feat(license): add signing and the trusted key list

shared/license/keys.go

@@ -0,0 +1,38 @@
+package license
+
+import (
+	"fmt"
+
+	"github.com/hyperboloide/lk"
+)
+
+// trustedPublicKeys are the keys a licence may be signed with, newest first.
+//
+// To rotate: prepend the new key, ship a server release that trusts both, then
+// reissue. Remove a retired key only once every licence signed with it has
+// expired.
+//
+// This is a slice from day one even though it holds one entry, because
+// retrofitting a single-key verifier into a multi-key one during an incident is
+// not a thing to plan for.
+//
+// These are compiled in and deliberately not configurable. A configurable trust
+// root is a licensing bypass: a self-hosted operator could point it at a keypair
+// they generated themselves.
+var trustedPublicKeys = []string{
+	// Populated in Task 6 with the real production key.
+	// Until then this slice is empty and every licence fails to verify,
+	// which is the correct default for a build with no trust root.
+}
+
+func publicKeys() ([]*lk.PublicKey, error) {
+	out := make([]*lk.PublicKey, 0, len(trustedPublicKeys))
+	for i, s := range trustedPublicKeys {
+		k, err := lk.PublicKeyFromB32String(s)
+		if err != nil {
+			return nil, fmt.Errorf("trusted public key %d is malformed: %w", i, err)
+		}
+		out = append(out, k)
+	}
+	return out, nil
+}