Documentation
¶
Overview ¶
Command amadan-sign produces a signed release manifest from a directory of built binaries. It is the offline half of the release trust anchor (design docs/superpowers/specs/2026-08-13-release-signing-and-updates-design.md, finding R-06): it runs on the machine that holds the private signing key — never on the hub, never in CI — and emits the JSON that internal/release verifies against the public key pinned in internal/version.
Usage:
amadan-sign -dir dist -version v1.4.0 -key release-signing-key.json > manifest.json
Each regular file in -dir is one artifact. Its os/arch come from the filename's last two dash-separated components, with an optional .exe stripped: "amadan-linux-arm64" → os=linux arch=arm64, "amadan-windows-amd64.exe" → os=windows arch=amd64. The key file is a rastrillo/crypto MarshalKeypair JSON (the format RELEASE-SIGNING-KEY.md documents). The signature covers the manifest's canonical bytes, so re-encoding the JSON on the way to a mirror cannot break verification.
🤖 generated 2026-08-27 (security hardening, R-06).
Source Files
¶
- main.go