mirror of
https://github.com/BetterCorp/BetterFrame.git
synced 2026-05-26 17:56:34 +00:00
65 lines
2.5 KiB
PowerShell
65 lines
2.5 KiB
PowerShell
|
# Generate the RAUC signing-cert PAIR used to sign OS bundles.
|
||
|
|
# Run ONCE per deployment. Requires OpenSSL in PATH (e.g. via Git for Windows,
|
||
|
|
# choco install openssl, or winget install ShiningLight.OpenSSL).
|
||
|
|
#
|
||
|
|
# Outputs (written to ./rauc-signing/):
|
||
|
|
# ca-cert.pem - embed in kiosk image at /etc/rauc/keyring.pem
|
||
|
|
# ca-key.pem - KEEP OFFLINE. Only used to issue new signing certs.
|
||
|
|
# signing-cert.pem - GitHub Actions secret BF_RAUC_SIGNING_CERT
|
||
|
|
# signing-key.pem - GitHub Actions secret BF_RAUC_SIGNING_KEY
|
||
|
|
|
||
|
|
param(
|
||
|
|
[string]$OutDir = ".\rauc-signing"
|
||
|
|
)
|
||
|
|
|
||
|
|
$ErrorActionPreference = "Stop"
|
||
|
|
|
||
|
|
if (-not (Get-Command openssl -ErrorAction SilentlyContinue)) {
|
||
|
|
Write-Error "openssl not found in PATH. Install via: winget install ShiningLight.OpenSSL"
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
if (Test-Path "$OutDir\ca-cert.pem") {
|
||
|
|
Write-Error "Refusing to overwrite existing keys at $OutDir - delete first if intentional"
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
|
||
|
|
Push-Location $OutDir
|
||
|
|
|
||
|
|
try {
|
||
|
|
Write-Host "==> Generating CA (Ed25519, 10 year validity)"
|
||
|
|
openssl genpkey -algorithm ED25519 -out ca-key.pem
|
||
|
|
openssl req -new -x509 -days 3650 -key ca-key.pem `
|
||
|
|
-subj "/CN=BetterFrame RAUC CA" -out ca-cert.pem
|
||
|
|
|
||
|
|
Write-Host "==> Generating signing cert (Ed25519, 2 year validity)"
|
||
|
|
openssl genpkey -algorithm ED25519 -out signing-key.pem
|
||
|
|
openssl req -new -key signing-key.pem `
|
||
|
|
-subj "/CN=BetterFrame RAUC Signing" -out signing.csr
|
||
|
|
openssl x509 -req -in signing.csr -CA ca-cert.pem -CAkey ca-key.pem `
|
||
|
|
-CAcreateserial -days 730 -out signing-cert.pem
|
||
|
|
|
||
|
|
Remove-Item -Force signing.csr, ca-cert.srl -ErrorAction SilentlyContinue
|
||
|
|
|
||
|
|
Write-Host ""
|
||
|
|
Write-Host "==> Done. Next steps:"
|
||
|
|
Write-Host ""
|
||
|
|
Write-Host "1. Commit CA cert into repo:"
|
||
|
|
Write-Host " Copy-Item $(Resolve-Path ca-cert.pem) ..\deploy\rauc\ca-cert.pem"
|
||
|
|
Write-Host " git add deploy/rauc/ca-cert.pem"
|
||
|
|
Write-Host " git commit -m 'chore(rauc): commit CA cert'"
|
||
|
|
Write-Host " git push"
|
||
|
|
Write-Host ""
|
||
|
|
Write-Host "2. Set GitHub Actions secrets (Settings > Secrets > Actions):"
|
||
|
|
Write-Host " BF_RAUC_SIGNING_CERT = contents of $(Resolve-Path signing-cert.pem)"
|
||
|
|
Write-Host " BF_RAUC_SIGNING_KEY = contents of $(Resolve-Path signing-key.pem)"
|
||
|
|
Write-Host ""
|
||
|
|
Write-Host "3. STORE ca-key.pem OFFLINE. Only needed to issue replacement signing certs."
|
||
|
|
Write-Host ""
|
||
|
|
Get-ChildItem | Format-Table Name, Length
|
||
|
|
}
|
||
|
|
finally {
|
||
|
|
Pop-Location
|
||
|
|
}
|