@qomicex/cli 0.1.2 → 0.1.3

package/dist/commands/pack.js

@@ -48,21 +48,26 @@ export async function packCommand(opts = {}) {
     if (!id)
         fail('manifest.json 缺少 id');
     let entries = buildPackageEntries(root, manifest);
-    // 可选签名（仅 signature.json；需要证书链请用 publish）
+    // 可选签名（signature.json + signature.cert.json；无商店证书时生成自签证书）
     if (opts.key) {
         const keyContent = await readKeyInput(opts.key);
         const priv = parsePrivateKey(keyContent);
-        const { derivePublicKey } = await import("../lib/signature.js");
+        const { derivePublicKey, makeSelfSignedCert } = await import("../lib/signature.js");
         const pub = await derivePublicKey(priv);
         const keyId = `ed25519:${pub.slice(0, 8)}`;
         const localCert = join(root, 'signature.cert.json');
         let certJson;
-        if (existsSync(localCert))
+        if (existsSync(localCert)) {
             certJson = readFileSync(localCert, 'utf8');
+        }
+        else {
+            const name = String(manifest.name ?? '');
+            certJson = await makeSelfSignedCert(priv, keyId, name);
+            writeFileSync(localCert, certJson);
+            warn('未找到本地签名证书，已生成自签证书并写入 signature.cert.json；上传商店需先在开发者中心注册对应公钥');
+        }
         const sig = await signPackage(entries, priv, keyId, certJson);
         entries = { ...entries, ...sig };
-        if (!certJson)
-            warn('缺少本地 signature.cert.json，商店上传仍需证书；建议改用 qomicex publish 走完整签名');
     }
     const outDir = resolve(root, opts.outDir ?? 'release');
     mkdirSync(outDir, { recursive: true });

package/dist/lib/signature.js

@@ -98,10 +98,34 @@ async function signBytes(privDer, msg) {
     const sig = await crypto.subtle.sign({ name: ALG }, key, msg);
     return bytesToBase64(new Uint8Array(sig));
 }
+/** 自签开发者证书（开发者私钥签证书体）：未注册商店密钥时的离线打包/本地验证用，商店上传需对应公钥已注册。 */
+export async function makeSelfSignedCert(privDer, keyId, developerName = '') {
+    const { derivePublicKey } = await import("./signature.js");
+    const publicKey = await derivePublicKey(privDer);
+    const body = {
+        alg: ALG,
+        keyId,
+        developerId: '',
+        developerName,
+        publicKey,
+        issuedAt: new Date().toISOString(),
+        signature: '',
+    };
+    const certBody = canonicalJson({
+        alg: body.alg,
+        keyId: body.keyId,
+        developerId: body.developerId,
+        developerName: body.developerName,
+        publicKey: body.publicKey,
+        issuedAt: body.issuedAt,
+    });
+    body.signature = await signBytes(privDer, new TextEncoder().encode(certBody));
+    return JSON.stringify(body);
+}
 /**
  * 对包内全部条目生成签名文件。
  * @param certJson 商店根钥签发的开发者证书 JSON（POST /developer/keys 返回值），
- *                 无 cert 时仅生成 signature.json（pack 场景，publish 会走完整证书链）。
+ *                 省略时仅生成 signature.json（publish 场景由调用方传证书）。
  */
 export async function signPackage(entries, privDer, keyId, certJson) {
     const payload = await signedPayloadBytes(entries);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qomicex/cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "publishConfig": {
     "access": "public"
   },