feat: accept Ed25519-signed license keys alongside RSA (#11810)

* feat: accept Ed25519-signed license keys alongside RSA

* fix: gate the Ed25519 renewal flag on the worker fleet version

* chore: update ee-repo-ref to 664708fff04d4f9e0660bcae3edb307fb2c9481b

This commit updates the EE repository reference after PR #887 was merged in windmill-ee-private.

Previous ee-repo-ref: 5c18fdde212aa1185c405be9c5e194209c5a8ee9

New ee-repo-ref: 664708fff04d4f9e0660bcae3edb307fb2c9481b

Automated by sync-ee-ref workflow.

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/Cargo.lock

@@ -16160,6 +16160,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "chrono",
+ "ed25519-dalek",
  "futures",
  "lazy_static",
  "regex",

backend/ee-repo-ref.txt

@@ -1 +1 @@
-d29a7c0dad120e137105b1186d0bbe3ea1504b5d
+664708fff04d4f9e0660bcae3edb307fb2c9481b

backend/windmill-api-settings/Cargo.toml

@@ -13,7 +13,7 @@ default = []
 enterprise = ["license"]
 private = ["windmill-common/private", "windmill-audit/private"]
 parquet = ["windmill-common/parquet", "windmill-object-store/parquet"]
-license = ["dep:rsa"]
+license = ["dep:rsa", "dep:ed25519-dalek"]
 
 [dependencies]
 windmill-ai = { workspace = true, default-features = false }
@@ -38,4 +38,5 @@ uuid.workspace = true
 base64.workspace = true
 sha2.workspace = true
 rsa = { workspace = true, optional = true }
+ed25519-dalek = { workspace = true, optional = true }
 windmill-object-store.workspace = true

backend/windmill-common/src/min_version.rs

@@ -30,6 +30,11 @@ pub const MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES: VC = vc(1, 822, 0, "Restricted
 // Also gates widening `variable.value`, which needs every process to retire the connections
 // the widening poisons (`db::retire_connections_opened_before_now`): that also ships in 1.832.
 pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 832, 0, "AES-GCM secret encryption");
+// A renewed license key replaces the one every process reads, and a worker that predates
+// Ed25519 support rejects an Ed25519-signed key and stops pulling jobs, so renewal only offers
+// to accept one once this is met. Only worker versions are seen here, not servers. Must name
+// the release this ships in.
+pub const MIN_VERSION_SUPPORTS_ED25519_LICENSE: VC = vc(1, 838, 0, "Ed25519 license keys");
 pub const MIN_VERSION_SUPPORTS_NODE_DEBOUNCING: VC = vc(1, 658, 0, "Flow node debouncing");
 pub const MIN_VERSION_SUPPORTS_TOKEN_HASH: VC = vc(1, 659, 0, "Token hash storage");
 pub const MIN_VERSION_SUPPORTS_SYNC_JOBS_DEBOUNCING: VC = vc(1, 602, 0, "Sync jobs debouncing");