nordisk/heimdall

guests/verify-bundle/examples/sign.rs

// SPDX-License-Identifier: AGPL-3.0-only
//! `sign <material-dir> <dist-dir>`: sign the three release components in
//! `<dist-dir>` the way Holger's own wasm plugins are signed. `<material-dir>`
//! holds what `dwarves sign-cert issue --purpose plugin` wrote beside the root
//! seed: `plugin-signing.pk8` (0600), `plugin-signing.der`, `korp-root-ca.der`.
//! Writes each `<name>.wasm.p7s`, verifies it against `korp-root-ca.der`, and
//! loads all three, pinned, in the real Heimdall host whose only trust root is
//! that file; any failure removes every signature it wrote. Run it on the box
//! that holds the material, outside any container. Heimdall is a defensive
//! sandbox.

#[path = "../tools/release.rs"]
mod release;

use std::path::Path;
use std::process::ExitCode;

fn main() -> ExitCode {
    let args: Vec<String> = std::env::args().skip(1).collect();
    if args.len() != 2 || args.iter().any(|a| a.starts_with('-')) {
        eprintln!("usage: sign <material-dir> <dist-dir>");
        return ExitCode::from(2);
    }
    match release::sign(Path::new(&args[0]), Path::new(&args[1])) {
        Ok(done) => {
            for s in done {
                println!(
                    "{}  signer \"{}\"  blake3 {}  sha256 {}",
                    s.signature.display(),
                    s.signer,
                    s.blake3,
                    s.sha256
                );
            }
            println!(
                "signed, verified against korp-root-ca.der, loaded pinned in the Heimdall host"
            );
            ExitCode::SUCCESS
        }
        Err(e) => {
            eprintln!("sign: {e}");
            ExitCode::FAILURE
        }
    }
}