Launcher: native-build --prebuilt-out, the registry CI's side of prebuilt builds (#11859)

`horizon-launcher native-build --prebuilt-out DIR --version <Nightly> FOLDER` builds every
.hnmod in FOLDER through the player's own pipeline (pins, hook points, left-out mods), but
needs no prepared game files and installs nothing: it writes the program, its
native-mods.json and request.txt into DIR. request.txt is the build's request
(horizon_release_sign::native_build): target, the base's commit, each mod's id, version and
file SHA-256, so the registry's workflow and the launcher name a build alike. A set with a
post-build step is refused: the step runs on the player's game files.

native_mods: pipeline takes an export folder; the .hnmod unpacking is shared with
installed_mods; build_target names the Rust target of a build.

Measured on the desktop: zoom + minimap on Nightly 6560641, release profile, -j 4: 8 min,
request key equal to the one horizon-mods' plan computes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/horizon-release-sign/native-build-keys.txt

@@ -0,0 +1,6 @@
+# The public keys prebuilt native-mod builds are signed with (crates/horizon-release-sign/src/native_build.rs,
+# #11859): one base64 Ed25519 key per line. The launcher builds these in and refuses a prebuilt build no key here
+# signed. They are not release keys: the private keys exist only as the NATIVE_BUILD_SIGNING_KEY secret(s) of
+# horizon-rust/horizon-mods' `native-builds` environment, where the registry compiles other people's code.
+# Changing this file needs Ludovic's review (.github/CODEOWNERS).
+Z6IAbJ0E8fIGYddlbe1FYfYNpzzOseREOdNbANWirKA=

crates/horizon-release-sign/src/lib.rs

@@ -16,6 +16,8 @@
 use base64::{Engine, engine::general_purpose::STANDARD};
 use ring::signature::{ED25519, Ed25519KeyPair, KeyPair, UnparsedPublicKey};
 
+pub mod native_build;
+
 /// The checksum list's asset name.
 pub const SUMS: &str = "SHA256SUMS";
 /// Its signatures' asset name.
@@ -386,7 +388,13 @@ impl SigningKey {
 
     /// A signature line for SHA256SUMS.sig.
     pub fn sign(&self, tag: &str, sums: &[u8]) -> String {
-        STANDARD.encode(self.0.sign(&message(tag, sums)).as_ref())
+        self.sign_bytes(&message(tag, sums))
+    }
+
+    /// A base64 signature line over `message` as it is (a prebuilt native build's
+    /// [`native_build::message`]).
+    pub fn sign_bytes(&self, message: &[u8]) -> String {
+        STANDARD.encode(self.0.sign(message).as_ref())
     }
 }
 

