From 702de24e28d4834192327c8a3debb535cc991bd9 Mon Sep 17 00:00:00 2001
From: Vantz Stockwell <vstockwell@predator-mini.local>
Date: Thu, 11 Jun 2026 20:18:08 -0400
Subject: [PATCH] fix(ci): fetch minisign static binary (not in bullseye apt);
 bump alpha.7
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

alpha.6 signing failed: 'E: Unable to locate package minisign' —
minisign isn't packaged for node:20-bullseye. Download the official
static linux binary instead. Forward to alpha.7 (alpha.6 published
nothing).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitea/workflows/build-host-agent.yml | 9 +++++++--
 corrosion-host-agent/Cargo.toml       | 2 +-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/build-host-agent.yml b/.gitea/workflows/build-host-agent.yml
index be506a0..4cfc3a4 100644
--- a/.gitea/workflows/build-host-agent.yml
+++ b/.gitea/workflows/build-host-agent.yml
@@ -75,12 +75,17 @@ jobs:
             echo "::error::MINISIGN_SECRET_KEY secret is not set — refusing to publish unsigned agent artifacts."
             exit 1
           fi
-          apt-get install -y -qq minisign
+          # minisign isn't packaged for bullseye — fetch the official static binary.
+          curl -sSL https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz -o /tmp/minisign.tgz
+          tar -xzf /tmp/minisign.tgz -C /tmp
+          MINISIGN="$(find /tmp -type f -name minisign -path '*linux*' | head -1)"
+          chmod +x "$MINISIGN"
+          "$MINISIGN" -v
           printf '%s\n' "$MINISIGN_SECRET_KEY" > /tmp/sign.key
           cd corrosion-host-agent/bin
           # Passwordless key (-W generated); feed empty stdin so it never blocks.
           for f in corrosion-host-agent-linux-amd64 corrosion-host-agent-windows-amd64.exe checksums.txt; do
-            minisign -S -s /tmp/sign.key -m "$f" -x "$f.minisig" < /dev/null
+            "$MINISIGN" -S -s /tmp/sign.key -m "$f" -x "$f.minisig" < /dev/null
           done
           rm -f /tmp/sign.key
           echo "signed: $(ls *.minisig)"
diff --git a/corrosion-host-agent/Cargo.toml b/corrosion-host-agent/Cargo.toml
index 8ba51b4..8f6d71b 100644
--- a/corrosion-host-agent/Cargo.toml
+++ b/corrosion-host-agent/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "corrosion-host-agent"
-version = "2.0.0-alpha.6"
+version = "2.0.0-alpha.7"
 edition = "2021"
 description = "Corrosion Host Agent — multi-game ops runtime for self-hosted game servers"
 license = "UNLICENSED"