Commit Graph

3 Commits (192fa6f05d12cfadaa3044d57e0a74f2b9f46a55)

Author SHA1 Message Date
Percy Wegmann 192fa6f05d {cmd/dist,release/dist}: add support for intermediary QNAP signing certificates
Updates #23528

Signed-off-by: Percy Wegmann <percy@tailscale.com>
4 months ago
Percy Wegmann 9c39296ab5 release/dist/qnap: verify code signing
This pulls in a change from github.com/tailscale/QDK to verify code signing
when using QNAP_SIGNING_SCRIPT.

It also upgrades to the latest Google Cloud PKCS#11 library, and reorders
the Dockerfile to allow for more efficient future upgrades to the included QDK.

Updates tailscale/corp#23528

Signed-off-by: Percy Wegmann <percy@tailscale.com>
4 months ago
Percy Wegmann 26f31f73f4 cmd/dist,release/dist: sign QNAP builds with a Google Cloud hosted key
QNAP now requires builds to be signed with an HSM.

This removes support for signing with a local keypair.

This adds support for signing with a Google Cloud hosted key.

The key should be an RSA key with protection level `HSM` and that uses PSS padding and a SHA256 digest.

The GCloud project, keyring and key name are passed in as command-line arguments.

The GCloud credentials and the PEM signing certificate are passed in as Base64-encoded command-line arguments.

Updates tailscale/corp#23528

Signed-off-by: Percy Wegmann <percy@tailscale.com>
8 months ago