blob: 7b99863446540f85d4d7674a3ad5b6fba95c98a2 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
#!/usr/bin/env bash
# Generate the developer key that signs every build (README section 15.6).
#
# Output: .cache/keys/developer_key.der (PKCS#8 DER, what monkeyc wants) and
# developer_key.pem, both mode 600 and git-ignored. An existing key is never
# overwritten: the Connect IQ Store rejects updates signed with a different
# key, so replacing it by accident would strand the published app.
set -euo pipefail
# shellcheck source=ciq-env.sh
source "$(dirname "${BASH_SOURCE[0]}")/ciq-env.sh"
umask 077
mkdir -p "${KEY_DIR}"
if [[ -f "${DEV_KEY}" ]]; then
log "Developer key already exists at .cache/keys/developer_key.der; leaving it untouched."
exit 0
fi
log "Generating a 4096-bit RSA developer key (this takes a few seconds)..."
openssl genrsa -out "${KEY_DIR}/developer_key.pem" 4096 2>/dev/null
openssl pkcs8 -topk8 -inform PEM -outform DER -nocrypt \
-in "${KEY_DIR}/developer_key.pem" -out "${DEV_KEY}"
chmod 600 "${KEY_DIR}/developer_key.pem" "${DEV_KEY}"
# A short fingerprint of the public key, so a backup can be recognised later.
fingerprint="$(openssl pkey -in "${KEY_DIR}/developer_key.pem" -pubout -outform DER \
| sha256sum | cut -c1-16)"
cat >&2 <<EOF
Developer key created: .cache/keys/developer_key.der
Public key fingerprint (SHA-256, first 16 hex digits): ${fingerprint}
BACK IT UP NOW. Copy the folder .cache/keys/ to an encrypted place (a password
manager attachment or an encrypted USB drive). Garmin rejects app updates that
are signed with a different key; without this key you would have to publish a
new app and re-add every entry on the watch. 'make nuke' deletes this folder.
EOF
|
