Refresh agent signing keys from repository (Refs #64)

src/lib/server/hosts/http.ts

@@ -70,5 +70,7 @@ export function hostApiError(cause: unknown): Response {
 export function installerCommand(controller: string, token: string): string {
     const origin = new URL(controller).origin;
     const quote = (value: string) => "'" + value.replaceAll("'", "'\\''") + "'";
-    return `sudo bash ./electric-cherry-install.sh --controller ${quote(origin)} --token ${quote(token)}`;
+    const installer =
+        'https://gitea.thewrightserver.net/josh/electric-cherry/raw/branch/main/agent/install.sh';
+    return `curl --proto '=https' --tlsv1.2 --fail --silent --show-error --connect-timeout 25 --max-time 120 ${quote(installer)} -o electric-cherry-install.sh && sudo bash ./electric-cherry-install.sh --controller ${quote(origin)} --token ${quote(token)}`;
 }

src/lib/ui/components/AddHostDrawer.svelte

@@ -53,10 +53,9 @@
                 {name} created. Run this command with administrator access on that machine.
             </p>
             <p>
-                First copy the reviewed installer from your release publisher to
-                <code>electric-cherry-install.sh</code> and provision the publisher's public signing
-                key at <code>/etc/electric-cherry/release-signing.gpg</code>. Obtain both through a
-                trusted channel independent of this controller.
+                This command downloads the installer from the public Electric Cherry repository. The
+                host automatically fetches the publisher's public signing key from that repository
+                during installation and before every update check.
             </p>
             <textarea
                 readonly

src/routes/hosts/[id]/+page.svelte

@@ -609,10 +609,9 @@
                         </div>
                         {#if enrollment}<p>Expires {$timeFormat.dateTime(enrollment.expiresAt)}</p>
                             <p>
-                                Use a reviewed <code>electric-cherry-install.sh</code> from your
-                                release publisher and provision its public signing key at
-                                <code>/etc/electric-cherry/release-signing.gpg</code>. Obtain both
-                                through a trusted channel independent of this controller.
+                                This command downloads the installer from the public Electric Cherry
+                                repository. The host fetches its public signing key from that
+                                repository during installation and before every update check.
                             </p>
                             <pre>{enrollment.command}</pre>{/if}{:else}<p>
                             Administrators manage enrollment and agent credentials.