feat(license): add signing and the trusted key list

shared/license/sign.go

@@ -0,0 +1,43 @@
+//go:build !noSign
+
+package license
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/hyperboloide/lk"
+)
+
+// Sign marshals a licence and signs it, returning the base32 blob.
+//
+// This file carries the !noSign build tag so the signing path can be compiled
+// out of the control plane. The server has no reason to hold signing code and
+// no reason to ship it into a customer's data centre.
+//
+// privateKeyB32 comes from LICENSE_SIGNING_KEY on the issuing side only.
+func Sign(l License, privateKeyB32 string) (string, error) {
+	if privateKeyB32 == "" {
+		return "", fmt.Errorf("no signing key provided")
+	}
+	priv, err := lk.PrivateKeyFromB32String(privateKeyB32)
+	if err != nil {
+		return "", fmt.Errorf("parse signing key: %w", err)
+	}
+
+	data, err := json.Marshal(l)
+	if err != nil {
+		return "", fmt.Errorf("marshal licence: %w", err)
+	}
+
+	signed, err := lk.NewLicense(priv, data)
+	if err != nil {
+		return "", fmt.Errorf("sign licence: %w", err)
+	}
+
+	blob, err := signed.ToB32String()
+	if err != nil {
+		return "", fmt.Errorf("encode licence: %w", err)
+	}
+	return blob, nil
+}