@oniroproject/core 0.6.0 → 0.6.2

package/dist/index.d.cts

@@ -321,6 +321,23 @@ type Apl = 'normal' | 'system_basic' | 'system_core';
 type AppFeature = 'hos_normal_app' | 'hos_system_app';
 declare const APL_VALUES: readonly Apl[];
 declare const APP_FEATURE_VALUES: readonly AppFeature[];
+/**
+ * Which signing key pairs with the chosen `apl`.
+ *
+ * - `'profile-release'` — the **OpenHarmony Application Profile Release** key.
+ *   Default for apl=normal. Matches the cert chain that ships with the SDK
+ *   (`OpenHarmonyProfileRelease.pem`). What `hvigor` uses for ordinary apps.
+ *
+ * - `'application-release'` — the **OpenHarmony Application Release** key.
+ *   Required for apl=system_basic|system_core. BMS's parse-profile-prop check
+ *   rejects HAPs whose `distribution-certificate` subject is "Application
+ *   Profile Release" when the HAP requests permissions above its apl. The
+ *   matching cert chain (`OpenHarmonyApplication.cer`) is not shipped in the
+ *   SDK, so we ship it ourselves under `applicationCert.ts`.
+ */
+type SigningKind = 'profile-release' | 'application-release';
+/** @internal exposed for tests. */
+declare function pickSigningKind(apl: Apl): SigningKind;
 interface GenerateSigningConfigsOptions {
     /** Absolute path to the OpenHarmony project (the folder containing build-profile.json5). */
     projectDir: string;
@@ -338,9 +355,23 @@ interface GenerateSigningConfigsOptions {
      * when `apl='normal'`, otherwise `'hos_system_app'`.
      */
     appFeature?: AppFeature;
+    /**
+     * Permission names to write into the profile's `acls.allowed-acls`. Required for
+     * apps that request permissions above their `apl` (e.g. a system_basic app
+     * requesting `ohos.permission.CAPTURE_SCREEN`). When omitted, the template's
+     * existing `allowed-acls` is left alone.
+     */
+    acls?: string[];
     /** Optional logger; defaults to no-op. */
     logger?: Logger;
 }
+/**
+ * Read all `products[*].signingConfig` names from the project's build-profile.json5.
+ * Returns the unique names in declaration order. Falls back to `['default']` when
+ * the file is missing or has no products.
+ * @internal exposed for tests.
+ */
+declare function detectSigningConfigNames(projectDir: string): string[];
 /**
  * Generate signing configs for an OpenHarmony project: copies certs, signs the profile,
  * generates the signing material, and writes the resulting `signingConfigs` entry into
@@ -590,4 +621,4 @@ declare function writeJsonFile(filePath: string, value: unknown): void;
 
 declare const VERSION: string;
 
-export { ALL_SDKS, APL_VALUES, APP_FEATURE_VALUES, type Apl, type AppFeature, CancelledError, ChecksumMismatchError, CmdToolsNotInstalledError, type CmdToolsStatus, type ConfigKey, type ConfigProvider, type CreateScaffoldOptions, type CreateScaffoldResult, type DownloadOptions, type ExtractZipOptions, type GenerateSigningConfigsOptions, type HilogEntry, type HilogLevel, type InstallAppOptions, type InstallCmdToolsOptions, type InstallEmulatorOptions, type InstallSdkOptions, type LaunchAppOptions, type Logger, OHOS_URL_BASE, type OniroContext, OniroError, type OsFolder, type ProgressReporter, type ProgressUpdate, type Prompter, type RunHvigorwOptions, type RunHvigorwResult, type RunningProcess, type SdkArchiveInfo, type SdkInfo, SdkNotInstalledError, type SdkRelease, type SetHilogLevelOptions, type StartEmulatorOptions, type StreamHilogOptions, type