@scalebun/cli 1.13.0 → 2.0.0

package/lib/commands/ota-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ota-bundle.d.ts","sourceRoot":"","sources":["../../src/commands/ota-bundle.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiFpC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAkH3D"}
+{"version":3,"file":"ota-bundle.d.ts","sourceRoot":"","sources":["../../src/commands/ota-bundle.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgFpC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA6G3D"}

package/lib/commands/ota-bundle.js

@@ -39,7 +39,6 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const bundle_1 = require("../utils/bundle");
 const validate_1 = require("../utils/validate");
-const ota_keys_1 = require("./ota-keys");
 /**
  * Ensure that the bundles folder and its artifacts are ignored by git.
  */
@@ -179,15 +178,15 @@ function registerOtaBundleCommand(ota) {
             // Ensure bundles directory is git-ignored
             const gitignoreUpdated = ensureBundlesGitIgnored(destPath);
             fs.copyFileSync(result.bundlePath, destPath);
-            // Compute SHA-256 and sign if private key exists
+            // Compute SHA-256. Under SB-OTA-RSA-SHA256-V1 the signature is not a
+            // detached `.sig` over the hash — it is an RSA signature over a binary
+            // signed-release payload whose identity fields (releaseId, bundleId,
+            // releaseSequence) are reserved by the server at publish time. A bundle
+            // built offline for manual dashboard upload therefore cannot be signed
+            // here; sign at `scalebun ota publish`, or use the dashboard's signed
+            // upload flow. This command emits the bundle + its hash only.
             const bundleBytes = fs.readFileSync(destPath);
             const sha256 = crypto.createHash('sha256').update(bundleBytes).digest('hex');
-            const signature = (0, ota_keys_1.signBundleHash)(sha256, opts.keyDir);
-            let sigPath = null;
-            if (signature) {
-                sigPath = `${destPath}.sig`;
-                fs.writeFileSync(sigPath, signature.trim(), 'utf8');
-            }
             // If sourcemap was generated, also copy it alongside the bundle in bundles/
             if (opts.sourcemap && result.sourcemapPath && fs.existsSync(result.sourcemapPath)) {
                 const mapDest = `${destPath}.map`;
@@ -199,12 +198,7 @@ function registerOtaBundleCommand(ota) {
             console.log(`   Output Path: ${destPath}`);
             console.log(`   Size:        ${sizeMb} MB (${stats.size} bytes)`);
             console.log(`   SHA-256:     ${sha256}`);
-            if (sigPath) {
-                console.log(`   Signature:   ${sigPath} (Signed with local ed25519 key)`);
-            }
-            else {
-                console.log(`   Signature:   Unsigned (no .scalebun/ota-signing-key.pem found)`);
-            }
+            console.log(`   Signature:   signed at publish time (RSA-3072 / SB-OTA-RSA-SHA256-V1)`);
             if (gitignoreUpdated) {
                 console.log(`   Git Status:  Added 'bundles/' to .gitignore`);
             }

