wyvrnpm 2.12.3 → 2.13.12

package/src/commands/key.js

@@ -0,0 +1,112 @@
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+
+const ed25519 = require('../signing/ed25519');
+const log     = require('../logger');
+
+/**
+ * `wyvrnpm key gen --out <dir> [--id <publisher-id>]`
+ *
+ * Generates a fresh Ed25519 keypair and writes:
+ *   <dir>/<id>.priv.pem   — PKCS#8 private key (publisher keeps secret)
+ *   <dir>/<id>.pub.pem    — SPKI PEM public key (paste into trust anchor)
+ *   <dir>/<id>.pub.b64    — Base64 SPKI DER (the literal value for keys.json)
+ *
+ * Refuses to overwrite existing files — rotation events are rare and
+ * destructive enough that the user should explicitly remove the old keys
+ * (or pick a fresh `--id`) rather than have the command stomp them.
+ */
+async function gen(argv) {
+  const outDir = argv.out;
+  const id     = argv.id ?? 'wyvrnpm';
+  if (!outDir) { log.error('--out <dir> is required'); process.exit(1); }
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(id)) {
+    log.error(`--id must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/ (got "${id}")`);
+    process.exit(1);
+  }
+
+  const privPath = path.join(outDir, `${id}.priv.pem`);
+  const pubPath  = path.join(outDir, `${id}.pub.pem`);
+  const b64Path  = path.join(outDir, `${id}.pub.b64`);
+
+  for (const p of [privPath, pubPath, b64Path]) {
+    if (fs.existsSync(p)) {
+      log.error(`refusing to overwrite existing file: ${p}`);
+      process.exit(1);
+    }
+  }
+
+  fs.mkdirSync(outDir, { recursive: true });
+  const k = ed25519.generateKeyPair();
+  // Private key permissions: chmod 0600 on POSIX so a stray process or
+  // backup tool doesn't accidentally include it. No-op on Windows.
+  fs.writeFileSync(privPath, k.privateKeyPem, { mode: 0o600 });
+  fs.writeFileSync(pubPath,  k.publicKeyPem);
+  fs.writeFileSync(b64Path,  k.publicKeyB64 + '\n');
+
+  if (argv.format === 'json') {
+    process.stdout.write(JSON.stringify({
+      command:        'key gen',
+      wyvrnpmVersion: require('../../package.json').version,
+      id,
+      out:            outDir,
+      privateKeyFile: privPath,
+      publicKeyPem:   pubPath,
+      publicKeyB64:   b64Path,
+      publicKey:      k.publicKeyB64,
+    }, null, 2) + '\n');
+  } else {
+    log.success(`Generated ed25519 keypair "${id}"`);
+    log.info(`  private key : ${privPath}`);
+    log.info(`  public PEM  : ${pubPath}`);
+    log.info(`  public b64  : ${b64Path}`);
+    console.log();
+    console.log('Add this entry to your registry\'s `.trust/keys.json`:');
+    console.log(JSON.stringify({
+      id, alg: 'ed25519',
+      publicKey:    k.publicKeyB64,
+      identityHint: '<your.email@example.com>',
+      addedAt:      new Date().toISOString(),
+      retiredAt:    null,
+    }, null, 2));
+  }
+}
+
+/**
+ * `wyvrnpm key show-pub --in <priv-file>`
+ *
+ * Re-derives the public key from a private key file. Handy for verifying
+ * that a CI-supplied key matches the keyId pinned in `keys.json` before
+ * publishing — derives + prints, without ever writing back to disk.
+ */
+async function showPub(argv) {
+  const inPath = argv.in;
+  if (!inPath) { log.error('--in <priv-file> is required'); process.exit(1); }
+  if (!fs.existsSync(inPath)) {
+    log.error(`private key file not found: ${inPath}`);
+    process.exit(1);
+  }
+  let derived;
+  try {
+    derived = ed25519.derivePublicKey(fs.readFileSync(inPath, 'utf8'));
+  } catch (err) {
+    log.error(err.message);
+    process.exit(1);
+  }
+  if (argv.format === 'json') {
+    process.stdout.write(JSON.stringify({
+      command:        'key show-pub',
+      wyvrnpmVersion: require('../../package.json').version,
+      in:             inPath,
+      publicKeyPem:   derived.publicKeyPem,
+      publicKey:      derived.publicKeyB64,
+    }, null, 2) + '\n');
+  } else {
+    process.stdout.write(derived.publicKeyPem);
+    process.stdout.write(`\nbase64: ${derived.publicKeyB64}\n`);
+  }
+}
+
+module.exports = { gen, showPub };