The verify step curl-fetched the public key anonymously from the
dev repo's raw URL; since that repo went private the fetch 404s
and every signed release died at verification. Embed the PUBLIC
key verbatim (same pattern as the platform's sync-mirror.sh) so
the workflow is self-contained. Keep in lockstep with
infra/cosign/official.pub on key rotation.
Signed-off-by: flemming-it <sf@flemming.it>
The vendored sign.yml predated the product rename: it installed
and invoked the old CLI name, packed a .fai bundle, and verified
against the renamed fai/platform repo URL — every tag build died
on the missing binary. Align with the platform's current
sign-bundle template: chain CLI, .chain bundle extension,
fai/chain-private raw URL for official.pub.
Signed-off-by: flemming-it <sf@flemming.it>
The product is Ch∆In; the old 'F∆I Platform' name survived in module
docs/manifests. Generic 'platform' terms left untouched.
Signed-off-by: flemming-it <sf@flemming.it>
Drop-in from fai/platform .forgejo/workflow-templates/
sign-bundle-keypair.yml. Triggers on v*.*.* tag push: builds
wasm32-wasip2, fetches the fai CLI from get.fai.flemming.ai,
packs the bundle, ECDSA P-256 signs it against the org-level
Forgejo secret FAI_SIGNING_KEY, round-trip-verifies against
infra/cosign/official.pub on fai/platform main, and attaches
bundle + .sig to the Forgejo Release via the API.
Signed-off-by: flemming-it <sf@flemming.it>