TemplateOption, UnsupportedPlatformError, VERSION, attemptHdcConnection, consoleLogger, createMaterial, createScaffold, decryptPwd, defaultContext, defaultPaths, detectProjectSdkVersion, downloadAndInstallSdk, downloadFile, encryptPwd, extractTarball, extractZipWithProgress, findAppProcessId, findCmdToolsSourceDir, generateSigningConfigs, getBundleName, getCmdToolsBin, getCmdToolsDownloadUrl, getCmdToolsPath, getCmdToolsStatus, getEmulatorDir, getHdcPath, getHvigorwPath, getInstalledSdks, getKey, getMainAbility, getOhosBaseSdkHome, getOsFolder, getSdkFilename, getSdkRootDir, getSupportedSdksForUi, installApp, installCmdTools, installEmulator, isCmdToolsInstalled, isEmulatorInstalled, isValidBundleName, isValidProjectName, launchApp, listRunningProcesses, listTemplates, nonInteractivePrompter, noopLogger, noopProgress, parseHilogLine, readJson5File, readJsonFile, removeCmdTools, removeEmulator, removeSdk, runHvigorw, setHilogLevel, startEmulator, staticConfig, stopEmulator, streamHilog, validateTemplateLayout, verifySha256, writeJson5File, writeJsonFile };
+export { ALL_SDKS, APL_VALUES, APP_FEATURE_VALUES, type Apl, type AppFeature, CancelledError, ChecksumMismatchError, CmdToolsNotInstalledError, type CmdToolsStatus, type ConfigKey, type ConfigProvider, type CreateScaffoldOptions, type CreateScaffoldResult, type DownloadOptions, type ExtractZipOptions, type GenerateSigningConfigsOptions, type HilogEntry, type HilogLevel, type InstallAppOptions, type InstallCmdToolsOptions, type InstallEmulatorOptions, type InstallSdkOptions, type LaunchAppOptions, type Logger, OHOS_URL_BASE, type OniroContext, OniroError, type OsFolder, type ProgressReporter, type ProgressUpdate, type Prompter, type RunHvigorwOptions, type RunHvigorwResult, type RunningProcess, type SdkArchiveInfo, type SdkInfo, SdkNotInstalledError, type SdkRelease, type SetHilogLevelOptions, type SigningKind, type StartEmulatorOptions, type StreamHilogOptions, type TemplateOption, UnsupportedPlatformError, VERSION, attemptHdcConnection, consoleLogger, createMaterial, createScaffold, decryptPwd, defaultContext, defaultPaths, detectProjectSdkVersion, detectSigningConfigNames, downloadAndInstallSdk, downloadFile, encryptPwd, extractTarball, extractZipWithProgress, findAppProcessId, findCmdToolsSourceDir, generateSigningConfigs, getBundleName, getCmdToolsBin, getCmdToolsDownloadUrl, getCmdToolsPath, getCmdToolsStatus, getEmulatorDir, getHdcPath, getHvigorwPath, getInstalledSdks, getKey, getMainAbility, getOhosBaseSdkHome, getOsFolder, getSdkFilename, getSdkRootDir, getSupportedSdksForUi, installApp, installCmdTools, installEmulator, isCmdToolsInstalled, isEmulatorInstalled, isValidBundleName, isValidProjectName, launchApp, listRunningProcesses, listTemplates, nonInteractivePrompter, noopLogger, noopProgress, parseHilogLine, pickSigningKind, readJson5File, readJsonFile, removeCmdTools, removeEmulator, removeSdk, runHvigorw, setHilogLevel, startEmulator, staticConfig, stopEmulator, streamHilog, validateTemplateLayout, verifySha256, writeJson5File, writeJsonFile };

package/dist/index.d.ts

@@ -321,6 +321,23 @@ type Apl = 'normal' | 'system_basic' | 'system_core';
 type AppFeature = 'hos_normal_app' | 'hos_system_app';
 declare const APL_VALUES: readonly Apl[];
 declare const APP_FEATURE_VALUES: readonly AppFeature[];
+/**
+ * Which signing key pairs with the chosen `apl`.
+ *
+ * - `'profile-release'` — the **OpenHarmony Application Profile Release** key.
+ *   Default for apl=normal. Matches the cert chain that ships with the SDK
+ *   (`OpenHarmonyProfileRelease.pem`). What `hvigor` uses for ordinary apps.
+ *
+ * - `'application-release'` — the **OpenHarmony Application Release** key.