package/lib/commands/ota-bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"ota-bundle.js","sourceRoot":"","sources":["../../src/commands/ota-bundle.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuGA,4DAkHC;AAzND,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAE7B,4CAA8C;AAC9C,gDAAgD;AAChD,yCAA4C;AAE5C;;GAEG;AACH,SAAS,uBAAuB,CAAC,cAAsB;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,kGAAkG;IAClG,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,EAAE,CAAC,aAAa,CACd,cAAc,EACd,+DAA+D,EAC/D,MAAM,CACP,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,SAAS,EAAE,CAAC;YAC9C,MAAM,eAAe,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACrG,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACnC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;YAED,kDAAkD;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,SAAS;gBACf,CAAC,KAAK,UAAU;gBAChB,CAAC,KAAK,UAAU;gBAChB,CAAC,KAAK,WAAW;gBACjB,CAAC,KAAK,eAAe;gBACrB,CAAC,KAAK,YAAY,CACrB,CAAC;YAEF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,MAAM,KAAK,GAAG,GAAG,MAAM,sCAAsC,CAAC;gBAC9D,IAAI,CAAC;oBACH,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,OAAO,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC;oBAC3D,gBAAgB,GAAG,IAAI,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YACD,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM;QAC3B,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,wBAAwB,CAAC,GAAY;IACnD,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uEAAuE,CAAC,CAAC;IAExF,MAAM;SACH,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;SACtC,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,uBAAuB,EAAE,gCAAgC,EAAE,SAAS,CAAC;SAC5E,MAAM,CAAC,qBAAqB,EAAE,eAAe,EAAE,UAAU,CAAC;SAC1D,MAAM,CACL,iBAAiB,EACjB,6EAA6E,CAC9E;SACA,MAAM,CAAC,kBAAkB,EAAE,+DAA+D,CAAC;SAC3F,MAAM,CAAC,UAAU,EAAE,wEAAwE,CAAC;SAC5F,MAAM,CAAC,mBAAmB,EAAE,sEAAsE,CAAC;SACnG,MAAM,CAAC,kBAAkB,EAAE,0DAA0D,CAAC;SACtF,MAAM,CAAC,aAAa,EAAE,yCAAyC,CAAC;SAChE,MAAM,CACL,KAAK,EAAE,IASN,EAAE,EAAE;QACH,MAAM,QAAQ,GAAG,IAAA,sBAAW,EAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,KAAK,CAAU,EAAE;YACrF,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,eAAe,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE5F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC;gBACzB,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,KAAK;gBACV,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YAEH,iDAAiD;YACjD,IAAI,QAAgB,CAAC;YACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACnE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,QAAQ,SAAS,CAAC,CAAC;gBAC7D,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,QAAQ,SAAS,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,QAAQ,CAAC;gBACtB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,QAAQ,SAAS,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,0CAA0C;YAC1C,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAE3D,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE7C,iDAAiD;YACjD,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAG,IAAA,yBAAc,EAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAC;gBAC5B,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC;YAED,4EAA4E;YAC5E,IAAI,IAAI,CAAC,SAAS,IAAK,MAAc,CAAC,aAAa,IAAI,EAAE,CAAC,UAAU,CAAE,MAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBACpG,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAC;gBAClC,EAAE,CAAC,YAAY,CAAE,MAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAEvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,QAAQ,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,kCAAkC,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,GAAG,CACT,6GAA6G,CAC9G,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}
+{"version":3,"file":"ota-bundle.js","sourceRoot":"","sources":["../../src/commands/ota-bundle.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsGA,4DA6GC;AAnND,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAE7B,4CAA8C;AAC9C,gDAAgD;AAEhD;;GAEG;AACH,SAAS,uBAAuB,CAAC,cAAsB;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,kGAAkG;IAClG,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,EAAE,CAAC,aAAa,CACd,cAAc,EACd,+DAA+D,EAC/D,MAAM,CACP,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,SAAS,EAAE,CAAC;YAC9C,MAAM,eAAe,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACrG,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACnC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;YAED,kDAAkD;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,SAAS;gBACf,CAAC,KAAK,UAAU;gBAChB,CAAC,KAAK,UAAU;gBAChB,CAAC,KAAK,WAAW;gBACjB,CAAC,KAAK,eAAe;gBACrB,CAAC,KAAK,YAAY,CACrB,CAAC;YAEF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,MAAM,KAAK,GAAG,GAAG,MAAM,sCAAsC,CAAC;gBAC9D,IAAI,CAAC;oBACH,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,OAAO,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC;oBAC3D,gBAAgB,GAAG,IAAI,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YACD,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM;QAC3B,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,wBAAwB,CAAC,GAAY;IACnD,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uEAAuE,CAAC,CAAC;IAExF,MAAM;SACH,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;SACtC,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,uBAAuB,EAAE,gCAAgC,EAAE,SAAS,CAAC;SAC5E,MAAM,CAAC,qBAAqB,EAAE,eAAe,EAAE,UAAU,CAAC;SAC1D,MAAM,CACL,iBAAiB,EACjB,6EAA6E,CAC9E;SACA,MAAM,CAAC,kBAAkB,EAAE,+DAA+D,CAAC;SAC3F,MAAM,CAAC,UAAU,EAAE,wEAAwE,CAAC;SAC5F,MAAM,CAAC,mBAAmB,EAAE,sEAAsE,CAAC;SACnG,MAAM,CAAC,kBAAkB,EAAE,0DAA0D,CAAC;SACtF,MAAM,CAAC,aAAa,EAAE,yCAAyC,CAAC;SAChE,MAAM,CACL,KAAK,EAAE,IASN,EAAE,EAAE;QACH,MAAM,QAAQ,GAAG,IAAA,sBAAW,EAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,KAAK,CAAU,EAAE;YACrF,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,eAAe,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE5F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC;gBACzB,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,KAAK;gBACV,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YAEH,iDAAiD;YACjD,IAAI,QAAgB,CAAC;YACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACnE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,QAAQ,SAAS,CAAC,CAAC;gBAC7D,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,QAAQ,SAAS,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,QAAQ,CAAC;gBACtB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,QAAQ,SAAS,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,0CAA0C;YAC1C,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAE3D,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE7C,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7E,4EAA4E;YAC5E,IAAI,IAAI,CAAC,SAAS,IAAK,MAAc,CAAC,aAAa,IAAI,EAAE,CAAC,UAAU,CAAE,MAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBACpG,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAC;gBAClC,EAAE,CAAC,YAAY,CAAE,MAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAEvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,QAAQ,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;YACxF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,GAAG,CACT,6GAA6G,CAC9G,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}

package/lib/commands/ota-keys.d.ts

@@ -1,39 +1,38 @@
 import { Command } from 'commander';
-import * as crypto from 'crypto';
+import { spkiFingerprint } from '../utils/signing';
 /**
- * Keep the private key out of version control WITHOUT relying on the operator
- * reading a warning. The previous behaviour printed "NEVER commit this — add
- * .scalebun/ to .gitignore" and stopped; anyone who scrolled past that line
- * committed their signing key, and a signing key in git history is compromised
- * even after the file is deleted.
+ * OTA signing keys for SB-OTA-RSA-SHA256-V1 (RSA-3072 / SHA-256).
  *
- * Rules, in order of caution:
- *   - Only the key's directory relative to cwd can be ignored by cwd's
- *     .gitignore; if --out points outside the project, we cannot help — report
- *     the manual step instead of writing a useless entry.
- *   - An existing .gitignore is appended to, never rewritten.
- *   - A missing .gitignore is created only when cwd is actually a git repo
- *     (a `.git` entry exists) — creating one in a non-repo would be litter.
+ * The security model, and the reason this command exists: the private key is
+ * generated on the developer's machine and NEVER leaves it. Only the SPKI PUBLIC
+ * key is uploaded/registered. A server that cannot sign cannot forge a release,
+ * so a compromise of ScaleBun's infrastructure still cannot push code to a
+ * customer's users.
  *
- * @returns a human-readable sentence describing what happened, for the summary.
+ * (Pre-1.14 ScaleBun signed with ed25519 over the bundle's SHA-256. That path is
+ * removed: the protocol is now native-verifiable RSA on every supported Android
+ * API level. Legacy ed25519 key ROWS remain readable in the dashboard, labelled
+ * "Ed25519 — Legacy"; new keys are RSA only.)
  */
-export declare function ensureKeyDirGitignored(outDir: string, cwd?: string): string;
-/** Hex-encoded raw 32-byte ed25519 public key from a Node KeyObject. */
-export declare function rawPublicKeyHex(publicKey: crypto.KeyObject): string;
+export declare const KEY_DIR = ".scalebun";
+export declare const PRIVATE_KEY_FILE = "ota-signing-key.pem";
+export declare const PUBLIC_KEY_FILE = "ota-signing-key.pub.pem";
+export declare const KEY_ID_FILE = "ota-key-id.txt";
+/** Absolute path to the private key for a key dir (default ./.scalebun). */
+export declare function privateKeyPath(keyDir?: string): string;
+/** The locally stored keyId, if any (written next to the private key at generate). */
+export declare function readLocalKeyId(keyDir?: string): string | null;
+/** The local private key PEM, if present. */
+export declare function readLocalPrivatePem(keyDir?: string): string | null;
+/** SPKI public-key PEM derived from the local private key, if present. */
+export declare function localPublicPem(keyDir?: string): string | null;
 /**
- * The public half of the local signing key, if one exists — so `register-key`
- * can offer the right value as the default instead of asking the developer to
- * paste a 64-char hex string. Reads the private key at `./.scalebun/…pem` and
- * derives the public key from it; returns null when there is no local key.
+ * Keep the private key out of version control WITHOUT relying on the operator
+ * reading a warning. An existing .gitignore is appended to; a missing one is
+ * created only inside an actual git repo. Returns a human-readable outcome.
  */
-export declare function localPublicKeyHex(keyDir?: string): string | null;
+export declare function ensureKeyDirGitignored(outDir: string, cwd?: string): string;
 export declare function registerOtaKeysCommand(ota: Command): void;
-/**
- * Sign a bundle hash with the locally-held private key.
- *
- * Returns null when no key is present — publishing without signing stays valid
- * for apps that have not adopted it, and `ota publish` reports which happened
- * rather than failing.
- */
-export declare function signBundleHash(sha256Hex: string, keyDir?: string): string | null;
+/** Re-export so callers can compute a fingerprint without importing signing.ts. */
+export { spkiFingerprint };
 //# sourceMappingURL=ota-keys.d.ts.map

package/lib/commands/ota-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ota-keys.d.ts","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AA4BjC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,CA8B1F;AAUD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAInE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CASzE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA6UzD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAcf"}
+{"version":3,"file":"ota-keys.d.ts","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,OAAO,EAAwC,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEzF;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,OAAO,cAAc,CAAC;AACnC,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AACtD,eAAO,MAAM,eAAe,4BAA4B,CAAC;AACzD,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,CAE/D;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAStE;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAG3E;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,CA4B1F;AAiHD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA+JzD;AAgLD,mFAAmF;AACnF,OAAO,EAAE,eAAe,EAAE,CAAC"}