43 lines
1.3 KiB
TypeScript
43 lines
1.3 KiB
TypeScript
import { Buffer } from 'node:buffer';
|
|
|
|
/**
|
|
* The production signing-key resource is deliberately code-owned. The empty
|
|
* table records the current activation hold until the platform supplies an
|
|
* official key; there is no environment or runtime override.
|
|
*/
|
|
export const CODE_OWNED_PLUGIN_SIGNING_KEYS = Object.freeze(
|
|
{} as Readonly<Record<string, string>>,
|
|
);
|
|
|
|
export const PLUGIN_SIGNING_KEY_ACTIVATION_HOLD = true as const;
|
|
|
|
export interface PluginSigningKeyStore {
|
|
get(keyId: string): Uint8Array | string | null;
|
|
}
|
|
|
|
function decodeKey(value: string): Uint8Array | null {
|
|
const trimmed = value.trim();
|
|
if (trimmed.length === 0) return null;
|
|
if (trimmed.includes('BEGIN PUBLIC KEY')) return Buffer.from(trimmed, 'utf8');
|
|
try {
|
|
const bytes = Buffer.from(trimmed, 'base64');
|
|
return bytes.length > 0 ? bytes : null;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
export function loadCodeOwnedPluginSigningKey(keyId: string): Uint8Array | null {
|
|
if (typeof keyId !== 'string' || keyId.length === 0) return null;
|
|
const encoded = CODE_OWNED_PLUGIN_SIGNING_KEYS[keyId];
|
|
return encoded === undefined ? null : decodeKey(encoded);
|
|
}
|
|
|
|
export function createCodeOwnedPluginTrustStore(): PluginSigningKeyStore {
|
|
return Object.freeze({
|
|
get: loadCodeOwnedPluginSigningKey,
|
|
});
|
|
}
|
|
|
|
export const getCodeOwnedPluginSigningKey = loadCodeOwnedPluginSigningKey;
|