feat: initial public release

scripts/generate-release-key.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { createHash, createPublicKey, generateKeyPairSync } from "node:crypto";
+import { dirname, resolve } from "node:path";
+import { parseArgs } from "node:util";
+
+const { values } = parseArgs({ options: {
+  "private-key": { type: "string", default: ".secrets/release-signing-private.pem" },
+  "public-key": { type: "string", default: "distribution/release-signing-public.pem" },
+} });
+const privatePath = resolve(String(values["private-key"]));
+const publicPath = resolve(String(values["public-key"]));
+if (existsSync(privatePath) || existsSync(publicPath)) throw new Error("发布签名密钥已存在；拒绝覆盖或静默轮换");
+const pair = generateKeyPairSync("ed25519");
+const privatePem = pair.privateKey.export({ type: "pkcs8", format: "pem" });
+const publicPem = pair.publicKey.export({ type: "spki", format: "pem" });
+mkdirSync(dirname(privatePath), { recursive: true, mode: 0o700 });
+mkdirSync(dirname(publicPath), { recursive: true, mode: 0o755 });
+writeFileSync(privatePath, privatePem, { mode: 0o600 });
+writeFileSync(publicPath, publicPem, { mode: 0o644 });
+if (process.platform !== "win32") chmodSync(privatePath, 0o600);
+const keyId = createHash("sha256").update(createPublicKey(publicPem).export({ type: "spki", format: "der" })).digest("hex");
+console.log(`发布签名密钥已生成；keyId=${keyId}`);
+console.log(`私钥（禁止提交或部署到下载目录）：${privatePath}`);
+console.log(`公钥（应提交 Git）：${publicPath}`);