Hardware-backed deployment signing
Every deployment to an Aureus cluster can be cryptographically signed with a YubiKey. The private key is generated inside the YubiKey's secure element and physically cannot leave the device. Before any deployment goes live, our infrastructure verifies that the code being deployed is byte-for-byte identical to what a key holder on your team signed — if a single file was added, removed, or modified after signing, the deployment is rejected before it reaches your cluster.
How it works
The signing tool computes a SHA-256 checksum of every file in your repository and writes them to a manifest. Your YubiKey then signs the manifest with an ECDSA P-256 key held in its PIV applet — confirming with your PIN at the moment of signing. At deploy time, our verifier fetches your registered public key from the Aureus API, validates the signature, and re-computes every checksum independently. Stolen repository credentials are not enough to ship code to your infrastructure; only someone holding a registered YubiKey can produce a deployable release.
Registering your YubiKey
Each team member registers their own YubiKey from the dashboard under Account menu → Security. The process takes a few minutes:
1. Install yubico-piv-tool (brew install yubico-piv-tool on macOS, sudo apt install yubico-piv-tool on Linux) and make sure Node.js 18+ is available.
2. Download the signing CLI and run node aureus-sign.mjs setup with your YubiKey plugged in. This generates the signing key on the device and prints your public key.
3. Paste the public key into the registration form on the Security page. The dashboard displays the key's fingerprint — confirm it matches the one printed by the CLI.
Signing a release
Before you push code for deployment, run node aureus-sign.mjs sign in your project directory. The tool checks that your YubiKey is present, hashes every file, and asks for your PIV PIN to sign the manifest. It writes two small files — .aureus-manifest and .aureus-manifest.sig — which you commit and push alongside your code. That's the entire workflow: sign, commit, push.
Files that should not be part of the signed release (build artifacts, local logs) can be excluded with a .aureusignore file. The ignore file itself is signed, so it cannot be tampered with to smuggle files past verification.
What happens at deploy time
Our deployment pipeline runs the Aureus verifier before your application is built. The verifier fails the deployment — and leaves your currently running version untouched — if any of the following is true:
— The manifest or signature file is missing.
— The signing key is not registered with Aureus, or has been revoked.
— The signature does not match the manifest.
— Any file's checksum differs from the signed manifest.
— Files are present that are not listed in the signed manifest.
Lost or compromised keys
If a YubiKey is lost or a team member leaves, revoke the key instantly from the Security page. Revocation takes effect immediately: any deployment signed with that key is rejected from that moment on, worldwide. Register a replacement key at any time — there is no limit on the number of keys per team.