Signed download endpoint — ed25519 time-limited download URLs #622

New Issue

2026-06-12T07:58:57Z

jmiller commented

2026-06-12 07:58:57 +00:00

Phase 2.2 — Signed Downloads

Parent: #616 | Depends on: #621

routers/api/v1/licensing/download.go + services/licensing/signer.go:

Route

GET /api/v1/licensing/download/{product}/{version}.zip?token=SIGNED&expires=TIMESTAMP

Signing (ed25519, Go stdlib)

Generate ed25519 keypair on first run, store private key in Gitea's app.ini or data dir
Token = base64url(ed25519.Sign(privateKey, "product|version|dlid|expires"))
Validation: verify signature, check expiry (5 min TTL), serve release asset from Gitea's existing release attachment system

Flow

Token generated by update XML endpoint (#621) with 5-minute expiry
Joomla downloads the ZIP within the window
Gitea verifies signature + expiry
Serves the release asset (ZIP) from the corresponding repo's latest release
Logs the download (license_id, product, version, domain, timestamp)

Acceptance criteria

ed25519 signing with Go crypto/ed25519 (no external deps)
5-minute TTL on download tokens
Expired/invalid tokens return 403
Downloads served from existing Gitea release attachments
Download logged for analytics

## Phase 2.2 — Signed Downloads Parent: #616 | Depends on: #621 `routers/api/v1/licensing/download.go` + `services/licensing/signer.go`: ### Route `GET /api/v1/licensing/download/{product}/{version}.zip?token=SIGNED&expires=TIMESTAMP` ### Signing (ed25519, Go stdlib) - Generate ed25519 keypair on first run, store private key in Gitea's app.ini or data dir - Token = base64url(ed25519.Sign(privateKey, "product|version|dlid|expires")) - Validation: verify signature, check expiry (5 min TTL), serve release asset from Gitea's existing release attachment system ### Flow 1. Token generated by update XML endpoint (#621) with 5-minute expiry 2. Joomla downloads the ZIP within the window 3. Gitea verifies signature + expiry 4. Serves the release asset (ZIP) from the corresponding repo's latest release 5. Logs the download (license_id, product, version, domain, timestamp) ### Acceptance criteria - [ ] ed25519 signing with Go crypto/ed25519 (no external deps) - [ ] 5-minute TTL on download tokens - [ ] Expired/invalid tokens return 403 - [ ] Downloads served from existing Gitea release attachments - [ ] Download logged for analytics

jmiller commented

2026-06-12 07:58:59 +00:00

Branch created: feature/622-signed-download-endpoint-ed25519-time-li

git fetch origin
git checkout feature/622-signed-download-endpoint-ed25519-time-li

Branch created: [`feature/622-signed-download-endpoint-ed25519-time-li`](https://code.mokoconsulting.tech/MokoConsulting/MokoGitea-APP/src/branch/feature/622-signed-download-endpoint-ed25519-time-li) ```bash git fetch origin git checkout feature/622-signed-download-endpoint-ed25519-time-li ```

jmiller referenced this issue

2026-06-12 08:05:11 +00:00

ROADMAP — Multi-repo licensing system implementation plan #616

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-Fork#622