42 lines
1.4 KiB
JavaScript
42 lines
1.4 KiB
JavaScript
|
#!/usr/bin/env node
|
||
|
|
// Generate an Ed25519 keypair for signing add-on updates.
|
||
|
|
//
|
||
|
|
// node scripts/generate-update-keypair.mjs <out-dir>
|
||
|
|
//
|
||
|
|
// Writes:
|
||
|
|
// <out-dir>/addon-update-key.pem — PKCS#8 PEM private key (keep secret)
|
||
|
|
// Prints:
|
||
|
|
// <64-char hex pubkey> — copy into addon-update-pubkeys.js
|
||
|
|
//
|
||
|
|
// The out-dir MUST NOT be inside the repo. Recommended: a machine-local
|
||
|
|
// ops folder outside git, e.g. `%USERPROFILE%\.silentmode\ops`.
|
||
|
|
|
||
|
|
import fs from "node:fs";
|
||
|
|
import path from "node:path";
|
||
|
|
import crypto from "node:crypto";
|
||
|
|
import process from "node:process";
|
||
|
|
|
||
|
|
const outDir = process.argv[2];
|
||
|
|
if (!outDir) {
|
||
|
|
console.error("usage: node scripts/generate-update-keypair.mjs <out-dir>");
|
||
|
|
process.exit(2);
|
||
|
|
}
|
||
|
|
fs.mkdirSync(outDir, { recursive: true });
|
||
|
|
const keyPath = path.join(outDir, "addon-update-key.pem");
|
||
|
|
if (fs.existsSync(keyPath)) {
|
||
|
|
console.error(`refuse to overwrite existing key at ${keyPath}`);
|
||
|
|
process.exit(1);
|
||
|
|
}
|
||
|
|
|
||
|
|
const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
|
||
|
|
fs.writeFileSync(keyPath, privateKey.export({ type: "pkcs8", format: "pem" }), { mode: 0o600 });
|
||
|
|
|
||
|
|
// Extract the 32-byte raw pubkey from the SPKI DER.
|
||
|
|
const der = publicKey.export({ type: "spki", format: "der" });
|
||
|
|
const raw = der.subarray(der.length - 32);
|
||
|
|
const hex = raw.toString("hex");
|
||
|
|
|
||
|
|
console.log(`private key written to ${keyPath}`);
|
||
|
|
console.log(`public key (paste into addon-update-pubkeys.js PUBKEYS_HEX):`);
|
||
|
|
console.log(` "${hex}"`);
|