Require signed agent releases (Refs #64)

2026-10-09 20:36:18 -04:00
parent df0d395138
commit 6f71822d41
24 changed files with 984 additions and 107 deletions
@@ -608,6 +608,12 @@
                            >
                        </div>
                        {#if enrollment}<p>Expires {$timeFormat.dateTime(enrollment.expiresAt)}</p>
+                            <p>
+                                Use a reviewed <code>electric-cherry-install.sh</code> from your
+                                release publisher and provision its public signing key at
+                                <code>/etc/electric-cherry/release-signing.gpg</code>. Obtain both
+                                through a trusted channel independent of this controller.
+                            </p>
                            <pre>{enrollment.command}</pre>{/if}{:else}<p>
                            Administrators manage enrollment and agent credentials.
                        </p>{/if}