root/goodbuddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: unify GoodBuddy release signing identity
Cross-platform packages / Publish GitHub and OSS release (push) Canceled after 0s
Details
Cross-platform packages / Validate source (push) Canceled after 0s
Details
Cross-platform packages / Authorize desktop packaging (push) Canceled after 0s
Details
Cross-platform packages / linux arm64 (push) Canceled after 0s
Details
Cross-platform packages / macos arm64 (push) Canceled after 0s
Details
Cross-platform packages / windows arm64 (push) Canceled after 0s
Details
Cross-platform packages / linux x64 (push) Canceled after 0s
Details
Cross-platform packages / macos x64 (push) Canceled after 0s
Details
Cross-platform packages / windows x64 (push) Canceled after 0s
Details
GoodBuddy Agents / Validate Agent source (push) Canceled after 0s
Details
GoodBuddy Agents / Build Linux arm64 Agent (push) Canceled after 0s
Details
GoodBuddy Agents / Build Linux x64 Agent (push) Canceled after 0s
Details

Browse Source 
Use one generic GoodBuddy Ed25519 identity for the Agent bundle, bundled Runtime, outer package, and signed catalog while preserving each layer's existing signature domain.

Rename the production Environment contract to GOODBUDDY_SIGNING_*, register the matching production public key, and keep desktop and branch CI workflows isolated from the private key.
This commit is contained in:
mesalogo
2026-08-25 22:02:47 +08:00
parent bcd347e092
commit 0cb7007429
12 changed files with 47 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture/remote-host-and-goodbuddy-agent-design.md
+1 -1
View File
@@ -216,7 +216,7 @@ Renderer 暴露固定方法名、数字 RPC code 和有界 service code，不转
`.remote-runtime-resources` 或任何可安装 Linux 远端 payload。
- `build/agent-package.cjs` 在对应原生 Linux 架构组装确定性 `.gbagent`，外层签名覆盖
描述符和每个内部文件身份；内部 Agent 与 Runtime 仍分别使用既有签名 manifest 和 lock
校验，但所有 production 层统一使用一组 GoodBuddy Agent 发布身份并通过签名域区分用途，
校验，但所有 production 层统一使用一组 GoodBuddy 通用发布身份并通过签名域区分用途，
不要求内部 Runtime 单独配置密钥。`build/agent-catalog.cjs` 为双架构包生成签名累计目录，
拒绝同一版本/架构改变字节。
- `.github/workflows/agents.yml` 只使用进程内临时测试 key 做分支/PR 原生验证，不发布。