fix: create private key file outside extension directory by default #104
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
BREAKING CHANGE: if no `--private-key` is passed, module will look for `extension/../key.pem` instead of `extension/key.pem`. It should discourage risky behavior of keeping private key file inside extension's directory (the one that is ZIPped and packed into CRX file). fixes: thom4parisot#101
|
@arkon i guess it can, but i'm not a fan of separating |
ahwayakchih
added a commit
to ahwayakchih/crx
that referenced
this pull request
Apr 17, 2019
BREAKING CHANGE introduced by thom4parisot#104
|
In the future, private key could become mandatory by making it explicit, and by reporting an error if it's contained in the paths. At the moment, they are silently ignored during the packing operation: |
|
@oncletom Yes, but it's up to dependency to actually ignore those files. I takes just one bug, we can't even quickly fix, and private keys become very public. Of course the same can be said about the code we control, but now it takes two bugs instead of one for private keys to become public ;). |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
BREAKING CHANGE: if no
--private-keyis passed, module will look forextension/../key.peminstead ofextension/key.pem. It should discourage risky behavior of keeping private key file inside extension's directory (the one that is ZIPped and packed into CRX file).fixes: #101