Require signed agent releases (Refs #64)

src/lib/server/auth/guard.ts

@@ -20,7 +20,8 @@ function publicAsset(routeId: string | null, path: string, method: string) {
                 '/agent/ec-agent.py',
                 '/agent/ec-agent-update.py',
                 '/agent/install.sh',
-                '/agent/manifest.json'
+                '/agent/manifest.json',
+                '/agent/manifest.json.sig'
             ].includes(path))
     );
 }

src/lib/server/hosts/http.ts

@@ -70,5 +70,5 @@ export function hostApiError(cause: unknown): Response {
 export function installerCommand(controller: string, token: string): string {
     const origin = new URL(controller).origin;
     const quote = (value: string) => "'" + value.replaceAll("'", "'\\''") + "'";
-    return `curl --fail --silent --show-error --proto '=https' ${quote(origin + '/api/agent/install.sh')} | sudo bash -s -- --controller ${quote(origin)} --token ${quote(token)}`;
+    return `sudo bash ./electric-cherry-install.sh --controller ${quote(origin)} --token ${quote(token)}`;
 }

src/lib/server/hosts/releases.ts

@@ -3,7 +3,8 @@ import { resolve } from 'node:path';
 
 /** adapter-node copies public assets to build/client; Vite serves static in development. */
 export async function agentReleaseAsset(
-    file: 'install.sh' | 'ec-agent.py' | 'ec-agent-update.py' | 'manifest.json'
+    file:
+        'install.sh' | 'ec-agent.py' | 'ec-agent-update.py' | 'manifest.json' | 'manifest.json.sig'
 ): Promise<string> {
     // A prior production build must never shadow a freshly packaged development release.
     if (process.env.NODE_ENV === 'development')