Switch release signing to RSA-2048/SHA-256 for openssl compatibility

.github/workflows/release.yml

@@ -104,14 +104,14 @@ jobs:
         working-directory: artifacts
         run: sha256sum * > SHA256SUMS.txt
 
-      - name: sign the checksums (Ed25519)
+      - name: sign the checksums (RSA-2048/SHA-256)
         env:
           KEY: ${{ secrets.SCIMESH_SIGNING_KEY }}
         working-directory: artifacts
         run: |
           if [ -n "$KEY" ]; then
             printf '%s\n' "$KEY" > /tmp/scimesh-sign-key.pem
-            openssl dgst -sign /tmp/scimesh-sign-key.pem \
+            openssl dgst -sha256 -sign /tmp/scimesh-sign-key.pem \
               -out SHA256SUMS.txt.sig SHA256SUMS.txt
             echo "signed SHA256SUMS.txt"
           else

install.ps1

@@ -11,7 +11,7 @@ $ErrorActionPreference = "Stop"
 # Public half of the Ed25519 key that signs SHA256SUMS.txt in releases (see
 # install.sh). Verification needs the openssl binary; without it the installer
 # falls back to checksum verification with a warning.
-$ScimeshSigningPubKey = "MCowBQYDK2VwAyEAZfOXciD5AIvC6/1YXjOp4KjA0DDNWKZ0nQ0dx76XUUw="
+$ScimeshSigningPubKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA01rjmCme4W4zAgBwbO00LvwgnB1srlg0LbooRG8ej7iNxzOtJ8vjRFR2Cu7z7OKjoDo9/0GW3pvcwB+ndBB6yUwht33IRwdsnbioBI4M7LL+yC1ubi4fJ5bigOgZ9VsVqKdU3T9GYxmrfJF1UexiOg6HjoRLO3V4Id+3e/CiI5Sr8UMfJMXUfO3uiEs9RpstxpP1V/UU4YDicTF0QjkOESimEwwXBG4z3VcVmQtqkb7Q3413iekTdQ13093GKAKp0Q2ia1TpB2su6ELUhHAqhmK88cJ73Opy1uEVye0twov4BFTu5GkxgazNTuU//aYVWVpd/NAlD+VVSmpDsbfBBQIDAQAB"
 
 $Repo = "emil28092005/SciMesh"
 $Component = if ($env:SCIMESH_COMPONENT) { $env:SCIMESH_COMPONENT } else { "coordinator" }
@@ -81,9 +81,9 @@ if ($env:SCIMESH_SKIP_VERIFY -ne "1") {
             try {
                 Invoke-WebRequest -Uri $SumUrl -OutFile $SumFile
                 Invoke-WebRequest -Uri "$SumUrl.sig" -OutFile $SigFile
-                & $openssl.Source dgst -verify $PubFile -signature $SigFile $SumFile 2>&1 | Out-Null
+                & $openssl.Source dgst -sha256 -verify $PubFile -signature $SigFile $SumFile 2>&1 | Out-Null
                 if ($LASTEXITCODE -eq 0) {
-                    Write-Host "Signature verified (Ed25519)"
+                    Write-Host "Signature verified (RSA-2048/SHA-256)"
                 } else {
                     Remove-Item -Force "$Target.tmp"
                     throw "the release signature does not verify; the download channel may be tampered with"

install.sh

@@ -19,7 +19,7 @@ REPO="emil28092005/SciMesh"
 # private half lives in the repository secret SCIMESH_SIGNING_KEY. Verification
 # uses openssl when available; without openssl the installer falls back to the
 # checksum-only check with a warning.
-SCIMESH_SIGNING_PUBKEY='MCowBQYDK2VwAyEAZfOXciD5AIvC6/1YXjOp4KjA0DDNWKZ0nQ0dx76XUUw='
+SCIMESH_SIGNING_PUBKEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA01rjmCme4W4zAgBwbO00LvwgnB1srlg0LbooRG8ej7iNxzOtJ8vjRFR2Cu7z7OKjoDo9/0GW3pvcwB+ndBB6yUwht33IRwdsnbioBI4M7LL+yC1ubi4fJ5bigOgZ9VsVqKdU3T9GYxmrfJF1UexiOg6HjoRLO3V4Id+3e/CiI5Sr8UMfJMXUfO3uiEs9RpstxpP1V/UU4YDicTF0QjkOESimEwwXBG4z3VcVmQtqkb7Q3413iekTdQ13093GKAKp0Q2ia1TpB2su6ELUhHAqhmK88cJ73Opy1uEVye0twov4BFTu5GkxgazNTuU//aYVWVpd/NAlD+VVSmpDsbfBBQIDAQAB'
 
 COMPONENT="${1:-coordinator}"
 VERSION="${SCIMESH_VERSION:-latest}"
@@ -80,8 +80,8 @@ if [ "${SCIMESH_SKIP_VERIFY:-0}" != "1" ]; then
         && curl -fsSL -o "$SIGFILE" "https://github.com/${REPO}/releases/download/${VERSION}/SHA256SUMS.txt.sig" 2>/dev/null; then
       PUBKEY_FILE=$(mktemp)
       printf '%s\n' '-----BEGIN PUBLIC KEY-----' "$SCIMESH_SIGNING_PUBKEY" '-----END PUBLIC KEY-----' > "$PUBKEY_FILE"
-      if openssl dgst -verify "$PUBKEY_FILE" -signature "$SIGFILE" "$SUMFILE" >/dev/null 2>&1; then
-        echo "Signature verified (Ed25519)"
+      if openssl dgst -sha256 -verify "$PUBKEY_FILE" -signature "$SIGFILE" "$SUMFILE" >/dev/null 2>&1; then
+        echo "Signature verified (RSA-2048/SHA-256)"
       else
         rm -f "$PUBKEY_FILE" "$SIGFILE" "$SUMFILE" "$TARGET.tmp"
         echo "ERROR: the release signature does not verify; the download channel may be tampered with." >&2