dsh 0.2.0-rc.2: in-container update (experimental channel), path-agnostic compose, upstream patches adapted to 0.1.x/0.2.x

upstream/container/platform/tools/sign.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+
+import { createHash, createPrivateKey, createPublicKey, sign } from 'node:crypto'
+import { readFile, writeFile } from 'node:fs/promises'
+import { canonicalJson } from '../lib/canonical-json.mjs'
+
+function usage() {
+  console.error('usage: sign.mjs canonicalize <input> <output> | key-id <public-key-pem> | sign <private-key-pem> <document> <signature-output>')
+  process.exitCode = 64
+}
+
+const [command, ...args] = process.argv.slice(2)
+if (command === 'canonicalize' && args.length === 2) {
+  await writeFile(args[1], canonicalJson(JSON.parse(await readFile(args[0], 'utf8'))), { flag: 'wx' })
+} else if (command === 'key-id' && args.length === 1) {
+  const key = createPublicKey(await readFile(args[0]))
+  if (key.asymmetricKeyType !== 'ed25519') throw new Error('public key must be Ed25519')
+  const der = key.export({ format: 'der', type: 'spki' })
+  process.stdout.write(`${createHash('sha256').update(der).digest('hex')}\n`)
+} else if (command === 'sign' && args.length === 3) {
+  const privateKey = createPrivateKey(await readFile(args[0]))
+  if (privateKey.asymmetricKeyType !== 'ed25519') throw new Error('private key must be Ed25519')
+  const publicKey = createPublicKey(privateKey)
+  const der = publicKey.export({ format: 'der', type: 'spki' })
+  const document = await readFile(args[1])
+  const signature = {
+    schema: 1,
+    algorithm: 'Ed25519',
+    keyId: createHash('sha256').update(der).digest('hex'),
+    signature: sign(null, document, privateKey).toString('base64'),
+  }
+  await writeFile(args[2], canonicalJson(signature), { flag: 'wx', mode: 0o600 })
+} else usage()