+ *   Required for apl=system_basic|system_core. BMS's parse-profile-prop check
+ *   rejects HAPs whose `distribution-certificate` subject is "Application
+ *   Profile Release" when the HAP requests permissions above its apl. The
+ *   matching cert chain (`OpenHarmonyApplication.cer`) is not shipped in the
+ *   SDK, so we ship it ourselves under `applicationCert.ts`.
+ */
+type SigningKind = 'profile-release' | 'application-release';
+/** @internal exposed for tests. */
+declare function pickSigningKind(apl: Apl): SigningKind;
 interface GenerateSigningConfigsOptions {
     /** Absolute path to the OpenHarmony project (the folder containing build-profile.json5). */
     projectDir: string;
@@ -338,9 +355,23 @@ interface GenerateSigningConfigsOptions {
      * when `apl='normal'`, otherwise `'hos_system_app'`.
      */
     appFeature?: AppFeature;
+    /**
+     * Permission names to write into the profile's `acls.allowed-acls`. Required for
+     * apps that request permissions above their `apl` (e.g. a system_basic app
+     * requesting `ohos.permission.CAPTURE_SCREEN`). When omitted, the template's
+     * existing `allowed-acls` is left alone.
+     */
+    acls?: string[];
     /** Optional logger; defaults to no-op. */
     logger?: Logger;
 }
+/**
+ * Read all `products[*].signingConfig` names from the project's build-profile.json5.
+ * Returns the unique names in declaration order. Falls back to `['default']` when
+ * the file is missing or has no products.
+ * @internal exposed for tests.
+ */
+declare function detectSigningConfigNames(projectDir: string): string[];
 /**
  * Generate signing configs for an OpenHarmony project: copies certs, signs the profile,
  * generates the signing material, and writes the resulting `signingConfigs` entry into
@@ -590,4 +621,4 @@ declare function writeJsonFile(filePath: string, value: unknown): void;
 
 declare const VERSION: string;
 
-export { ALL_SDKS, APL_VALUES, APP_FEATURE_VALUES, type Apl, type AppFeature, CancelledError, ChecksumMismatchError, CmdToolsNotInstalledError, type CmdToolsStatus, type ConfigKey, type ConfigProvider, type CreateScaffoldOptions, type CreateScaffoldResult, type DownloadOptions, type ExtractZipOptions, type GenerateSigningConfigsOptions, type HilogEntry, type HilogLevel, type InstallAppOptions, type InstallCmdToolsOptions, type InstallEmulatorOptions, type InstallSdkOptions, type LaunchAppOptions, type Logger, OHOS_URL_BASE, type OniroContext, OniroError, type OsFolder, type ProgressReporter, type ProgressUpdate, type Prompter, type RunHvigorwOptions, type RunHvigorwResult, type RunningProcess, type SdkArchiveInfo, type SdkInfo, SdkNotInstalledError, type SdkRelease, type SetHilogLevelOptions, type StartEmulatorOptions, type StreamHilogOptions, type TemplateOption, UnsupportedPlatformError, VERSION, attemptHdcConnection, consoleLogger, createMaterial, createScaffold, decryptPwd, defaultContext, defaultPaths, detectProjectSdkVersion, downloadAndInstallSdk, downloadFile, encryptPwd, extractTarball, extractZipWithProgress, findAppProcessId, findCmdToolsSourceDir, generateSigningConfigs, getBundleName, getCmdToolsBin, getCmdToolsDownloadUrl, getCmdToolsPath, getCmdToolsStatus, getEmulatorDir, getHdcPath, getHvigorwPath, getInstalledSdks, getKey, getMainAbility, getOhosBaseSdkHome, getOsFolder, getSdkFilename, getSdkRootDir, getSupportedSdksForUi, installApp, installCmdTools, installEmulator, isCmdToolsInstalled, isEmulatorInstalled, isValidBundleName, isValidProjectName, launchApp, listRunningProcesses, listTemplates, nonInteractivePrompter, noopLogger, noopProgress, parseHilogLine, readJson5File, readJsonFile, removeCmdTools, removeEmulator, removeSdk, runHvigorw, setHilogLevel, startEmulator, staticConfig, stopEmulator, streamHilog, validateTemplateLayout, verifySha256, writeJson5File, writeJsonFile };
+export { ALL_SDKS, APL_VALUES, APP_FEATURE_VALUES, type Apl, type AppFeature, CancelledError, ChecksumMismatchError, CmdToolsNotInstalledError, type CmdToolsStatus, type ConfigKey, type ConfigProvider, type CreateScaffoldOptions, type CreateScaffoldResult, type DownloadOptions, type ExtractZipOptions, type GenerateSigningConfigsOptions, type HilogEntry, type HilogLevel, type InstallAppOptions, type InstallCmdToolsOptions, type InstallEmulatorOptions, type InstallSdkOptions, type LaunchAppOptions, type Logger, OHOS_URL_BASE, type OniroContext, OniroError, type OsFolder, type ProgressReporter, type ProgressUpdate, type Prompter, type RunHvigorwOptions, type RunHvigorwResult, type RunningProcess, type SdkArchiveInfo, type SdkInfo, SdkNotInstalledError, type SdkRelease, type SetHilogLevelOptions, type SigningKind, type StartEmulatorOptions, type StreamHilogOptions, type TemplateOption, UnsupportedPlatformError, VERSION, attemptHdcConnection, consoleLogger, createMaterial, createScaffold, decryptPwd, defaultContext, defaultPaths, detectProjectSdkVersion, detectSigningConfigNames, downloadAndInstallSdk, downloadFile, encryptPwd, extractTarball, extractZipWithProgress, findAppProcessId, findCmdToolsSourceDir, generateSigningConfigs, getBundleName, getCmdToolsBin, getCmdToolsDownloadUrl, getCmdToolsPath, getCmdToolsStatus, getEmulatorDir, getHdcPath, getHvigorwPath, getInstalledSdks, getKey, getMainAbility, getOhosBaseSdkHome, getOsFolder, getSdkFilename, getSdkRootDir, getSupportedSdksForUi, installApp, installCmdTools, installEmulator, isCmdToolsInstalled, isEmulatorInstalled, isValidBundleName, isValidProjectName, launchApp, listRunningProcesses, listTemplates, nonInteractivePrompter, noopLogger, noopProgress, parseHilogLine, pickSigningKind, readJson5File, readJsonFile, removeCmdTools, removeEmulator, removeSdk, runHvigorw, setHilogLevel, startEmulator, staticConfig, stopEmulator, streamHilog, validateTemplateLayout, verifySha256, writeJson5File, writeJsonFile };

package/dist/index.js

@@ -822,25 +822,101 @@ import * as fs10 from "fs";
 import * as path10 from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 import JSON52 from "json5";
+
+// src/sign/applicationCert.ts
+var OPEN_HARMONY_APPLICATION_CERT = `-----BEGIN CERTIFICATE-----
+MIICRDCCAcmgAwIBAgIED+E4izAMBggqhkjOPQQDAwUAMGgxCzAJBgNVBAYTAkNO
+MRQwEgYDVQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVh
+bTEoMCYGA1UEAxMfT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gUm9vdCBDQTAeFw0y
+MTAyMDIxMjE0MThaFw00OTEyMzExMjE0MThaMGgxCzAJBgNVBAYTAkNOMRQwEgYD
+VQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVhbTEoMCYG
+A1UEAxMfT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gUm9vdCBDQTB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABE023XmRaw2DnO8NSsb+KG/uY0FtS3u5LQucdr3qWVnRW5ui
