gitea-admin
504145aec6
CI / Client installer (macos-latest) (push) Canceled after 0s
CI / Client installer (ubuntu-latest) (push) Canceled after 0s
CI / Client installer (windows-latest) (push) Canceled after 0s
CI / test (22) (push) Canceled after 0s
CI / test (24) (push) Canceled after 0s
CI / release-smoke (push) Canceled after 0s
26 lines
1.5 KiB
JavaScript
26 lines
1.5 KiB
JavaScript
#!/usr/bin/env node
|
|
import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
|
|
import { createHash, createPublicKey, generateKeyPairSync } from "node:crypto";
|
|
import { dirname, resolve } from "node:path";
|
|
import { parseArgs } from "node:util";
|
|
|
|
const { values } = parseArgs({ options: {
|
|
"private-key": { type: "string", default: ".secrets/release-signing-private.pem" },
|
|
"public-key": { type: "string", default: "distribution/release-signing-public.pem" },
|
|
} });
|
|
const privatePath = resolve(String(values["private-key"]));
|
|
const publicPath = resolve(String(values["public-key"]));
|
|
if (existsSync(privatePath) || existsSync(publicPath)) throw new Error("发布签名密钥已存在；拒绝覆盖或静默轮换");
|
|
const pair = generateKeyPairSync("ed25519");
|
|
const privatePem = pair.privateKey.export({ type: "pkcs8", format: "pem" });
|
|
const publicPem = pair.publicKey.export({ type: "spki", format: "pem" });
|
|
mkdirSync(dirname(privatePath), { recursive: true, mode: 0o700 });
|
|
mkdirSync(dirname(publicPath), { recursive: true, mode: 0o755 });
|
|
writeFileSync(privatePath, privatePem, { mode: 0o600 });
|
|
writeFileSync(publicPath, publicPem, { mode: 0o644 });
|
|
if (process.platform !== "win32") chmodSync(privatePath, 0o600);
|
|
const keyId = createHash("sha256").update(createPublicKey(publicPem).export({ type: "spki", format: "der" })).digest("hex");
|
|
console.log(`发布签名密钥已生成；keyId=${keyId}`);
|
|
console.log(`私钥（禁止提交或部署到下载目录）：${privatePath}`);
|
|
console.log(`公钥（应提交 Git）：${publicPath}`);
|