mirror of
https://github.com/andwati/kget-capture.git
synced 2026-10-18 03:02:56 +00:00
33 lines
1.7 KiB
Markdown
33 lines
1.7 KiB
Markdown
# Extension signing key
|
|
|
|
This directory holds the RSA key pair used to pin the extension's Chrome ID so
|
|
it's identical across every install (needed so the native messaging host's
|
|
`allowed_origins` can be hardcoded instead of asking each user to paste their
|
|
extension ID).
|
|
|
|
- `kget-capture-private.pem` — **not committed** (see `.gitignore`). Keep it
|
|
somewhere safe if you want to be able to reproduce the same key deterministically
|
|
later; losing it just means a future re-key would get a new extension ID, it's
|
|
not a security incident.
|
|
- `kget-capture-public.der` / `kget-capture-public.b64` — derived from the
|
|
private key. The base64 contents of `kget-capture-public.b64` is pasted
|
|
verbatim into `extension/manifest.json`'s `"key"` field. These are already
|
|
effectively public once checked into `manifest.json`, so committing them is
|
|
fine (and `extension-id.txt` too).
|
|
- `extension-id.txt` — the 32-character Chrome extension ID derived from the
|
|
public key (also hardcoded into `native-host/com.kget_capture.host.json`).
|
|
|
|
## Regenerating (only if rotating the key)
|
|
|
|
```bash
|
|
openssl genrsa -out keys/kget-capture-private.pem 2048
|
|
openssl rsa -in keys/kget-capture-private.pem -pubout -outform DER -out keys/kget-capture-public.der
|
|
openssl base64 -A -in keys/kget-capture-public.der -out keys/kget-capture-public.b64
|
|
openssl dgst -sha256 -binary keys/kget-capture-public.der | head -c 16 | od -An -tx1 \
|
|
| tr -d ' \n' | tr '0123456789abcdef' 'abcdefghijklmnop' > keys/extension-id.txt
|
|
```
|
|
|
|
Rotating the key changes the extension ID, which means `extension/manifest.json`'s
|
|
`"key"` and `native-host/com.kget_capture.host.json`'s `allowed_origins` both
|
|
need updating to match.
|