54 lines
2.1 KiB
Markdown
54 lines
2.1 KiB
Markdown
|
# Self-signed cert for ZXP signing
|
||
|
|
|
||
|
|
The `.zxp` package format requires a signature. We use a self-signed cert so
|
||
|
|
there is no Certificate Authority cost; the trade-off is editors must enable
|
||
|
|
`PlayerDebugMode` for the panel to load (the Windows `.exe` installer does
|
||
|
|
this automatically).
|
||
|
|
|
||
|
|
## Files
|
||
|
|
|
||
|
|
| File | What it is | Commit to git? |
|
||
|
|
|------|------------|----------------|
|
||
|
|
| `dragonflight-selfsigned.p12` | PKCS#12 keystore containing the signing cert + private key | **yes** |
|
||
|
|
| `cert-passphrase.txt` | Passphrase for the `.p12` | **yes** |
|
||
|
|
|
||
|
|
Both are auto-generated on the first `node build-zxp.mjs` run. They MUST be
|
||
|
|
committed and reused across builds: Adobe's ZXP signature continuity rule
|
||
|
|
means a re-signed package with a different cert fingerprint will not install
|
||
|
|
over an existing version — editors would have to uninstall the panel first.
|
||
|
|
|
||
|
|
## Why is committing a private key OK here?
|
||
|
|
|
||
|
|
- The panel is proprietary internal tooling, not a public distribution.
|
||
|
|
- The cert chains to nothing — a leak lets an attacker sign a fake
|
||
|
|
`net.wilddragon.dragonflight.panel` bundle, which would still require
|
||
|
|
`PlayerDebugMode=1` to load and physical access to the editor's machine to
|
||
|
|
install. Threat model: low.
|
||
|
|
- The alternative (rotating the cert on every build or keeping it in a
|
||
|
|
secrets manager) would break upgrade-in-place for every editor on every
|
||
|
|
build.
|
||
|
|
|
||
|
|
If you want a real codesigning cert later, drop a CA-issued `.p12` over the
|
||
|
|
self-signed one with the same filename and update `cert-passphrase.txt`. The
|
||
|
|
build script will reuse them.
|
||
|
|
|
||
|
|
## Regenerating
|
||
|
|
|
||
|
|
Delete both files. Next `node build-zxp.mjs` run will create a fresh
|
||
|
|
self-signed cert (valid for 25 years). Commit the new pair. **Heads up:**
|
||
|
|
every editor with the old `.zxp` installed must uninstall first before the
|
||
|
|
new one will install.
|
||
|
|
|
||
|
|
Manual regeneration with the Adobe-published `ZXPSignCmd` (the
|
||
|
|
`zxp-sign-cmd` npm package wraps this):
|
||
|
|
|
||
|
|
```
|
||
|
|
npx zxp-sign-cmd selfSignedCert \
|
||
|
|
--country US \
|
||
|
|
--province WA \
|
||
|
|
--org "Wild Dragon LLC" \
|
||
|
|
--name "Wild Dragon LLC" \
|
||
|
|
--password "$(cat cert-passphrase.txt)" \
|
||
|
|
--output dragonflight-selfsigned.p12
|
||
|
|
```
|