webnet/tailscale
1
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

cmd/dist,release/dist: sign QNAP builds with a Google Cloud hosted key

Browse Source 
QNAP now requires builds to be signed with an HSM.

This removes support for signing with a local keypair.

This adds support for signing with a Google Cloud hosted key.

The key should be an RSA key with protection level `HSM` and that uses PSS padding and a SHA256 digest.

The GCloud project, keyring and key name are passed in as command-line arguments.

The GCloud credentials and the PEM signing certificate are passed in as Base64-encoded command-line arguments.

Updates tailscale/corp#23528

Signed-off-by: Percy Wegmann <percy@tailscale.com>
This commit is contained in:
Percy Wegmann
2025-04-15 11:50:39 -05:00
committed by Percy Wegmann
parent 0c78f081a4
commit 26f31f73f4
5 changed files with 119 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
release/dist/qnap/targets.go
Vendored
+21 -6
View File
@@ -3,16 +3,31 @@
package qnap
import "tailscale.com/release/dist"
import (
"slices"
"tailscale.com/release/dist"
)
// Targets defines the dist.Targets for QNAP devices.
//
// If privateKeyPath and certificatePath are both provided non-empty,
// these targets will be signed for QNAP app store release with built.
func Targets(privateKeyPath, certificatePath string) []dist.Target {
// If all parameters are provided non-empty, then the build will be signed using
// a Google Cloud hosted key.
//
// gcloudCredentialsBase64 is the JSON credential for connecting to Google Cloud, base64 encoded.
// gcloudKeyring is the full path to the Google Cloud keyring containing the signing key.
// keyName is the name of the key.
// certificateBase64 is the PEM certificate to use in the signature, base64 encoded.
func Targets(gcloudCredentialsBase64, gcloudProject, gcloudKeyring, keyName, certificateBase64 string) []dist.Target {
var signerInfo *signer
if privateKeyPath != "" && certificatePath != "" {
signerInfo = &signer{privateKeyPath, certificatePath}
if !slices.Contains([]string{gcloudCredentialsBase64, gcloudProject, gcloudKeyring, keyName, certificateBase64}, "") {
signerInfo = &signer{
gcloudCredentialsBase64: gcloudCredentialsBase64,
gcloudProject: gcloudProject,
gcloudKeyring: gcloudKeyring,
keyName: keyName,
certificateBase64: certificateBase64,
}
}
return []dist.Target{
&target{