Repository: syncthing/syncthing (language: go)

Issue:
Embed binary releases signing key as a file instead of hardcoding a string
Currently, signing key is hardcoded as text:  
https://github.com/syncthing/syncthing/blob/2ae15aa4546b8cf76cd6077303aa6b97e2e043ee/lib/upgrade/signingkey.go#L14-L19

[Release Signing page](https://docs.syncthing.net/dev/release-signing.html) states:  
> You can then sign binaries with the private key using stsigtool sign, verify them with the public key using stsigtool verify, _and have Syncthing accept these signatures by replacing the compiled in public key_. This may be useful in an enterprise setting, for example.

So, "in an enterprise setting" you'd either need to patch/replace `signingkey.go` on the fly or maintain separate copy of the repo and rebase signature changes on top of every release.

## Solution

Since introduction of `embed` package in Go 1.16 embedding keyfile becomes as simple as this:
```go

import _ "embed"

//go:embed pubkey.pem
var SigningKey []byte
```

```
$ cat pubkey.pem
-----BEGIN EC PUBLIC KEY----- 
MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA1iRk+p+DsmolixxVKcpEVlMDPOeQ 
1dWthURMqsjxoJuDAe5I98P/A0kXSdBI7avm5hXhX2opJ5TAyBZLHPpDTRoBg4WN 
7jUpeAjtPoVVxvOh37qDeDVcjCgJbbDTPKbjxq/Ae3SHlQMRcoes7lVY1+YJ8dPk 
2oPfjA6jtmo9aVbf/uo= 
-----END EC PUBLIC KEY-----
```

This makes it possible to simply replace `pubkey.pem` during build without fiddling with go source files.
Embed binary releases signing key as a file instead of hardcoding a string
Currently, signing key is hardcoded as text:  
https://github.com/syncthing/syncthing/blob/2ae15aa4546b8cf76cd6077303aa6b97e2e043ee/lib/upgrade/signingkey.go#L14-L19

[Release Signing page](https://docs.syncthing.net/dev/release-signing.html) states:  
> You can then sign binaries with the private key using stsigtool sign, verify them with the public key using stsigtool verify, _and have Syncthing accept these signatures by replacing the compiled in public key_. This may be useful in an enterprise setting, for example.

So, "in an enterprise setting" you'd either need to patch/replace `signingkey.go` on the fly or maintain separate copy of the repo and rebase signature changes on top of every release.

## Solution

Since introduction of `embed` package in Go 1.16 embedding keyfile becomes as simple as this:
```go

import _ "embed"

//go:embed pubkey.pem
var SigningKey []byte
```

```
$ cat pubkey.pem
-----BEGIN EC PUBLIC KEY----- 
MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA1iRk+p+DsmolixxVKcpEVlMDPOeQ 
1dWthURMqsjxoJuDAe5I98P/A0kXSdBI7avm5hXhX2opJ5TAyBZLHPpDTRoBg4WN 
7jUpeAjtPoVVxvOh37qDeDVcjCgJbbDTPKbjxq/Ae3SHlQMRcoes7lVY1+YJ8dPk 
2oPfjA6jtmo9aVbf/uo= 
-----END EC PUBLIC KEY-----
```

This makes it possible to simply replace `pubkey.pem` during build without fiddling with go source files.


Discussion / hints:

Fix patch:
diff --git a/lib/upgrade/signingkey.go b/lib/upgrade/signingkey.go
index 57daa322741..df59c39460a 100644
--- a/lib/upgrade/signingkey.go
+++ b/lib/upgrade/signingkey.go
@@ -6,14 +6,13 @@
 
 package upgrade
 
+import _ "embed"
+
 // SigningKey is the public key used to verify signed upgrades. It must match
 // the private key used to sign binaries for the built in upgrade mechanism to
 // accept an upgrade. Keys and signatures can be created and verified with the
 // stsigtool utility. The build script creates signed binaries when given the
 // -sign option.
-var SigningKey = []byte(`-----BEGIN EC PUBLIC KEY-----
-MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA1iRk+p+DsmolixxVKcpEVlMDPOeQ
-1dWthURMqsjxoJuDAe5I98P/A0kXSdBI7avm5hXhX2opJ5TAyBZLHPpDTRoBg4WN
-7jUpeAjtPoVVxvOh37qDeDVcjCgJbbDTPKbjxq/Ae3SHlQMRcoes7lVY1+YJ8dPk
-2oPfjA6jtmo9aVbf/uo=
------END EC PUBLIC KEY-----`)
+//
+//go:embed signingkey.pem
+var SigningKey []byte
diff --git a/lib/upgrade/signingkey.pem b/lib/upgrade/signingkey.pem
new file mode 100644
index 00000000000..5f9f3064919
--- /dev/null
+++ b/lib/upgrade/signingkey.pem
@@ -0,0 +1,6 @@
+-----BEGIN EC PUBLIC KEY-----
+MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA1iRk+p+DsmolixxVKcpEVlMDPOeQ
+1dWthURMqsjxoJuDAe5I98P/A0kXSdBI7avm5hXhX2opJ5TAyBZLHPpDTRoBg4WN
+7jUpeAjtPoVVxvOh37qDeDVcjCgJbbDTPKbjxq/Ae3SHlQMRcoes7lVY1+YJ8dPk
+2oPfjA6jtmo9aVbf/uo=
+-----END EC PUBLIC KEY-----
\ No newline at end of file


Test patch: