6b3e805ac2
Agent only ever runs a binary whose minisign signature verifies against
the EMBEDDED public key. NATS host.cmd func 'update' {url}: download
binary + .minisig from the CDN -> verify against embedded pubkey ->
atomic swap (.old rollback) -> relaunch. URL allowlist (https + cdn.
corrosionmgmt.com only, rejects userinfo-bypass), 100MiB cap. Closes the
supply-chain hole: even a malicious CDN upload can't run unsigned.
CI: build-host-agent.yml signs every artifact with MINISIGN_SECRET_KEY
(Gitea secret) and publishes .minisig alongside; the step FAILS the
build if the secret is absent (refuses to ship unsigned). Bumped to
alpha.6.
6 deterministic tests (accept valid / reject tampered+garbage+empty sig,
URL allowlist incl userinfo-bypass, atomic swap+rollback). Fixtures
signed with the real release key so tests need no key at runtime. Full
suite 50/50 green; musl + native build clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
46 lines
1.2 KiB
TOML
46 lines
1.2 KiB
TOML
[package]
|
|
name = "corrosion-host-agent"
|
|
version = "2.0.0-alpha.6"
|
|
edition = "2021"
|
|
description = "Corrosion Host Agent — multi-game ops runtime for self-hosted game servers"
|
|
license = "UNLICENSED"
|
|
publish = false
|
|
|
|
[[bin]]
|
|
name = "corrosion-host-agent"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
tokio = { version = "1", features = ["full"] }
|
|
tokio-util = { version = "0.7", features = ["rt"] }
|
|
futures = "0.3"
|
|
async-nats = "0.37"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
toml = "0.8"
|
|
sysinfo = "0.33"
|
|
chrono = { version = "0.4", features = ["serde", "clock"] }
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
|
|
anyhow = "1"
|
|
clap = { version = "4.5", features = ["derive"] }
|
|
rand = "0.8"
|
|
tokio-tungstenite = "0.24"
|
|
minisign-verify = "0.2.5"
|
|
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"] }
|
|
|
|
[target.'cfg(unix)'.dependencies]
|
|
libc = "0.2"
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
|
|
# Size-optimized release: single static binary living next to RAM-heavy game
|
|
# servers. Panic stays 'unwind' so a panicking task surfaces through its
|
|
# JoinHandle instead of killing the whole agent.
|
|
[profile.release]
|
|
opt-level = "s"
|
|
lto = true
|
|
codegen-units = 1
|
|
strip = true
|