crates/horizon-release-sign/src/native_build.rs

@@ -0,0 +1,346 @@
+//! Prebuilt native-mod builds (#11859): the game compiled for one exact set of registry native
+//! mods, by horizon-mods' CI, signed there and checked by the launcher before it installs one.
+//!
+//! A build is named by its [`Request`]: the target, the Horizon commit it builds on (the Nightly or
+//! release the instance plays) and each mod's id, version and the SHA-256 of its registry file. The
+//! launcher computes the request's [`Request::key`] from what it has installed; CI computes it from
+//! the workflow's own inputs, never from what a build wrote. The file for a target is
+//! [`archive`] in the release [`release_tag`] of horizon-mods, and its signature [`signature`]
+//! beside it: one base64 Ed25519 signature per line over [`message`], so a signature can't pass for
+//! another set's file, another target's, a release's (`horizon release <tag>`) or a Nightly's.
+//!
+//! The keys are not the release keys: `native-build-keys.txt` lists them, and their private halves
+//! are the `NATIVE_BUILD_SIGNING_KEY` secret(s) of horizon-mods' `native-builds` environment. The
+//! registry compiles other people's code there, so a key it holds must never sign a game release.
+
+use crate::{PublicKey, Sha256, parse_keys};
+use base64::{Engine, engine::general_purpose::STANDARD};
+use ring::signature::{ED25519, UnparsedPublicKey};
+
+const KEYS: &str = include_str!("../native-build-keys.txt");
+
+/// The first line of a request's text: a new layout gets a new number, and so new keys.
+const REQUEST_HEADER: &str = "horizon native build request 1";
+
+/// The public keys prebuilt native builds are signed with: those in `native-build-keys.txt`. A
+/// file that doesn't parse gives none, so every prebuilt build is refused (a test keeps it valid).
+pub fn trusted_keys() -> Vec<PublicKey> {
+    parse_keys(KEYS).unwrap_or_default()
+}
+
+/// One mod of a build: its registry id and version, and the SHA-256 of its registry file.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct Mod {
+    pub id: String,
+    pub version: String,
+    pub sha256: String,
+}
+
+/// What a prebuilt build is made of. Two requests with the same mods in another order are the same
+/// request: the mods are sorted by id.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Request {
+    /// The Rust target triple the game is compiled for.
+    pub target: String,
+    /// The commit of the Nightly or release the build starts from (40 hex digits).
+    pub base: String,
+    pub mods: Vec<Mod>,
+}
+
+impl Request {
+    /// A checked request, its mods sorted by id.
+    pub fn new(target: &str, base: &str, mut mods: Vec<Mod>) -> Result<Self, String> {
+        if !is_target(target) {
+            return Err(format!("{target:?} is not a target triple"));
+        }
+        if !is_hex(base, 40) {
+            return Err(format!("{base:?} is not a commit (40 hex digits)"));
+        }
+        if mods.is_empty() {
+            return Err("a native build needs at least one mod".into());
+        }
+        for m in &mods {
+            if !is_id(&m.id) {
+                return Err(format!("{:?} is not a mod id", m.id));
+            }
+            if !is_version(&m.version) {
+                return Err(format!("{}: {:?} is not a version", m.id, m.version));
+            }
+            if !is_hex(&m.sha256, 64) {
+                return Err(format!("{}: {:?} is not a SHA-256", m.id, m.sha256));
+            }
+        }
+        mods.sort();
+        if let Some(pair) = mods.windows(2).find(|w| w[0].id == w[1].id) {
+            return Err(format!("{} is listed twice", pair[0].id));
+        }
+        Ok(Self {
+            target: target.into(),
+            base: base.to_ascii_lowercase(),
+            mods: mods
+                .into_iter()
+                .map(|m| Mod {
+                    sha256: m.sha256.to_ascii_lowercase(),
+                    ..m
+                })
+                .collect(),
+        })
+    }
+
+    /// The text the key hashes: a header, the target, the base, then one line per mod.
+    pub fn text(&self) -> String {
+        let mut text = format!(
+            "{REQUEST_HEADER}\ntarget {}\nbase {}\n",
+            self.target, self.base
+        );
+        for m in &self.mods {
+            text.push_str(&format!("mod {} {} {}\n", m.id, m.version, m.sha256));
+        }
+        text
+    }
+
+    /// The request's SHA-256, in hex: what names the build.
+    pub fn key(&self) -> String {
+        let mut hash = Sha256::default();
+        hash.update(self.text().as_bytes());
+        hash.hex()
+    }
+}
+
+/// The horizon-mods release holding the builds made on commit `base`.
+pub fn release_tag(base: &str) -> String {
+    format!("native-builds-{}", &base[..base.len().min(12)])
+}
+
+/// The archive of build `key` for `target` (its first 16 hex digits name it).
+pub fn archive(key: &str, target: &str) -> String {
+    format!("{}-{target}.tar.gz", &key[..key.len().min(16)])
+}
+
+/// The signature file beside [`archive`].
+pub fn signature(key: &str, target: &str) -> String {
+    format!("{}-{target}.sig", &key[..key.len().min(16)])
+}
+
+/// What a build's signature covers: the whole key, the target, then the archive's SHA-256 and
+/// name as `sha256sum` writes them. CI signs this text with OpenSSL.
+pub fn message(key: &str, target: &str, sha256: &str, asset: &str) -> Vec<u8> {
+    format!("horizon native build {key} {target}\n{sha256}  {asset}\n").into_bytes()
+}
+
+/// Checks that one of `keys` signed archive `asset` with SHA-256 `sha256` as build `key` for
+/// `target`. `signatures` is the signature file's text.
+pub fn verify(
+    key: &str,
+    target: &str,
+    sha256: &str,
+    asset: &str,
+    signatures: &str,
+    keys: &[PublicKey],
+) -> Result<(), String> {
+    if keys.is_empty() {
+        return Err("This launcher has no key for prebuilt native builds built in.".into());
+    }
+    let message = message(key, target, &sha256.to_ascii_lowercase(), asset);
+    let signed = signatures
+        .lines()
+        .filter_map(|line| STANDARD.decode(line.trim()).ok())
+        .any(|signature| {
+            keys.iter().any(|k| {
+                UnparsedPublicKey::new(&ED25519, k)
+                    .verify(&message, &signature)
+                    .is_ok()
+            })
+        });
+    if signed {
+        Ok(())
+    } else {
+        Err(format!(
+            "{asset}'s signature doesn't match Horizon's key for prebuilt native builds, so it was \
+             not installed."
+        ))
+    }
+}
+
+fn is_hex(text: &str, len: usize) -> bool {
+    text.len() == len && text.bytes().all(|b| b.is_ascii_hexdigit())
+}
+
+/// A registry id: what `horizon_mods::index::valid_id` takes, and no space or line break.
+fn is_id(text: &str) -> bool {
+    (1..=64).contains(&text.len())
+        && text
+            .bytes()
+            .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'_' || b == b'-')
+}
+
+fn is_version(text: &str) -> bool {
+    (1..=64).contains(&text.len()) && text.bytes().all(|b| b.is_ascii_graphic())
+}
+
+/// `x86_64-unknown-linux-gnu`: lowercase words joined by hyphens, at least two of them.
+fn is_target(text: &str) -> bool {
+    text.len() <= 64
+        && text.split('-').count() >= 2
+        && text.split('-').all(|part| {
+            !part.is_empty()
+                && part
+                    .bytes()
+                    .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'_')
+        })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::SigningKey;
+
+    const BASE: &str = "656064105c0e1fbd0a8f1d6e5f5d3a8b3c2e1f00";
+
+    fn mod_(id: &str, version: &str, byte: char) -> Mod {
+        Mod {
+            id: id.into(),
+            version: version.into(),
+            sha256: byte.to_string().repeat(64),
+        }
+    }
+
+    fn request() -> Request {
+        Request::new(
+            "x86_64-unknown-linux-gnu",
+            BASE,
+            vec![mod_("zoom", "2.0.0", 'b'), mod_("minimap", "1.4.0", 'a')],
+        )
+        .unwrap()
+    }
+
+    /// A key computed by hand, so the registry's CI (Python) and the launcher name a build alike.
+    #[test]
+    fn the_key_is_the_sha256_of_the_documented_text() {
+        let r = request();
+        assert_eq!(
+            r.text(),
+            format!(
+                "horizon native build request 1\ntarget x86_64-unknown-linux-gnu\nbase {BASE}\n\
+                 mod minimap 1.4.0 {}\nmod zoom 2.0.0 {}\n",
+                "a".repeat(64),
+                "b".repeat(64)
+            )
+        );
+        // python3 -c 'import hashlib,sys; print(hashlib.sha256(sys.stdin.buffer.read()).hexdigest())'
+        assert_eq!(
+            r.key(),
+            "c07fffc296cf14c5c496a016a930f84b0d0ac028a63c667c2bdf47657788445d"
+        );
+    }
+
+    #[test]
+    fn order_and_case_do_not_change_the_key() {
+        let shuffled = Request::new(
+            "x86_64-unknown-linux-gnu",
+            &BASE.to_ascii_uppercase(),
+            vec![mod_("minimap", "1.4.0", 'A'), mod_("zoom", "2.0.0", 'B')],
+        )
+        .unwrap();
+        assert_eq!(shuffled.key(), request().key());
+    }
+
+    #[test]
+    fn any_input_changes_the_key() {
+        let key = request().key();
+        let other = |target: &str, base: &str, mods: Vec<Mod>| {
+            Request::new(target, base, mods).unwrap().key()
+        };
+        let mods = || vec![mod_("zoom", "2.0.0", 'b'), mod_("minimap", "1.4.0", 'a')];
+        assert_ne!(other("x86_64-pc-windows-gnu", BASE, mods()), key);
+        assert_ne!(
+            other("x86_64-unknown-linux-gnu", &"1".repeat(40), mods()),
+            key
+        );
+        assert_ne!(
+            other(
+                "x86_64-unknown-linux-gnu",
+                BASE,
+                vec![mod_("zoom", "2.0.1", 'b'), mod_("minimap", "1.4.0", 'a')]
+            ),
+            key
+        );
+        assert_ne!(
+            other(
+                "x86_64-unknown-linux-gnu",
+                BASE,
+                vec![mod_("zoom", "2.0.0", 'c'), mod_("minimap", "1.4.0", 'a')]
+            ),
+            key
+        );
+        assert_ne!(
+            other(
+                "x86_64-unknown-linux-gnu",
+                BASE,
+                vec![mod_("zoom", "2.0.0", 'b')]
+            ),
+            key
+        );
+    }
+
+    #[test]
+    fn a_request_that_could_forge_another_line_is_refused() {
+        let base = "x86_64-unknown-linux-gnu";
+        assert!(Request::new(base, BASE, vec![]).is_err());
+        assert!(Request::new("linux", BASE, vec![mod_("a", "1", 'a')]).is_err());
+        assert!(Request::new("x86 64-linux", BASE, vec![mod_("a", "1", 'a')]).is_err());
+        assert!(Request::new(base, "abc", vec![mod_("a", "1", 'a')]).is_err());
+        assert!(Request::new(base, BASE, vec![mod_("a b", "1", 'a')]).is_err());
+        assert!(Request::new(base, BASE, vec![mod_("a", "1\nmod x", 'a')]).is_err());
+        assert!(Request::new(base, BASE, vec![mod_("a", "1", 'g')]).is_err());
+        assert!(Request::new(base, BASE, vec![mod_("a", "1", 'a'), mod_("a", "2", 'b')]).is_err());
+    }
+
+    #[test]
+    fn a_signed_build_verifies_and_nothing_else_does() {
+        let (signer, _) = SigningKey::generate().unwrap();
+        let (stranger, _) = SigningKey::generate().unwrap();
+        let r = request();
+        let key = r.key();
+        let target = &r.target;
+        let asset = archive(&key, target);
+        let sha = "c".repeat(64);
+        let sign = |k: &SigningKey, msg: Vec<u8>| k.sign_bytes(&msg) + "\n";
+        let good = sign(&signer, message(&key, target, &sha, &asset));
+        let keys = [signer.public()];
+        assert_eq!(verify(&key, target, &sha, &asset, &good, &keys), Ok(()));
+        // Another key, another archive, another set or target, no key at all.
+        let theirs = sign(&stranger, message(&key, target, &sha, &asset));
+        assert!(verify(&key, target, &sha, &asset, &theirs, &keys).is_err());
+        assert!(verify(&key, target, &"d".repeat(64), &asset, &good, &keys).is_err());
+        let other = "e".repeat(64);
+        assert!(verify(&other, target, &sha, &asset, &good, &keys).is_err());
+        assert!(verify(&key, "aarch64-apple-darwin", &sha, &asset, &good, &keys).is_err());
+        assert!(verify(&key, target, &sha, &asset, &good, &[]).is_err());
+        // A release's signature over the same bytes is no build's.
+        let release = signer.sign(&key, format!("{sha}  {asset}\n").as_bytes()) + "\n";
+        assert!(verify(&key, target, &sha, &asset, &release, &keys).is_err());
+        // One line of several is enough (a key being replaced signs beside the old one).
+        let both = theirs + &good;
+        assert_eq!(verify(&key, target, &sha, &asset, &both, &keys), Ok(()));
+    }
+
+    #[test]
+    fn the_built_in_keys_file_parses() {
+        assert!(parse_keys(KEYS).is_ok());
+    }
+
+    #[test]
+    fn assets_are_named_by_the_keys_first_16_digits() {
+        let key = request().key();
+        assert_eq!(release_tag(BASE), "native-builds-656064105c0e");
+        assert_eq!(
+            archive(&key, "aarch64-apple-darwin"),
+            format!("{}-aarch64-apple-darwin.tar.gz", &key[..16])
+        );
+        assert_eq!(
+            signature(&key, "aarch64-apple-darwin"),
+            format!("{}-aarch64-apple-darwin.sig", &key[..16])
+        );
+    }
+}

crates/horizon-release-sign/tests/native_build.rs

@@ -0,0 +1,170 @@
+//! A prebuilt native build signed as horizon-mods' workflow signs it (tools/ci/sign_native_build.sh,
+//! OpenSSL), then checked as the launcher checks it (`native_build::verify`).
+use horizon_release_sign::native_build::{Mod, Request, archive, signature, verify};
+use horizon_release_sign::{SigningKey, parse_keys, sha256_hex};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+
+/// An OpenSSL 3 (the runner's), or None on a machine without one (macOS ships LibreSSL).
+fn openssl() -> Option<String> {
+    [
+        "openssl",
+        "/opt/homebrew/opt/openssl@3/bin/openssl",
+        "/usr/local/opt/openssl@3/bin/openssl",
+    ]
+    .into_iter()
+    .find(|o| {
+        Command::new(o)
+            .arg("version")
+            .output()
+            .is_ok_and(|v| v.stdout.starts_with(b"OpenSSL 3"))
+    })
+    .map(String::from)
+}
+
+fn request() -> Request {
+    Request::new(
+        "x86_64-unknown-linux-gnu",
+        &"6".repeat(40),
+        vec![Mod {
+            id: "minimap".into(),
+            version: "1.4.0".into(),
+            sha256: "a".repeat(64),
+        }],
+    )
+    .unwrap()
+}
+
+/// A folder with the build's archive, as the build job leaves it.
+fn folder(name: &str, request: &Request) -> (PathBuf, PathBuf) {
+    let dir =
+        std::env::temp_dir().join(format!("horizon-native-sign-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let file = dir.join(archive(&request.key(), &request.target));
+    std::fs::write(&file, b"the game with the minimap").unwrap();
+    (dir, file)
+}
+
+fn sign(key: &str, target: &str, file: &Path, env: &[(&str, &str)], keys: &Path) -> Output {
+    let script = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tools/ci/sign_native_build.sh");
+    let mut cmd = Command::new("bash");
+    cmd.arg(script)
+        .args([key, target])
+        .arg(file)
+        .env_remove("NATIVE_BUILD_SIGNING_KEY")
+        .env_remove("NATIVE_BUILD_SIGNING_KEY_NEXT")
+        .env("OPENSSL", openssl().unwrap())
+        .env("NATIVE_BUILD_KEYS", keys);
+    for (k, v) in env {
+        cmd.env(k, v);
+    }
+    cmd.output().unwrap()
+}
+
+fn read_signature(dir: &Path, r: &Request) -> String {
+    std::fs::read_to_string(dir.join(signature(&r.key(), &r.target))).unwrap()
+}
+
+#[test]
+fn the_workflows_signature_is_what_the_launcher_checks() {
+    // The script runs on the Linux runner of horizon-mods' sign job.
+    if cfg!(windows) || openssl().is_none() {
+        eprintln!("skipped: tools/ci/sign_native_build.sh is tested on Linux (bash, OpenSSL 3)");
+        return;
+    }
+    let r = request();
+    let (dir, file) = folder("secret", &r);
+    let sha = sha256_hex(b"the game with the minimap");
+    let name = archive(&r.key(), &r.target);
+    let (old, old_secret) = SigningKey::generate().unwrap();
+    let (new, new_secret) = SigningKey::generate().unwrap();
+    let keys = dir.join("keys.txt");
+    std::fs::write(
+        &keys,
+        format!(
+            "# listed\n{}\n{}\n",
+            old.public_base64(),
+            new.public_base64()
+        ),
+    )
+    .unwrap();
+    let out = sign(
+        &r.key(),
+        &r.target,
+        &file,
+        &[
+            ("NATIVE_BUILD_SIGNING_KEY", &old_secret),
+            ("NATIVE_BUILD_SIGNING_KEY_NEXT", &new_secret),
+        ],
+        &keys,
+    );
+    let printed = format!(
+        "{}{}",
+        String::from_utf8_lossy(&out.stdout),
+        String::from_utf8_lossy(&out.stderr)
+    );
+    assert!(out.status.success(), "{printed}");
+    assert!(!printed.contains(&old_secret) && !printed.contains(&new_secret));
+    let sig = read_signature(&dir, &r);
+    assert_eq!(sig.lines().count(), 2);
+    let listed = parse_keys(&std::fs::read_to_string(&keys).unwrap()).unwrap();
+    for key in [&listed[..1], &listed[1..]] {
+        assert_eq!(verify(&r.key(), &r.target, &sha, &name, &sig, key), Ok(()));
+    }
+    // The same signature for another set, target or file is refused.
+    let other = "0".repeat(64);
+    assert!(verify(&other, &r.target, &sha, &name, &sig, &listed).is_err());
+    assert!(verify(&r.key(), "aarch64-apple-darwin", &sha, &name, &sig, &listed).is_err());
+    assert!(verify(&r.key(), &r.target, &other, &name, &sig, &listed).is_err());
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn a_key_launchers_would_refuse_or_a_misnamed_archive_signs_nothing() {
+    if cfg!(windows) || openssl().is_none() {
+        eprintln!("skipped: tools/ci/sign_native_build.sh is tested on Linux (bash, OpenSSL 3)");
+        return;
+    }
+    let r = request();
+    let (dir, file) = folder("refused", &r);
+    let (_, secret) = SigningKey::generate().unwrap();
+    let keys = dir.join("keys.txt");
+    std::fs::write(&keys, "# none yet\n").unwrap();
+    let env = [("NATIVE_BUILD_SIGNING_KEY", secret.as_str())];
+    // Not listed in the keys file.
+    assert!(
+        !sign(&r.key(), &r.target, &file, &env, &keys)
+            .status
+            .success()
+    );
+    // No key at all.
+    assert!(
+        !sign(&r.key(), &r.target, &file, &[], &keys)
+            .status
+            .success()
+    );
+    // The archive named for another key than the one signed.
+    let ephemeral = [("EPHEMERAL", "yes")];
+    assert!(
+        !sign(&"0".repeat(64), &r.target, &file, &ephemeral, &keys)
+            .status
+            .success()
+    );
+    // A dry run signs with a throwaway key, whose public half it leaves for the check.
+    let out = sign(&r.key(), &r.target, &file, &ephemeral, &keys);
+    assert!(
+        out.status.success(),
+        "{}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let public = parse_keys(&std::fs::read_to_string(dir.join("ephemeral.pub")).unwrap()).unwrap();
+    let sha = sha256_hex(b"the game with the minimap");
+    let name = archive(&r.key(), &r.target);
+    let sig = read_signature(&dir, &r);
+    assert_eq!(
+        verify(&r.key(), &r.target, &sha, &name, &sig, &public),
+        Ok(())
+    );
+    std::fs::remove_dir_all(dir).unwrap();
+}

docs/launcher-commands.md

@@ -111,6 +111,7 @@ Native mods (docs/native-mods.md): compile mixin bundles on the Horizon revision
 
 - `FOLDER`: A mod folder (horizon-mixin.toml, or an unpacked .hnmod), or a folder of them (default: the native mods installed and turned on in the instance)
 - `--server-output`: Export mode: build a standalone dedicated-server engine into this folder instead of an instance's build. Needs a mod FOLDER; no instance is read or changed, and no launcher config is written
+- `--prebuilt-out`: Prebuilt mode, for the registry's CI (#11859): build every .hnmod file in FOLDER as a player's launcher would, and write the program, its native-mods.json and request.txt into this new folder instead of installing it. The base needs no prepared game files
 - `--instance`: The instance whose installed native mods to build, and which then plays the build (default: the selected one)
 - `--update`: Move to the newest installed release or Nightly instead of the Horizon the instance plays (a full rebuild)
 - `--trust-native-code`: You read the mods' source and trust it with full access to this computer

docs/native-mods.md

@@ -1922,6 +1922,18 @@ whole file, **Open full log** opens it outside the launcher, **Show in folder**
 refresh, not a live stream: a running build's later output appears only on the next refresh. Nothing is
 uploaded; the log stays on the player's computer.
 
+## Prebuilt builds (in progress)
+
+Most players can't wait 30 to 60 minutes for a first build, so the registry builds sets of its native mods itself
+and signs them (#11859). The launcher's own pipeline makes them in CI:
+`horizon-launcher native-build --prebuilt-out DIR --version <Nightly> --profile release --trust-native-code FOLDER`
+builds every `.hnmod` in FOLDER as a player's launcher would (the same pins, hook points and left-out mods), on the
+Nightly's source, without the player's game files. It writes the program, its `native-mods.json` and `request.txt`
+into DIR instead of installing anything. `request.txt` names the build: the target, the Nightly's commit and each
+mod's id, version and file SHA-256 (`horizon_release_sign::native_build::Request`), the text whose SHA-256 the
+launcher computes to look the build up. A set with a post-build step is never exported, because that step runs on
+the player's own game files. Downloading and checking the signed builds in the launcher comes next.
+
 ## Rebuilds stay on the instance's Horizon
 
 A build starts from the version the instance plays (`native_mods::base_for`). When that is a native build, the

docs/security.md

@@ -37,6 +37,7 @@ and some are waiting for Ludovic:
 | Fork pull requests need approval | **Live**: every outside contributor's workflows wait for a maintainer's approval. |
 | Private vulnerability reporting | **Live** (see the end of this page). |
 | Signed checksums on releases | **Live** for new releases (#1011): the `release` environment holds the key, and its public half is in `release-keys.txt` (#1023). Releases from before then are unsigned. |
+| Signed prebuilt native-mod builds | **Being built** (#11859): horizon-mods' `native-builds` environment (deployable from `main` only) holds `NATIVE_BUILD_SIGNING_KEY`, a key of its own, never the release key, because the registry compiles other people's code there. Its public half is in `native-build-keys.txt`. Each signature covers the build's request key (target, base commit, each mod's file SHA-256), its target and the archive's SHA-256 (`horizon_release_sign::native_build`), so it can't pass for another set's file or for a release. `tools/ci/sign_native_build.sh` signs with OpenSSL. |
 | Launchers and servers checking signatures | **Not yet**: #1014 waits as a draft until a signed stable game release and a signed launcher release exist. Until then they trust GitHub's checksum, as before. |
 | Smoke test and release-blocker before publishing | **Live**: since 2026-10-23 every release is the latest at once (one channel, Ludovic's decision), so it is published only after its smoke test passed and while no `release-blocker` is open. The 6-hour beta of the old Alpha, then stable flow (#1012) is gone. |
 | Reports marked suspicious | **Partly**: the scan of Discord for agents does it. Kira's issues do it once its pull request merges. |

launcher/src/cli.rs

@@ -805,6 +805,16 @@ enum Cmd {
             requires = "folder"
         )]
         server_output: Option<PathBuf>,
+        /// Prebuilt mode, for the registry's CI (#11859): build every .hnmod file in FOLDER as a
+        /// player's launcher would, and write the program, its native-mods.json and request.txt
+        /// into this new folder instead of installing it. The base needs no prepared game files
+        #[arg(
+            long = "prebuilt-out",
+            value_name = "DIR",
+            conflicts_with_all = ["instance", "server_output", "update"],
+            requires = "folder"
+        )]
+        prebuilt_out: Option<PathBuf>,
         /// The instance whose installed native mods to build, and which then plays the build
         /// (default: the selected one)
         #[arg(long)]
@@ -1314,6 +1324,7 @@ fn execute(command: Cmd, as_json: bool) -> Result<(), String> {
         Cmd::NativeBuild {
             folder,
             server_output,
+            prebuilt_out,
             instance,
             version,
             update,
@@ -1334,6 +1345,30 @@ fn execute(command: Cmd, as_json: bool) -> Result<(), String> {
                 let secs = started.elapsed().as_secs();
                 eprintln!("[{:>2}:{:02}] {}", secs / 60, secs % 60, step.label())
             };
+            if let Some(out) = prebuilt_out {
+                // For the registry's CI: no instance, no install, no launcher config.
+                let folder = folder.unwrap();
+                let base = match &version {
+                    Some(v) => backend::resolve_version(Some(v))?,
+                    None => native_mods::base_for(None, &backend::installed(), false)
+                        .ok_or_else(backend::no_version_installed)?,
+                };
+                let made = horizon_launcher::native_prebuilt::export(
+                    &base, &folder, &out, profile, steps,
+                )?;
+                let left: Vec<&str> = made.left_out.iter().map(|l| l.id.as_str()).collect();
+                println!(
+                    "{}",
+                    serde_json::json!({
+                        "key": made.request.key(),
+                        "target": made.request.target,
+                        "base": made.request.base,
+                        "version": made.version,
+                        "left_out": left,
+                    })
+                );
+                return Ok(());
+            }
             if let Some(output) = server_output {
                 // Export mode: a standalone server engine in `output`. No instance is read
                 // or changed, and no launcher config is written; `folder` is required (clap).
@@ -3970,6 +4005,45 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn prebuilt_mode_needs_mods_and_builds_for_no_instance() {
+        let parse = |args: &[&str]| {
+            Cli::try_parse_from(
+                [
+                    &["horizon-launcher", "native-build", "--trust-native-code"],
+                    args,
+                ]
+                .concat(),
+            )
+        };
+        match parse(&["hnmods", "--prebuilt-out", "out", "--version", "nightly"])
+            .unwrap()
+            .command
+        {
+            Some(Cmd::NativeBuild {
+                folder,
+                prebuilt_out,
+                version,
+                ..
+            }) => {
+                assert_eq!(folder.as_deref(), Some(Path::new("hnmods")));
+                assert_eq!(prebuilt_out.as_deref(), Some(Path::new("out")));
+                assert_eq!(version.as_deref(), Some("nightly"));
+            }
+            _ => panic!("expected native-build"),
+        }
+        // The CI names its mods; an instance's, a server engine or a move to another Horizon
+        // are a player's builds.
+        assert!(parse(&["--prebuilt-out", "out"]).is_err());
+        for other in [
+            &["--instance", "A"][..],
+            &["--server-output", "engine"],
+            &["--update"],
+        ] {
+            assert!(parse(&[&["hnmods", "--prebuilt-out", "out"][..], other].concat()).is_err());
+        }
+    }
+
     #[test]
     fn export_mode_base_is_an_installed_release_not_a_native_build() {
         // The export mode picks the newest installed release or Nightly, never a native build

launcher/src/lib.rs

@@ -33,6 +33,7 @@ pub mod mojang;
 mod native_cache;
 pub mod native_fit;
 pub mod native_mods;
+pub mod native_prebuilt;
 pub mod native_status;
 pub mod nightly;
 pub mod other_launchers;

launcher/src/native_mods.rs

@@ -198,6 +198,17 @@ fn platform_for_game(base: &str) -> Result<BuildPlatform, String> {
     windows_build_platform(machine, host.target)
 }
 
+/// The Rust target a build on installed version `base` compiles for: a prebuilt build's
+/// (`native_prebuilt`) is named by it.
+pub(crate) fn build_target(base: &str) -> Result<&'static str, String> {
+    match platform_for_game(base)?.target {
+        Some(target) => Ok(target),
+        None => rust_toolchain::host()
+            .map(|h| h.target)
+            .ok_or_else(|| architecture_mismatch(std::env::consts::ARCH, "a supported computer")),
+    }
+}
+
 fn windows_build_platform(machine: u16, host_target: &str) -> Result<BuildPlatform, String> {
     let target = rust_toolchain::windows_target_for_machine(machine).ok_or_else(|| {
         architecture_mismatch(&format!("PE machine 0x{machine:04x}"), "x64 or ARM64")
@@ -627,12 +638,7 @@ pub fn installed_mods(home: &Path) -> Result<PathBuf, String> {
         if !crate::browser::java::is_enabled(home, &bundle.manifest.id) {
             continue;
         }
-        let dir = out.join(&bundle.manifest.id);
-        for (name, bytes) in &bundle.files {
-            let to = dir.join(name);
-            fs::create_dir_all(to.parent().unwrap_or(&dir)).map_err(|e| e.to_string())?;
-            fs::write(&to, bytes).map_err(|e| format!("{}: {e}", to.display()))?;
-        }
+        unpack(&bundle, &out)?;
         count += 1;
     }
     if count == 0 {
@@ -644,6 +650,20 @@ pub fn installed_mods(home: &Path) -> Result<PathBuf, String> {
     Ok(out)
 }
 
+/// Writes a checked `.hnmod`'s files into `out/<id>/`, as a build reads an installed mod.
+pub(crate) fn unpack(
+    bundle: &horizon_mods::index::native::Bundle,
+    out: &Path,
+) -> Result<(), String> {
+    let dir = out.join(&bundle.manifest.id);
+    for (name, bytes) in &bundle.files {
+        let to = dir.join(name);
+        fs::create_dir_all(to.parent().unwrap_or(&dir)).map_err(|e| e.to_string())?;
+        fs::write(&to, bytes).map_err(|e| format!("{}: {e}", to.display()))?;
+    }
+    Ok(())
+}
+
 /// A mixin bundle: a folder with a `horizon-mixin.toml`, and the revisions it pins.
 #[derive(Clone, Debug, PartialEq)]
 pub struct Bundle {
@@ -1133,6 +1153,11 @@ fn ask_github(repo: &str, revision: &str) -> Result<String, String> {
 /// use and the player hasn't agreed to try (`anyway`); the rest lists them.
 pub const MISMATCH: &str = "Made for other Horizon versions: ";
 
+/// Why a set with a post-build step is never exported as a prebuilt build: the step runs in the
+/// installed version, on the player's own game files (`native_prebuilt`, #11859).
+pub const PREBUILT_POST_BUILD: &str =
+    "A mod of this set has a post-build step, which runs on the player's own game files: it is built on the player's computer, never prebuilt.";
+
 /// Each pinned mod whose Horizon revision isn't `revision`, as `id → pin`, and the build's.
 fn mismatch(mods: &[Bundle], revision: &str) -> Option<String> {
     let list: Vec<String> = mods
@@ -2219,9 +2244,14 @@ fn pipeline(
     progress: &impl Fn(Step),
     skip: &[LeftOut],
     isolate: bool,
+    export: Option<&Path>,
 ) -> Result<Built, Failed> {
     let started = std::time::Instant::now();
-    backend::need_prepared(base)?;
+    // An export (`native_prebuilt::export`, the registry's CI) never plays: it needs only the
+    // version's program, never the player's prepared game files.
+    if export.is_none() {
+        backend::need_prepared(base)?;
+    }
     let platform = platform_for_game(base)?;
     fs::create_dir_all(root()).map_err(|e| e.to_string())?;
     // The mods are copied first: the build and its key use the copy, whatever happens to the
@@ -2375,7 +2405,7 @@ fn pipeline(
             .map(|m| Ok((m.id.clone(), mod_hash(m)?)))
             .collect::<Result<_, String>>()?,
     };
-    let exists = target.directory(&version).join(".installed").is_file();
+    let exists = export.is_none() && target.directory(&version).join(".installed").is_file();
     let plan = classify(
         exists,
         last_record(target, profile, platform.cache_key()).as_ref(),
@@ -2465,6 +2495,11 @@ fn pipeline(
         let stage = stage_dir(&real)?;
         sync(&fresh, &stage)?;
         let _ = fs::remove_dir_all(&fresh);
+        // A post-build step runs in the installed version, on the player's game files: a build
+        // with one is only ever made on that computer.
+        if export.is_some() && !crates::post_builds(&stage)?.is_empty() {
+            return Err(PREBUILT_POST_BUILD.to_string().into());
+        }
         if crates::any(&stage) || has_api {
             progress(Step::Crates);
             lock_crates(&rust, &source, &stage, &mods)?;
@@ -2588,14 +2623,21 @@ fn pipeline(
             })).collect::<Vec<_>>(),
             "left_out": left_out.iter().map(LeftOut::to_json).collect::<Vec<_>>(),
         });
-        install(base, &version, target, &binary, &about, |dir| {
-            for (step, program) in &post {
-                progress(Step::PostBuild(step.mod_id.clone()));
-                let cmd = crates::post_build(program, step, dir, &real.join("cache"), &stage)?;
-                run(cmd, &format!("{}'s post-build step", step.mod_id), |_| {})?;
+        match export {
+            Some(out) => {
+                copy_out(&binary, &out.join(target.binary()))?;
+                fs::write(out.join("native-mods.json"), about.to_string())
+                    .map_err(|e| e.to_string())?;
             }
-            Ok(())
-        })?;
+            None => install(base, &version, target, &binary, &about, |dir| {
+                for (step, program) in &post {
+                    progress(Step::PostBuild(step.mod_id.clone()));
+                    let cmd = crates::post_build(program, step, dir, &real.join("cache"), &stage)?;
+                    run(cmd, &format!("{}'s post-build step", step.mod_id), |_| {})?;
+                }
+                Ok(())
+            })?,
+        }
         let _ = fs::remove_dir_all(real.join("programs"));
     } else {
         // Used again: it counts as the newest of the builds kept (`prune`).
@@ -2694,6 +2736,7 @@ pub fn build(
                     &progress,
                     skip,
                     true,
+                    None,
                 )
             },
             &progress,
@@ -2713,6 +2756,40 @@ pub fn build(
     })
 }
 
+/// Builds the bundles in `folder` as a player's launcher builds them on installed version
+/// `base` (left-out mods included), and writes the program and its `native-mods.json` into `out`
+/// instead of installing it: a prebuilt build for the registry's CI (`native_prebuilt::export`).
+/// Nothing is installed, no instance is changed, and `base` needs no prepared game files.
+/// Returns the version a player's build of the same set would install, and the mods left out.
+pub(crate) fn build_prebuilt(
+    base: &str,
+    folder: &Path,
+    out: &Path,
+    profile: Profile,
+    progress: impl Fn(Step),
+) -> Result<(String, Vec<LeftOut>), String> {
+    logged(|| {
+        let built = isolated(
+            |skip| {
+                pipeline(
+                    base,
+                    folder,
+                    false,
+                    false,
+                    profile,
+                    Target::Client,
+                    &progress,
+                    skip,
+                    true,
+                    Some(out),
+                )
+            },
+            &progress,
+        )?;
+        Ok((built.version, built.left_out))
+    })
+}
+
 /// Builds `folder`'s mods as the headless engine a dedicated server runs (`horizon-engine`,
 /// docs/server.md): the same pipeline as [`build`] on the same revision, compiled with
 /// `--no-default-features`, installed as its own version (its key distinct from the game's, so
@@ -2768,6 +2845,7 @@ pub fn build_server(
             &progress,
             &[],
             false,
+            None,
         )
         .map_err(String::from)?;
         export(&Target::Server.directory(&built.version), &output)?;

launcher/src/native_prebuilt.rs

@@ -0,0 +1,225 @@
+//! Prebuilt native builds (#11859): the game compiled for one exact set of registry native mods by
+//! horizon-mods' CI, so players download it instead of compiling.
+//!
+//! A build is named by its request (`horizon_release_sign::native_build::Request`): the target, the
+//! commit of the release or Nightly it starts from, and each mod's id, version and the SHA-256 of
+//! its `.hnmod`. [`request_for`] computes it the same way on the player's computer and in CI.
+//! [`export`] is CI's side: `horizon-launcher native-build --prebuilt-out DIR FOLDER` builds the
+//! `.hnmod` files in FOLDER with the player's pipeline (the same pins, hook points and left-out
+//! mods), and writes the program, its `native-mods.json` and the request into DIR, for the workflow
+//! to sign. A set with a post-build step is never exported: the step runs on the player's game files.
+
+use crate::native_mods::{self, LeftOut, Profile, Step};
+use horizon_release_sign::native_build::{Mod, Request};
+use std::fs;
+use std::path::{Path, PathBuf};
+
+/// The request's text in an export's folder: what the workflow checks against its own.
+pub const REQUEST_FILE: &str = "request.txt";
+
+/// The `.hnmod` files directly in `dir`, by name.
+pub fn hnmod_files(dir: &Path) -> Result<Vec<PathBuf>, String> {
+    let mut files: Vec<PathBuf> = fs::read_dir(dir)
+        .map_err(|e| format!("{}: {e}", dir.display()))?
+        .flatten()
+        .map(|e| e.path())
+        .filter(|p| p.is_file() && p.extension().is_some_and(|e| e == "hnmod"))
+        .collect();
+    files.sort();
+    Ok(files)
+}
+
+/// The request for building `files` (registry `.hnmod`s, each checked as the registry checks it)
+/// for `target` on commit `base`: each mod's id and version from its `horizon-native.json`, and the
+/// file's SHA-256.
+pub fn request_for(target: &str, base: &str, files: &[PathBuf]) -> Result<Request, String> {
+    let mods = files
+        .iter()
+        .map(|path| {
+            let bytes = fs::read(path).map_err(|e| format!("{}: {e}", path.display()))?;
+            let bundle = horizon_mods::index::native::Bundle::read(path)
+                .map_err(|e| format!("{}: {e}", path.display()))?;
+            Ok(Mod {
+                id: bundle.manifest.id,
+                version: bundle.manifest.version,
+                sha256: horizon_release_sign::sha256_hex(&bytes),
+            })
+        })
+        .collect::<Result<Vec<_>, String>>()?;
+    Request::new(target, base, mods)
+}
+
+/// What [`export`] made.
+#[derive(Debug)]
+pub struct Exported {
+    pub request: Request,
+    /// The version a player's own build of this set would install (`native-<commit>-<key>`).
+    pub version: String,
+    /// The mods the build left out, as a player's build leaves them out.
+    pub left_out: Vec<LeftOut>,
+}
+
+/// Builds every `.hnmod` in `folder` on installed version `base` as a player's launcher would,
+/// and writes into `out` (a new folder): the program, its `native-mods.json` and [`REQUEST_FILE`].
+/// Nothing is installed and `base` needs no prepared game files.
+pub fn export(
+    base: &str,
+    folder: &Path,
+    out: &Path,
+    profile: Profile,
+    progress: impl Fn(Step),
+) -> Result<Exported, String> {
+    let files = hnmod_files(folder)?;
+    if files.is_empty() {
+        return Err(format!("{} holds no .hnmod file.", folder.display()));
+    }
+    let empty = fs::read_dir(out).map_or(true, |mut dir| dir.next().is_none());
+    if !empty {
+        return Err(format!(
+            "{} already holds files: export into a new folder.",
+            out.display()
+        ));
+    }
+    let request = request_for(
+        native_mods::build_target(base)?,
+        &native_mods::revision_of(base)?,
+        &files,
+    )?;
+    fs::create_dir_all(out).map_err(|e| format!("{}: {e}", out.display()))?;
+    // Unpacked as a player's installed mods are (`native_mods::installed_mods`), so the build's
+    // record names them alike.
+    let incoming = native_mods::root().join("prebuilt.incoming");
+    let _ = fs::remove_dir_all(&incoming);
+    for path in &files {
+        let bundle = horizon_mods::index::native::Bundle::read(path)
+            .map_err(|e| format!("{}: {e}", path.display()))?;
+        native_mods::unpack(&bundle, &incoming)?;
+    }
+    let built = native_mods::build_prebuilt(base, &incoming, out, profile, progress);
+    let _ = fs::remove_dir_all(&incoming);
+    let (version, left_out) = built?;
+    fs::write(out.join(REQUEST_FILE), request.text()).map_err(|e| e.to_string())?;
+    Ok(Exported {
+        request,
+        version,
+        left_out,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+
+    fn scratch(name: &str) -> PathBuf {
+        let dir =
+            std::env::temp_dir().join(format!("native-prebuilt-{name}-{}", std::process::id()));
+        let _ = fs::remove_dir_all(&dir);
+        fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    /// A registry `.hnmod` for `id` at `version`, as `.hnmod` files are zipped.
+    fn hnmod(dir: &Path, file: &str, id: &str, version: &str) -> PathBuf {
+        hnmod_with(dir, file, id, version, "")
+    }
+
+    /// [`hnmod`] with `extra` at the end of its manifest.
+    fn hnmod_with(dir: &Path, file: &str, id: &str, version: &str, extra: &str) -> PathBuf {
+        let pin = "a".repeat(40);
+        let path = dir.join(file);
+        let mut zip = zip::ZipWriter::new(fs::File::create(&path).unwrap());
+        let manifest = serde_json::json!({
+            "schema": 1, "id": id, "version": version, "game": "26.3", "horizon": pin, "mixins": pin
+        });
+        let source = format!(
+            "[mod]\nid = \"{id}\"\nversion = \"{version}\"\n[compatibility]\nhorizon_revision = \"{pin}\"\n{extra}"
+        );
+        for (name, text) in [
+            ("horizon-native.json".to_string(), manifest.to_string()),
+            (format!("mixins/{id}/horizon-mixin.toml"), source),
+        ] {
+            zip.start_file(name, zip::write::SimpleFileOptions::default())
+                .unwrap();
+            zip.write_all(text.as_bytes()).unwrap();
+        }
+        zip.finish().unwrap();
+        path
+    }
+
+    fn sha256(path: &Path) -> String {
+        use sha2::{Digest, Sha256};
+        Sha256::digest(fs::read(path).unwrap())
+            .iter()
+            .map(|b| format!("{b:02x}"))
+            .collect()
+    }
+
+    #[test]
+    fn a_request_names_each_file_by_its_manifest_and_its_bytes() {
+        let dir = scratch("request");
+        // The file name is not the id: the manifest says what the mod is.
+        let zoom = hnmod(&dir, "b.hnmod", "zoom", "2.0.0");
+        let minimap = hnmod(&dir, "a-renamed.hnmod", "minimap", "1.4.0");
+        fs::write(dir.join("notes.txt"), "not a mod").unwrap();
+        let files = hnmod_files(&dir).unwrap();
+        assert_eq!(files, vec![minimap.clone(), zoom.clone()]);
+        let base = "6".repeat(40);
+        let request = request_for("x86_64-unknown-linux-gnu", &base, &files).unwrap();
+        let expected = Request::new(
+            "x86_64-unknown-linux-gnu",
+            &base,
+            vec![
+                Mod {
+                    id: "zoom".into(),
+                    version: "2.0.0".into(),
+                    sha256: sha256(&zoom),
+                },
+                Mod {
+                    id: "minimap".into(),
+                    version: "1.4.0".into(),
+                    sha256: sha256(&minimap),
+                },
+            ],
+        )
+        .unwrap();
+        assert_eq!(request, expected);
+        // Another file for the same mod and version is another build.
+        let other = scratch("request-other");
+        let edited = hnmod_with(&other, "b.hnmod", "zoom", "2.0.0", "# edited\n");
+        fs::copy(&minimap, other.join("a.hnmod")).unwrap();
+        let changed = request_for(
+            "x86_64-unknown-linux-gnu",
+            &base,
+            &hnmod_files(&other).unwrap(),
+        )
+        .unwrap();
+        assert_ne!(sha256(&edited), sha256(&zoom));
+        assert_ne!(changed.key(), request.key());
+        fs::remove_dir_all(dir).unwrap();
+        fs::remove_dir_all(other).unwrap();
+    }
+
+    #[test]
+    fn a_file_the_registry_would_refuse_names_no_build() {
+        let dir = scratch("refused");
+        fs::write(dir.join("broken.hnmod"), b"not a zip").unwrap();
+        let files = hnmod_files(&dir).unwrap();
+        assert!(request_for("x86_64-unknown-linux-gnu", &"6".repeat(40), &files).is_err());
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn an_export_needs_mods_and_a_new_folder_before_anything_runs() {
+        let mods = scratch("export-mods");
+        let out = scratch("export-out");
+        let nothing = export("v0.0.1", &mods, &out.join("new"), Profile::Release, |_| {});
+        assert!(nothing.unwrap_err().contains("no .hnmod"));
+        hnmod(&mods, "zoom.hnmod", "zoom", "2.0.0");
+        fs::write(out.join("left-over"), "").unwrap();
+        let taken = export("v0.0.1", &mods, &out, Profile::Release, |_| {});
+        assert!(taken.unwrap_err().contains("already holds files"));
+        fs::remove_dir_all(mods).unwrap();
+        fs::remove_dir_all(out).unwrap();
+    }
+}

