargo.toml

@@ -7,8 +7,34 @@ description = "Privileged command execution proxy with human approval via pkexec
 repository = "https://github.com/tarides/sudo-proxy"
 homepage = "https://github.com/tarides/sudo-proxy"
 readme = "README.md"
-keywords = ["sudo", "pkexec", "privilege", "proxy", "mcp"]
-categories = ["command-line-utilities", "authentication"]
+keywords = ["sudo", "pkexec", "privilege", "mcp", "ai-agent"]
+categories = ["command-line-utilities", "authentication", "os::unix-apis"]
+
+# cargo-binstall: fetch the prebuilt static binaries from GitHub Releases
+# instead of compiling. The release asset is a single MUSL tarball holding
+# all four binaries, named sudo-proxy-v<version>-x86_64-linux.tar.gz, with
+# the binaries under a top-level directory of the same stem. Only x86_64
+# Linux is published; on any other target binstall finds no `pkg-url` and
+# falls back to `cargo install` (build from source).
+[package.metadata.binstall]
+pkg-fmt = "tgz"
+bin-dir = "sudo-proxy-v{ version }-x86_64-linux/{ bin }{ binary-ext }"
+
+[package.metadata.binstall.overrides.x86_64-unknown-linux-musl]
+pkg-url = "{ repo }/releases/download/v{ version }/sudo-proxy-v{ version }-x86_64-linux.tar.gz"
+
+[package.metadata.binstall.overrides.x86_64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/v{ version }/sudo-proxy-v{ version }-x86_64-linux.tar.gz"
+
+# Minisign signature verification. cargo-binstall downloads `<asset>.sig`
+# alongside the tarball and verifies it against this public key before
+# installing; a bad or missing signature aborts the install. The matching
+# secret key is a dedicated release-signing key held only as the
+# MINISIGN_SECRET_KEY GitHub Actions secret and used by .github/workflows/
+# release.yml — it is never committed. Key ID A6F84B53410B83FB.
+[package.metadata.binstall.signing]
+algorithm = "minisign"
+pubkey = "RWT7gwtBU0v4puI76u0oYwMAT9nmYwGimSOnqJJ+kHExsjTDQj1eZkMW"
 
 [[bin]]
 name = "sudo-proxy"

README.md

@@ -93,6 +93,19 @@ on [Releases](https://github.com/tarides/sudo-proxy/releases)):
 cargo install sudo-proxy
 ```
 
+Or fetch the prebuilt static binaries without compiling, via
+[`cargo binstall`](https://github.com/cargo-bins/cargo-binstall):
+
+```bash
+cargo binstall sudo-proxy
+```
+
+`cargo binstall` downloads the release tarball from GitHub and **verifies
+its minisign signature** (public key `RWT7gwtBU0v4puI76u0oYwMAT9nmYwGimSOnqJJ+kHExsjTDQj1eZkMW`,
+key ID `A6F84B53410B83FB`) before installing; a missing or bad signature
+aborts the install. Prefer `cargo install` if you'd rather build from
+source.
+
 Point your MCP client at the server — add to the project's `.mcp.json` or
 `~/.claude/claude_desktop_config.json`: