new plugin signing and checking

2026-04-14 09:56:20 -05:00
parent 60baac85cd
commit 59da653142
15 changed files with 1022 additions and 43 deletions
@@ -0,0 +1,51 @@
+import { writeFileSync } from "fs";
+import { resolve } from "path";
+
+async function main() {
+  const args = process.argv.slice(2);
+  let prefix = "plugin-signing";
+
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--out" && args[i + 1]) {
+      prefix = args[i + 1];
+      i++;
+    }
+  }
+
+  const keyPair = await crypto.subtle.generateKey("Ed25519", true, [
+    "sign",
+    "verify",
+  ]);
+
+  const privRaw = await crypto.subtle.exportKey("pkcs8", keyPair.privateKey);
+  const privBase64 = Buffer.from(privRaw).toString("base64");
+
+  const pubRaw = await crypto.subtle.exportKey("raw", keyPair.publicKey);
+  const pubBase64 = Buffer.from(pubRaw).toString("base64");
+
+  const fingerprintBuf = await crypto.subtle.digest("SHA-256", pubRaw);
+  const fingerprint = Buffer.from(fingerprintBuf).toString("hex");
+
+  const keyPath = resolve(prefix + ".key");
+  const pubPath = resolve(prefix + ".pub");
+
+  writeFileSync(keyPath, privBase64 + "\n", { mode: 0o600 });
+  writeFileSync(
+    pubPath,
+    `${pubBase64}\n# fingerprint: ${fingerprint}\n`,
+    { mode: 0o644 },
+  );
+
+  console.log(`Key pair generated:`);
+  console.log(`  Private key: ${keyPath}`);
+  console.log(`  Public key:  ${pubPath}`);
+  console.log(`  Fingerprint: ${fingerprint}`);
+  console.log(``);
+  console.log(`Add this fingerprint to your server config to trust plugins signed with this key:`);
+  console.log(`  "plugins": { "trustedKeys": ["${fingerprint}"] }`);
+}
+
+main().catch((err) => {
+  console.error("Error:", err.message || err);
+  process.exit(1);
+});