tools/ci/sign_native_build.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Signs one prebuilt native-mod build (#11859, crates/horizon-release-sign/src/native_build.rs) in
+# horizon-mods' native-build workflow: writes <key16>-<target>.sig beside the archive, one base64 Ed25519
+# signature per line over "horizon native build <key> <target>\n<sha256>  <archive>\n", for every key set in
+# NATIVE_BUILD_SIGNING_KEY and NATIVE_BUILD_SIGNING_KEY_NEXT (base64 PKCS#8, the `native-builds` environment's
+# secrets). The key and target are the workflow's own inputs, never read from the build: a build can only be
+# signed as the set it was asked for. The job that runs this holds the private keys, so it runs nothing from the
+# build but this file, which calls only sha256sum and OpenSSL.
+# Each key's public half must be listed in native-build-keys.txt (beside this repository's copy of the script),
+# else launchers would refuse the file: the script fails instead.
+# EPHEMERAL=yes (dry runs, tests) signs with a throwaway key instead and writes its public key to ephemeral.pub.
+#   tools/ci/sign_native_build.sh <key, 64 hex> <target> dist/<key16>-<target>.tar.gz
+set -euo pipefail
+key=$1 target=$2 archive=$3
+openssl=${OPENSSL:-openssl}
+keys_file=${NATIVE_BUILD_KEYS:-$(dirname "$0")/../../crates/horizon-release-sign/native-build-keys.txt}
+[[ "$key" =~ ^[0-9a-f]{64}$ ]] || { echo "$key: not a build key (64 lowercase hex digits)" >&2; exit 1; }
+[[ "$target" =~ ^[a-z0-9_]+(-[a-z0-9_]+)+$ ]] || { echo "$target: not a target triple" >&2; exit 1; }
+dir=$(dirname "$archive")
+name=$(basename "$archive")
+[[ "$name" == "${key:0:16}-$target.tar.gz" ]] || { echo "$name: must be named ${key:0:16}-$target.tar.gz" >&2; exit 1; }
+if command -v sha256sum > /dev/null; then sha=$(sha256sum < "$archive"); else sha=$(shasum -a 256 < "$archive"); fi
+sha=${sha%% *}
+umask 077
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+printf 'horizon native build %s %s\n%s  %s\n' "$key" "$target" "$sha" "$name" > "$work/message"
+out="$dir/${key:0:16}-$target.sig"
+rm -f "$out" "$dir/ephemeral.pub"
+
+sign_with() {  # the key file in $1; $2 = "listed" to require its public key in the keys file
+  "$openssl" pkey -inform DER -in "$1" -pubout -outform DER | tail -c 32 | base64 > "$work/public"
+  if [[ "$2" == listed ]] && ! grep -qxF "$(cat "$work/public")" <(sed 's/[[:space:]]//g' "$keys_file"); then
+    echo "a signing key's public half is not in $(basename "$keys_file"): launchers would refuse this build" >&2
+    exit 1
+  fi
+  "$openssl" pkeyutl -sign -rawin -inkey "$1" -keyform DER -in "$work/message" -out "$work/signature"
+  "$openssl" pkeyutl -verify -rawin -pubin -inkey <("$openssl" pkey -inform DER -in "$1" -pubout) \
+    -in "$work/message" -sigfile "$work/signature" > /dev/null
+  base64 < "$work/signature" | tr -d '\n' >> "$out"
+  echo >> "$out"
+  rm -f "$1" "$work/signature"
+}
+
+if [[ -n "${EPHEMERAL:-}" ]]; then
+  "$openssl" genpkey -algorithm ed25519 -outform DER -out "$work/key"
+  "$openssl" pkey -inform DER -in "$work/key" -pubout -outform DER | tail -c 32 | base64 > "$dir/ephemeral.pub"
+  sign_with "$work/key" any
+else
+  for var in NATIVE_BUILD_SIGNING_KEY NATIVE_BUILD_SIGNING_KEY_NEXT; do
+    if [[ -n "${!var:-}" ]]; then
+      # From the environment into a private temporary file: never an argument, never printed.
+      printf '%s' "${!var}" | base64 --decode > "$work/key"
+      sign_with "$work/key" listed
+    fi
+  done
+fi
+[[ -s "$out" ]] || { echo "no signing key: NATIVE_BUILD_SIGNING_KEY is not set" >&2; exit 1; }
+echo "$name: sha256 $sha, signed with $(wc -l < "$out" | tr -d ' ') key(s) into $(basename "$out")"