dragonflight/services/premiere-plugin/build/cert/README.md

# Self-signed cert for ZXP signing

The `.zxp` package format requires a signature. We use a self-signed cert so
there is no Certificate Authority cost; the trade-off is editors must enable
`PlayerDebugMode` for the panel to load (the Windows `.exe` installer does
this automatically).

## Files

| File | What it is | Commit to git? |
|------|------------|----------------|
| `dragonflight-selfsigned.p12` | PKCS#12 keystore containing the signing cert + private key | **yes** |
| `cert-passphrase.txt` | Passphrase for the `.p12` | **yes** |

Both are auto-generated on the first `node build-zxp.mjs` run. They MUST be
committed and reused across builds: Adobe's ZXP signature continuity rule
means a re-signed package with a different cert fingerprint will not install
over an existing version — editors would have to uninstall the panel first.

## Why is committing a private key OK here?

- The panel is proprietary internal tooling, not a public distribution.
- The cert chains to nothing — a leak lets an attacker sign a fake
  `net.wilddragon.dragonflight.panel` bundle, which would still require
  `PlayerDebugMode=1` to load and physical access to the editor's machine to
  install. Threat model: low.
- The alternative (rotating the cert on every build or keeping it in a
  secrets manager) would break upgrade-in-place for every editor on every
  build.

If you want a real codesigning cert later, drop a CA-issued `.p12` over the
self-signed one with the same filename and update `cert-passphrase.txt`. The
build script will reuse them.

## Regenerating

Delete both files. Next `node build-zxp.mjs` run will create a fresh
self-signed cert (valid for 25 years). Commit the new pair. **Heads up:**
every editor with the old `.zxp` installed must uninstall first before the
new one will install.

The build script handles regeneration automatically — just delete both
files and re-run `node build-zxp.mjs`. If you need to invoke Adobe's
`ZXPSignCmd` directly (e.g. to inspect the generated cert), it ships inside
`node_modules/zxp-provider/bin/<version>/` after `npm install`.