+QIL6ttNZBEeLTUeYcJZCpayg9Llf+1SmDA7dY4iP2EcRo4UN3rilovtfFfsmH4ty
+3SApHVFzWUl+NwdH8KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
+AQYwHQYDVR0OBBYEFBc6EKGrGXzlAE+s0Zgnsphadw7NMAwGCCqGSM49BAMDBQAD
+ZwAwZAIwd1p3JzHN93eoPped1li0j64npgqNzwy4OrkehYAqNXpcpaEcLZ7UxW8E
+I2lZJ3SbAjAkqySHb12sIwdSFKSN9KCMMEo/eUT5dUXlcKR2nZz0MJdxT5F51qcX
+1CumzkcYhgU=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICYTCCAeWgAwIBAgIEHmXAPTAMBggqhkjOPQQDAwUAMGgxCzAJBgNVBAYTAkNO
+MRQwEgYDVQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVh
+bTEoMCYGA1UEAxMfT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gUm9vdCBDQTAeFw0y
+MTAyMDIxMjE1MzJaFw00OTEyMzExMjE1MzJaMGMxCzAJBgNVBAYTAkNOMRQwEgYD
+VQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVhbTEjMCEG
+A1UEAxMaT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gQ0EwdjAQBgcqhkjOPQIBBgUr
+gQQAIgNiAAQhnu7Hna8XNa2KyqRf5+lBJScE4xqf89N0g0OuqAb2re8nGsvWkw26
+uDekfnBYicd+G3Cydqa2zFIwV7Talyg2ULW3r8KbGpyl84mJEPPRmCGJ+H9gtCsf
++OrJ4Y76LVWjYzBhMB8GA1UdIwQYMBaAFBc6EKGrGXzlAE+s0Zgnsphadw7NMA8G
+A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTbhrciFtUL
+oUu33SV7ufEFfaItRzAMBggqhkjOPQQDAwUAA2gAMGUCMG3cXjiDmXTvf7D4Omhf
+qcc2nuO+EMfWE+N9ZhBP5UhV34mAGWi3SfLU6rcV0urWEQIxAMYIb3epOnKhUrcm
+Lfu1WKzFlpYQwmw73RaCHP2I3k6NcuWOYeNwWXSNZ8o0nzvaLg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICMzCCAbegAwIBAgIEaOC/zDAMBggqhkjOPQQDAwUAMGMxCzAJBgNVBAYTAkNO
+MRQwEgYDVQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVh
+bTEjMCEGA1UEAxMaT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gQ0EwHhcNMjEwMjAy
+MTIxOTMxWhcNNDkxMjMxMTIxOTMxWjBoMQswCQYDVQQGEwJDTjEUMBIGA1UEChML
+T3Blbkhhcm1vbnkxGTAXBgNVBAsTEE9wZW5IYXJtb255IFRlYW0xKDAmBgNVBAMT
+H09wZW5IYXJtb255IEFwcGxpY2F0aW9uIFJlbGVhc2UwWTATBgcqhkjOPQIBBggq
+hkjOPQMBBwNCAATbYOCQQpW5fdkYHN45v0X3AHax12jPBdEDosFRIZ1eXmxOYzSG
+JwMfsHhUU90E8lI0TXYZnNmgM1sovubeQqATo1IwUDAfBgNVHSMEGDAWgBTbhrci
+FtULoUu33SV7ufEFfaItRzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFPtxruhl
+cRBQsJdwcZqLu9oNUVgaMAwGCCqGSM49BAMDBQADaAAwZQIxAJta0PQ2p4DIu/ps
+LMdLCDgQ5UH1l0B4PGhBlMgdi2zf8nk9spazEQI/0XNwpft8QAIwHSuA2WelVi/o
+zAlF08DnbJrOOtOnQq5wHOPlDYB4OtUzOYJk9scotrEnJxJzGsh/
+-----END CERTIFICATE-----
+`;
+
+// src/sign/generateSigningConfigs.ts
 var APL_VALUES = ["normal", "system_basic", "system_core"];
 var APP_FEATURE_VALUES = ["hos_normal_app", "hos_system_app"];
-function copyFilesToProject(projectDir, paths, logger) {
+function pickSigningKind(apl) {
+  return apl === "normal" ? "profile-release" : "application-release";
+}
+var SIGNING_KIND_CONFIG = {
+  "profile-release": {
+    hapKeyAlias: "openharmony application profile release",
+    certBasename: "OpenHarmonyProfileRelease.pem"
+  },
+  "application-release": {
+    hapKeyAlias: "OpenHarmony Application Release",
+    certBasename: "OpenHarmonyApplication.cer"
+  }
+};
+function copyFilesToProject(projectDir, paths, kind, logger) {
   logger.info("[sign] Copying signing material into project...");
   const signaturesDir = path10.join(projectDir, "signatures");
   fs10.mkdirSync(signaturesDir, { recursive: true });
   fs10.copyFileSync(paths.keystore, path10.join(signaturesDir, "OpenHarmony.p12"));
   fs10.copyFileSync(paths.profileCert, path10.join(signaturesDir, "OpenHarmonyProfileRelease.pem"));
   fs10.copyFileSync(paths.unsignedProfileTemplate, path10.join(signaturesDir, "UnsgnedReleasedProfileTemplate.json"));
