root/goodbuddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: unify GoodBuddy release signing identity
Cross-platform packages / Publish GitHub and OSS release (push) Canceled after 0s
Details
Cross-platform packages / Validate source (push) Canceled after 0s
Details
Cross-platform packages / Authorize desktop packaging (push) Canceled after 0s
Details
Cross-platform packages / linux arm64 (push) Canceled after 0s
Details
Cross-platform packages / macos arm64 (push) Canceled after 0s
Details
Cross-platform packages / windows arm64 (push) Canceled after 0s
Details
Cross-platform packages / linux x64 (push) Canceled after 0s
Details
Cross-platform packages / macos x64 (push) Canceled after 0s
Details
Cross-platform packages / windows x64 (push) Canceled after 0s
Details
GoodBuddy Agents / Validate Agent source (push) Canceled after 0s
Details
GoodBuddy Agents / Build Linux arm64 Agent (push) Canceled after 0s
Details
GoodBuddy Agents / Build Linux x64 Agent (push) Canceled after 0s
Details

Browse Source 
Use one generic GoodBuddy Ed25519 identity for the Agent bundle, bundled Runtime, outer package, and signed catalog while preserving each layer's existing signature domain.

Rename the production Environment contract to GOODBUDDY_SIGNING_*, register the matching production public key, and keep desktop and branch CI workflows isolated from the private key.
This commit is contained in:
mesalogo
2026-08-25 22:02:47 +08:00
parent bcd347e092
commit 0cb7007429
12 changed files with 47 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/agent-release.yml
+6 -6
View File
@@ -189,10 +189,10 @@ jobs:
}
NODE
- name: Preflight production Agent signing identity
- name: Preflight production GoodBuddy signing identity
shell: bash
env:
GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
GOODBUDDY_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_SIGNING_KEY_ID }}
run: |
set -euo pipefail
node build/agent-bundle.cjs preflight
@@ -202,8 +202,8 @@ jobs:
env:
AGENT_ARCH: ${{ matrix.arch }}
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}
GOODBUDDY_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_SIGNING_KEY_ID }}
GOODBUDDY_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_SIGNING_PRIVATE_KEY }}
NODE_ARCHIVE: ${{ steps.inputs.outputs.node-archive }}
OPENCODE_ARCHIVE: ${{ steps.inputs.outputs.opencode-archive }}
run: |
@@ -344,8 +344,8 @@ jobs:
env:
AGENT_VERSION: ${{ needs.authorize.outputs.version }}
PREVIOUS_ARGUMENTS: ${{ steps.previous.outputs.arguments }}
GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}
GOODBUDDY_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_SIGNING_KEY_ID }}
GOODBUDDY_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_SIGNING_PRIVATE_KEY }}
run: |
set -euo pipefail
generated_at="$(git show -s --format=%cI "$GITHUB_SHA")"