kget-capture/keys/README.md

Extension signing key

This directory holds the RSA key pair used to pin the extension's Chrome ID so it's identical across every install (needed so the native messaging host's allowed_origins can be hardcoded instead of asking each user to paste their extension ID).

• kget-capture-private.pem — not committed (see .gitignore). Keep it somewhere safe if you want to be able to reproduce the same key deterministically later; losing it just means a future re-key would get a new extension ID, it's not a security incident.
• kget-capture-public.der / kget-capture-public.b64 — derived from the private key. The base64 contents of kget-capture-public.b64 is pasted verbatim into extension/manifest.json's "key" field. These are already effectively public once checked into manifest.json, so committing them is fine (and extension-id.txt too).
• extension-id.txt — the 32-character Chrome extension ID derived from the public key (also hardcoded into native-host/com.kget_capture.host.json).

Regenerating (only if rotating the key)

openssl genrsa -out keys/kget-capture-private.pem 2048
openssl rsa -in keys/kget-capture-private.pem -pubout -outform DER -out keys/kget-capture-public.der
openssl base64 -A -in keys/kget-capture-public.der -out keys/kget-capture-public.b64
openssl dgst -sha256 -binary keys/kget-capture-public.der | head -c 16 | od -An -tx1 \
  | tr -d ' \n' | tr '0123456789abcdef' 'abcdefghijklmnop' > keys/extension-id.txt

Rotating the key changes the extension ID, which means extension/manifest.json's "key" and native-host/com.kget_capture.host.json's allowed_origins both need updating to match.