+  if (kind === "application-release") {
+    fs10.writeFileSync(
+      path10.join(signaturesDir, "OpenHarmonyApplication.cer"),
+      OPEN_HARMONY_APPLICATION_CERT
+    );
+  }
 }
 function resolveAppFeature(apl, override) {
   if (override) return override;
   return apl === "normal" ? "hos_normal_app" : "hos_system_app";
 }
-function modifyProfileTemplate(projectDir, apl, appFeature, logger) {
-  logger.info(`[sign] Modifying profile template (apl=${apl}, app-feature=${appFeature})...`);
+function extractLeafCertificate(chainPath) {
+  const certContent = fs10.readFileSync(chainPath, "utf-8");
+  const parts = certContent.split("-----END CERTIFICATE-----");
+  if (parts.length < 3) {
+    throw new OniroError(`${chainPath} does not contain enough certificates.`);
+  }
+  return parts[2].trim() + "\n-----END CERTIFICATE-----\n";
+}
+function modifyProfileTemplate(projectDir, apl, appFeature, logger, options = {}) {
+  const kind = options.kind ?? pickSigningKind(apl);
+  logger.info(`[sign] Modifying profile template (apl=${apl}, app-feature=${appFeature}, kind=${kind})...`);
   const appJsonPath = path10.join(projectDir, "AppScope/app.json5");
   const profileTemplatePath = path10.join(projectDir, "signatures/UnsgnedReleasedProfileTemplate.json");
-  const profileCertFilePath = path10.join(projectDir, "signatures/OpenHarmonyProfileRelease.pem");
   if (!fs10.existsSync(appJsonPath)) {
     throw new OniroError(`${appJsonPath} does not exist.`);
   }
@@ -865,13 +941,16 @@ function modifyProfileTemplate(projectDir, apl, appFeature, logger) {
   profileTemplate["bundle-info"]["bundle-name"] = appJson.app.bundleName;
   profileTemplate["bundle-info"]["apl"] = apl;
   profileTemplate["bundle-info"]["app-feature"] = appFeature;
-  const certContent = fs10.readFileSync(profileCertFilePath, "utf-8");
-  const certs = certContent.split("-----END CERTIFICATE-----");
-  if (certs.length < 3) {
-    throw new OniroError(`${profileCertFilePath} does not contain enough certificates.`);
+  const distCertChainPath = path10.join(
+    projectDir,
+    "signatures",
+    SIGNING_KIND_CONFIG[kind].certBasename
+  );
+  profileTemplate["bundle-info"]["distribution-certificate"] = extractLeafCertificate(distCertChainPath);
+  if (options.acls !== void 0) {
+    profileTemplate.acls = profileTemplate.acls ?? {};
+    profileTemplate.acls["allowed-acls"] = options.acls;
   }
-  const thirdCert = certs[2].trim() + "\n-----END CERTIFICATE-----\n";
-  profileTemplate["bundle-info"]["distribution-certificate"] = thirdCert;
   fs10.writeFileSync(profileTemplatePath, JSON.stringify(profileTemplate, null, 2));
 }
 function generateP7bFile(projectDir, paths, logger) {
@@ -911,7 +990,27 @@ function generateP7bFile(projectDir, paths, logger) {
     );
   }
 }
-function updateBuildProfile(projectDir, logger) {
+function detectSigningConfigNames(projectDir) {
+  const buildProfilePath = path10.join(projectDir, "build-profile.json5");
+  if (!fs10.existsSync(buildProfilePath)) return ["default"];
+  let parsed;
+  try {
+    parsed = JSON52.parse(fs10.readFileSync(buildProfilePath, "utf-8"));
+  } catch {
+    return ["default"];
+  }
+  const products = parsed.app?.products;
+  if (!Array.isArray(products) || products.length === 0) return ["default"];
+  const names = [];
+  for (const product of products) {
