feat(marketplace): propagate signing keys in indexes

Co-Authored-By: Virgil <virgil@lethean.io>

marketplace/builder.go

@@ -66,9 +66,10 @@ func (b *Builder) BuildFromDirs(dirs ...string) (*Index, error) {
 			seen[m.Code] = true
 
 			mod := Module{
-				Code: m.Code,
-				Name: m.Name,
-				Repo: b.repoURL(m.Code),
+				Code:    m.Code,
+				Name:    m.Name,
+				Repo:    b.repoURL(m.Code),
+				SignKey: m.Sign,
 			}
 			modules = append(modules, mod)
 		}
@@ -102,8 +103,9 @@ func BuildFromManifests(manifests []*manifest.Manifest) *Index {
 		seen[m.Code] = true
 
 		modules = append(modules, Module{
-			Code: m.Code,
-			Name: m.Name,
+			Code:    m.Code,
+			Name:    m.Name,
+			SignKey: m.Sign,
 		})
 	}
 

marketplace/builder_test.go

@@ -23,6 +23,15 @@ func writeManifestYAML(t *testing.T, dir, code, name, version string) {
 	require.NoError(t, os.WriteFile(filepath.Join(coreDir, "manifest.yaml"), []byte(yaml), 0644))
 }
 
+// writeManifestYAMLWithSign writes a .core/manifest.yaml with a signing key.
+func writeManifestYAMLWithSign(t *testing.T, dir, code, name, version, sign string) {
+	t.Helper()
+	coreDir := filepath.Join(dir, ".core")
+	require.NoError(t, os.MkdirAll(coreDir, 0755))
+	yaml := "code: " + code + "\nname: " + name + "\nversion: " + version + "\nsign: " + sign + "\n"
+	require.NoError(t, os.WriteFile(filepath.Join(coreDir, "manifest.yaml"), []byte(yaml), 0644))
+}
+
 // writeCoreJSON writes a core.json for a module directory.
 func writeCoreJSON(t *testing.T, dir, code, name, version string) {
 	t.Helper()
@@ -56,6 +65,20 @@ func TestBuildFromDirs_Good_ManifestYAML_Good(t *testing.T) {
 	assert.Equal(t, IndexVersion, idx.Version)
 }
 
+func TestBuildFromDirs_Good_CarriesSignKey_Good(t *testing.T) {
+	root := t.TempDir()
+	modDir := filepath.Join(root, "signed-mod")
+	require.NoError(t, os.MkdirAll(modDir, 0755))
+	writeManifestYAMLWithSign(t, modDir, "signed-mod", "Signed Module", "1.0.0", "abc123")
+
+	b := &Builder{}
+	idx, err := b.BuildFromDirs(root)
+	require.NoError(t, err)
+
+	require.Len(t, idx.Modules, 1)
+	assert.Equal(t, "abc123", idx.Modules[0].SignKey)
+}
+
 func TestBuildFromDirs_Good_CoreJSON_Good(t *testing.T) {
 	root := t.TempDir()
 	modDir := filepath.Join(root, "compiled-mod")
@@ -168,14 +191,16 @@ func TestBuildFromDirs_Good_NoRepoURLWithoutConfig_Good(t *testing.T) {
 
 func TestBuildFromManifests_Good(t *testing.T) {
 	manifests := []*manifest.Manifest{
-		{Code: "bravo", Name: "Bravo"},
-		{Code: "alpha", Name: "Alpha"},
+		{Code: "bravo", Name: "Bravo", Sign: "key-bravo"},
+		{Code: "alpha", Name: "Alpha", Sign: "key-alpha"},
 	}
 	idx := BuildFromManifests(manifests)
 	require.Len(t, idx.Modules, 2)
 	assert.Equal(t, "alpha", idx.Modules[0].Code)
 	assert.Equal(t, "bravo", idx.Modules[1].Code)
 	assert.Equal(t, IndexVersion, idx.Version)
+	assert.Equal(t, "key-alpha", idx.Modules[0].SignKey)
+	assert.Equal(t, "key-bravo", idx.Modules[1].SignKey)
 }
 
 func TestBuildFromManifests_Good_SkipsNil_Good(t *testing.T) {

marketplace/indexer.go

@@ -48,8 +48,9 @@ func BuildIndex(medium io.Medium, repoPaths []string, opts IndexOptions) (*Index
 		seen[m.Code] = true
 
 		module := Module{
-			Code: m.Code,
-			Name: m.Name,
+			Code:    m.Code,
+			Name:    m.Name,
+			SignKey: m.Sign,
 		}
 		if opts.ForgeURL != "" && opts.Org != "" {
 			module.Repo = opts.ForgeURL + "/" + opts.Org + "/" + m.Code

marketplace/indexer_test.go

@@ -17,16 +17,19 @@ func TestBuildIndex_Good_CategoriesAndRepoURLs_Good(t *testing.T) {
 code: a
 name: Alpha
 version: 1.0.0
+sign: key-a
 `))
 	require.NoError(t, medium.Write("/repos/b/.core/manifest.yaml", `
 code: b
 name: Beta
 version: 1.0.0
+sign: key-b
 `))
 	require.NoError(t, medium.Write("/repos/c/.core/manifest.yaml", `
 code: c
 name: Gamma
 version: 1.0.0
+sign: key-c
 `))
 
 	idx, err := BuildIndex(medium, []string{"/repos/a", "/repos/b", "/repos/c"}, IndexOptions{
@@ -47,6 +50,7 @@ version: 1.0.0
 	assert.Equal(t, "a", idx.Modules[0].Code)
 	assert.Equal(t, "https://forge.example.com/core/a", idx.Modules[0].Repo)
 	assert.Equal(t, "tools", idx.Modules[0].Category)
+	assert.Equal(t, "key-a", idx.Modules[0].SignKey)
 	assert.Equal(t, []string{"products", "tools"}, idx.Categories)
 }
 
@@ -57,6 +61,7 @@ func TestBuildIndex_Good_SkipsMissingManifest_Good(t *testing.T) {
 code: one
 name: One
 version: 1.0.0
+sign: key-one
 `))
 
 	idx, err := BuildIndex(medium, []string{"/repos/one", "/repos/missing"}, IndexOptions{})