repofence 0.1.6 → 0.1.7

package/README.md

@@ -151,6 +151,7 @@ Step-by-step: **[docs/RELEASE.md](docs/RELEASE.md)** (`npm version`, `npm publis
 | `REPOFENCE_API_BASE_URL` | API host for the CLI (`auth`, `init`). Default normalizes to `…/api`. |
 | `REPOFENCE_MOCK` | Set to `1` for mock API responses (no network). |
 | `REPOFENCE_PACK_ID` | Pack id for `repofence init` (default: `core`). |
+| `REPOFENCE_PUBLIC_KEY` | Optional. PEM or base64 public key to verify signed packs. If unset, the CLI uses its built-in public key. |
 
 ## Requirements
 

package/dist/core/pack-manager.js

@@ -9,6 +9,7 @@ const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const crypto_1 = __importDefault(require("crypto"));
 const tar_1 = __importDefault(require("tar"));
+const pack_public_key_1 = require("./pack-public-key");
 const defaultCommandsDir = () => process.env.REPOFENCE_COMMANDS_DIR || path_1.default.join(os_1.default.homedir(), '.cursor', 'commands');
 const commandsDir = (baseDir) => baseDir || defaultCommandsDir();
 const manifestPath = (baseDir) => path_1.default.join(commandsDir(baseDir), '.repofence-manifest.json');
@@ -151,13 +152,10 @@ const validateSignature = async (_pack) => {
     const payloadToVerify = pack.archiveHash
         ? `${pack.manifestHash}:${pack.archiveHash}`
         : pack.manifestHash;
-    const publicKeyEnv = process.env.REPOFENCE_PUBLIC_KEY;
-    if (!publicKeyEnv) {
-        throw new Error('Falta REPOFENCE_PUBLIC_KEY para validar la firma del pack.');
-    }
-    const publicKeyPem = publicKeyEnv.includes('BEGIN')
-        ? publicKeyEnv
-        : Buffer.from(publicKeyEnv, 'base64').toString('utf8');
+    const rawKey = process.env.REPOFENCE_PUBLIC_KEY?.trim() || pack_public_key_1.EMBEDDED_PACK_PUBLIC_KEY_PEM;
+    const publicKeyPem = rawKey.includes('BEGIN')
+        ? rawKey
+        : Buffer.from(rawKey, 'base64').toString('utf8');
     try {
         const keyObject = crypto_1.default.createPublicKey(publicKeyPem);
         const isValid = crypto_1.default.verify(null, Buffer.from(payloadToVerify), keyObject, Buffer.from(pack.signature, 'base64'));

package/dist/core/pack-public-key.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMBEDDED_PACK_PUBLIC_KEY_PEM = void 0;
+/**
+ * Default Ed25519 public key for verifying signed packs from the Repofence API.
+ * Keep in sync with `public_key.pem` at the repo root (pair to backend REPOFENCE_SIGNING_KEY).
+ * Override with env REPOFENCE_PUBLIC_KEY for testing or key rotation.
+ */
+exports.EMBEDDED_PACK_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQUpUZnhjN2JhVzg1dzdyM3V4YllOdWFaUk1vZTFlMmxjdmEybDdNTzBpYWs9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=
+-----END PUBLIC KEY-----
+`;
+//# sourceMappingURL=pack-public-key.js.map

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "repofence",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Repofence CLI (packs + backend auth)",
   "main": "dist/cli.js",
   "bin": {
-    "repofence": "dist/cli.js"
+    "repofence": "./dist/cli.js"
   },
   "files": [
     "dist/**/*.js",