+    const name = product.signingConfig;
+    if (typeof name === "string" && name.length > 0 && !names.includes(name)) {
+      names.push(name);
+    }
+  }
+  return names.length > 0 ? names : ["default"];
+}
+function updateBuildProfile(projectDir, kind, logger) {
   logger.info("[sign] Writing signing configs into build-profile.json5...");
   const materialDir = path10.join(projectDir, "signatures", "material");
   const buildProfilePath = path10.join(projectDir, "build-profile.json5");
@@ -925,21 +1024,22 @@ function updateBuildProfile(projectDir, logger) {
       throw new OniroError(`Error parsing ${buildProfilePath}: ${e.message}`, e);
     }
   }
+  const { hapKeyAlias, certBasename } = SIGNING_KIND_CONFIG[kind];
+  const configNames = detectSigningConfigNames(projectDir);
+  logger.info(`[sign] Writing signingConfigs entries: ${configNames.join(", ")}`);
   buildProfile.app = buildProfile.app ?? {};
-  buildProfile.app.signingConfigs = [
-    {
-      name: "default",
-      material: {
-        certpath: "./signatures/OpenHarmonyProfileRelease.pem",
-        storePassword: encryptedStorePassword,
-        keyAlias: "openharmony application profile release",
-        keyPassword: encryptedKeyPassword,
-        profile: "./signatures/app1-profile.p7b",
-        signAlg: "SHA256withECDSA",
-        storeFile: "./signatures/OpenHarmony.p12"
-      }
+  buildProfile.app.signingConfigs = configNames.map((name) => ({
+    name,
+    material: {
+      certpath: `./signatures/${certBasename}`,
+      storePassword: encryptedStorePassword,
+      keyAlias: hapKeyAlias,
+      keyPassword: encryptedKeyPassword,
+      profile: "./signatures/app1-profile.p7b",
+      signAlg: "SHA256withECDSA",
+      storeFile: "./signatures/OpenHarmony.p12"
     }
-  ];
+  }));
   fs10.writeFileSync(buildProfilePath, JSON.stringify(buildProfile, null, 2));
 }
 function prepareMaterialDirectory(projectDir, logger) {
@@ -979,12 +1079,13 @@ function generateSigningConfigs(options) {
     profileCert: path10.join(sdkPath, "toolchains/lib/OpenHarmonyProfileRelease.pem"),
     unsignedProfileTemplate: path10.join(sdkPath, "toolchains/lib/UnsgnedReleasedProfileTemplate.json")
   };
+  const kind = pickSigningKind(apl);
   logger.info("[sign] Starting signing configuration generation...");
-  copyFilesToProject(projectDir, paths, logger);
-  modifyProfileTemplate(projectDir, apl, appFeature, logger);
+  copyFilesToProject(projectDir, paths, kind, logger);
+  modifyProfileTemplate(projectDir, apl, appFeature, logger, { kind, acls: options.acls });
   generateP7bFile(projectDir, paths, logger);
   prepareMaterialDirectory(projectDir, logger);
-  updateBuildProfile(projectDir, logger);
+  updateBuildProfile(projectDir, kind, logger);
   logger.info("[sign] Signing configuration generated successfully.");
 }
 
@@ -1670,7 +1771,7 @@ async function createScaffold(opts) {
 }
 
 // src/index.ts
-var VERSION = "0.6.0";
+var VERSION = "0.6.2";
 export {
   ALL_SDKS,
   APL_VALUES,
@@ -1691,6 +1792,7 @@ export {
   defaultContext,
   defaultPaths,
   detectProjectSdkVersion,
+  detectSigningConfigNames,
   downloadAndInstallSdk,
   downloadFile,
   encryptPwd,
@@ -1729,6 +1831,7 @@ export {
   noopLogger,
   noopProgress,
   parseHilogLine,
+  pickSigningKind,
   readJson5File,
   readJsonFile,
   removeCmdTools,