feat: add plugin packing, signing, pinned trust and tmxplug bundling

packages/plugin-sdk/cli/commands/pack.mjs

@@ -1,19 +1,23 @@
 import fs from "node:fs";
 import path from "node:path";
-import { create } from "tar";
 import { readManifest } from "../lib/plugin-dir.mjs";
+import { collectFiles, createTmxplug } from "../lib/tmxplug.mjs";
+import { sha256 } from "../lib/signing.mjs";
+import { validate } from "./validate.mjs";
 
-/** Everything a server needs to run the plugin, and nothing else. D3 signs it. */
-const CONTENTS = [
-  "manifest.json",
-  "dist",
-  "locales",
-  "migrations",
-  "README.md",
-  "CHANGELOG.md",
-];
+function readOption(args, name) {
+  const index = args.indexOf(name);
+  if (index === -1) return null;
+  const value = args[index + 1];
+  if (!value) throw new Error(`${name} needs a value`);
+  return value;
+}
 
-export async function pack({ cwd }) {
+/**
+ * Writes <id>-<version>.tmxplug. Validates first and refuses on any error,
+ * so a broken manifest never becomes a release.
+ */
+export async function pack({ cwd, args = [] }) {
   const manifest = readManifest(cwd);
   const pluginId = manifest.id ?? path.basename(cwd);
   const version = manifest.version ?? "0.0.0";
@@ -22,12 +26,17 @@ export async function pack({ cwd }) {
     throw new Error(`${pluginId}: nothing built. Run termix-plugin build.`);
   }
 
-  const files = CONTENTS.filter((entry) =>
-    fs.existsSync(path.join(cwd, entry)),
-  );
-  const outfile = path.join(cwd, `${pluginId}-${version}.tgz`);
+  await validate({ cwd });
 
-  await create({ gzip: true, cwd, file: outfile }, files);
+  const outDir = path.resolve(cwd, readOption(args, "--out") ?? ".");
+  fs.mkdirSync(outDir, { recursive: true });
+  const outfile = path.join(outDir, `${pluginId}-${version}.tmxplug`);
+
+  const archive = createTmxplug(cwd, collectFiles(cwd));
+  fs.writeFileSync(outfile, archive);
 
   console.log(`packed ${path.basename(outfile)}`);
+  console.log(`  size    ${archive.length}`);
+  console.log(`  sha256  ${sha256(archive).toString("hex")}`);
+  return outfile;
 }

packages/plugin-sdk/cli/commands/sign.mjs

@@ -0,0 +1,83 @@
+import fs from "node:fs";
+import path from "node:path";
+import {
+  SIGNING_KEY_ENV,
+  generateKeyPair,
+  loadPrivateKey,
+  sha256,
+  signArtifact,
+  verifyArtifact,
+} from "../lib/signing.mjs";
+
+function readOption(args, name) {
+  const index = args.indexOf(name);
+  if (index === -1) return null;
+  const value = args[index + 1];
+  if (!value) throw new Error(`${name} needs a value`);
+  return value;
+}
+
+function artifactArg(cwd, args) {
+  const file = args.find((arg) => arg.endsWith(".tmxplug"));
+  if (!file) throw new Error("Pass the .tmxplug file to use");
+  const full = path.resolve(cwd, file);
+  if (!fs.existsSync(full)) throw new Error(`${file} does not exist`);
+  return full;
+}
+
+/** Writes <file>.sig: base64 Ed25519 over the sha256 of the .tmxplug. */
+export async function sign({ cwd, args = [], env = process.env }) {
+  const file = artifactArg(cwd, args);
+  const key = loadPrivateKey(env[SIGNING_KEY_ENV]);
+  const buffer = fs.readFileSync(file);
+  const signature = signArtifact(buffer, key);
+  fs.writeFileSync(`${file}.sig`, `${signature}\n`);
+  console.log(`signed ${path.basename(file)}`);
+  console.log(`  sha256     ${sha256(buffer).toString("hex")}`);
+  console.log(`  signature  ${signature}`);
+  return signature;
+}
+
+/** Checks a .tmxplug against its .sig and one or more public keys. */
+export async function verify({ cwd, args = [] }) {
+  const file = artifactArg(cwd, args);
+  const keys = (readOption(args, "--key") ?? "")
+    .split(",")
+    .map((key) => key.trim())
+    .filter(Boolean);
+  if (keys.length === 0) throw new Error("Pass --key <base64 public key>");
+  const sigFile = readOption(args, "--sig") ?? `${file}.sig`;
+  if (!fs.existsSync(sigFile)) throw new Error(`${sigFile} does not exist`);
+
+  const matched = verifyArtifact(
+    fs.readFileSync(file),
+    fs.readFileSync(sigFile, "utf8"),
+    keys,
+  );
+  if (!matched)
+    throw new Error(`${path.basename(file)}: signature is not valid`);
+  console.log(`ok  ${path.basename(file)} signed by key ${matched}`);
+  return matched;
+}
+
+/**
+ * Writes a new private key to a file and prints the public half. The
+ * private key never goes to stdout, so it does not end up in a CI log.
+ */
+export async function keygen({ cwd, args = [] }) {
+  const outDir = path.resolve(cwd, readOption(args, "--out") ?? ".");
+  const keyFile = path.join(outDir, "termix-plugin-signing.key");
+  if (fs.existsSync(keyFile)) {
+    throw new Error(`${keyFile} already exists; move it first`);
+  }
+  const pair = generateKeyPair();
+  fs.mkdirSync(outDir, { recursive: true });
+  fs.writeFileSync(keyFile, `${pair.privateKey}\n`, { mode: 0o600 });
+  console.log(`private key  ${keyFile}`);
+  console.log(`public key   ${pair.publicKey}`);
+  console.log(`key id       ${pair.keyId}`);
+  console.log(
+    `Store the private key as ${SIGNING_KEY_ENV}, then delete the file.`,
+  );
+  return { keyFile, publicKey: pair.publicKey, keyId: pair.keyId };
+}