* add `lgx signature` — dump raw manifest.sig bytes
Symmetric to `lgx manifest --json`: a machine-readable extractor for
the package's signature blob. Until now the only way to get the raw
manifest.sig out of an .lgx was to extract via `tar -O -xzf` — fine in
CI (release.yml does it) but awkward elsewhere.
Out-of-CI tooling that reproduces what `logos-modules-release-action`
records under `sidecar.json#signature` (e.g. a local index.json builder
for a non-GitHub-hosted catalog) needs the raw signature alongside the
manifest. With `lgx manifest --json` + this new `lgx signature`, both
halves of a signed package's envelope are available without shelling
out to `tar` or knowing the archive layout.
Contract:
- Signed package: stdout = manifest.sig bytes verbatim
(byte-identical to the file inside the .lgx), exit 0.
- Unsigned package: stdout empty, exit 0.
- Bad / missing package: stderr message, exit 1.
Callers distinguish "no signature" from "error" via the exit status,
not the stream length — matches the existing convention for
unsigned-package handling elsewhere in the codebase.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* address PR #23 review
* Distinguish malformed package from unsigned. `Package::load` accepts
any valid-tar-gzip .lgx, including pathological ones with no
`manifest.json` at all — in which case the previous code exited 0
with empty stdout, indistinguishable from a genuinely unsigned
package. Now: missing manifest.json → exit 1 with a message, so the
"signed-vs-unsigned-vs-error" contract holds for malformed inputs
too.
* Set stdout to binary on Windows before writing the signature bytes
so `\n` doesn't get translated to `\r\n`. POSIX stdout is already
binary; the `#ifdef _WIN32` guard is the whole Windows-only
difference. Without this, the "byte-identical to the file inside
the .lgx" contract silently broke on Windows.
* Add CLI tests in tests/test_cli.cpp covering the three branches of
the documented contract: unsigned → empty + exit 0; signed →
manifest.sig JSON (with `did` + `signature` fields) + exit 0;
missing path → message + non-zero exit. Test infra reuses the
existing CLITest fixture / runLgx helper.
* Clarify the README example that pipes `lgx signature` into `jq` —
it's a signed-package-only pipeline, and the unsigned case would
make jq error on the empty stream. Gate the example accordingly.
Verified locally: `ws test logos-package` PASSes; a hand-crafted
tar+gzip with no manifest.json now produces the explicit
"malformed .lgx — not the same as an unsigned package" error and
exits 1, where previously it silently returned exit 0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
