Angel Dionisio 15136eb0d8 Sign managed updates Linux tarballs with cosign (#68053) ...

* add managed updates artifact signature verification

* updating signature max size to a more realistic, yet generous size

* fail teleport-update bulds when artifact verifier key is missing

* forward artifact signing key into Docker buildbox

* verify artifact signature over stream instead of pre-computed digest

* add insecure-skip-artifact-signature flag for dev builds

* renaming insecure signature flag and simplify verifier flow

* import separation for linter CI fix

* gofmt

* simplifying verifyArfifactSig function, table tests

* verify artifact signature during install, adding godoc for WithDigest

* adding staging CDN fallback

* updating isStagingCDN url check by adding helper function to check for raw vs want url equality, pr comments

* clarify ECDSA-specific digest verification comment

* initialize artifact signature verifier at construction time

* embed backup artifact signature public key for managed updates

* move teleport-update signature inputs to main.go

* removing comment

* verify staging signatures by default with explicit fallback

* update staging signature verification to trust prod artifacts

* fix test expected message error

2026-08-07 20:05:42 +00:00

..

main_test.go

[ci] add differential benchmark workflows (#63100)

2026-02-20 15:31:03 +00:00

main.go

Sign managed updates Linux tarballs with cosign (#68053)

2026-08-07 20:05:42 +00:00