`icon` moves from a per-variant copy to a single assets/icon.png at the
package root, so a host can read it without unpacking a platform build —
the precondition for showing icons before install. Covered by the Merkle
tree, so it is authenticated by manifest.sig for free.
Adds `lgx add --icon` and Package::setIcon(). Validation (PNG, exactly
256x256) runs at verify/sign, not at create/add — a package is
legitimately incomplete mid-assembly.
Required for type ui_qml only; core modules render no tile.
Manifests below 0.4.0 are exempt: icon: "" was legal at 0.3.0 and is what
lgx create defaulted to, so enforcing it would make every published
package uninstallable
* feat: add DID-based identity for package signing with comprehensive tests
- Add did:jwk identity layer (base64url, publicKeyToDid, didToPublicKey)
- Replace raw public keys with DID strings in manifest.sig
- Add signer metadata (name, url) and linkedDids placeholder
- JWK private key format (.jwk) replaces PEM (.secret)
- JSON-based keyring with DID lookup
- Make content hashes mandatory (recomputed on every content change)
- Add keygen, keyring, sign commands with DID support
- Add C API (lgx.h) with DID-based signature types
- Add comprehensive test coverage for crypto, keyring, signing, hashes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: replace hashes_valid with package_valid in SignatureInfo
verifySignature() now validates the package (structure + hashes) first
via validatePackage(), removing duplicate hash verification. The
hashes_valid field is replaced by package_valid which reflects the
full package validation result.
- Extract validatePackage() from verify() as non-static instance method
- verify() now delegates to load() + validatePackage()
- verifySignature() calls validatePackage() before checking signature
- Remove duplicate Merkle tree verification from verifySignature()
- Update C API, tests, and downstream consumers
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: signPackage validates instead of recomputing hashes
signPackage() now calls validatePackage() to ensure the package is
valid (structure + hashes) before signing. It no longer recomputes
hashes — hashes are already kept up to date by addVariant/removeVariant.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add lgx_keyring_list C API for listing trusted keys
Adds lgx_keyring_list() and lgx_free_keyring_list() to the C API,
enabling downstream consumers to enumerate trusted keys in the keyring.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add custom directory options to keygen, keyring, sign, and verify CLI commands
- keygen: --output-dir / -o to specify key output directory
- keyring: --dir / -d to specify keyring directory
- sign: --keys-dir / -d to specify keys directory
- verify: --keyring-dir to specify keyring directory for trust lookup
All default to the standard ~/.config/logos/ paths when not specified.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update spec, project, and README for directory options and TOFU removal
- Add --output-dir, --keys-dir, --dir, --keyring-dir options to CLI docs
- Add signing/keyring C API functions to project.md
- Add test_crypto.cpp and libsodium to project.md
- Remove --tofu from install-time verification docs
- Update lifecycle example with signing and trust management steps
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review feedback — security, robustness, and clarity
Security:
- Validate key names in keyring to prevent path traversal attacks
- Add missing <cstdlib> include for std::getenv
Robustness:
- Detect malformed manifest.sig (report as invalid, not unsigned)
- Fail validation when crypto::init() fails instead of skipping hashes
- Check init() return value in sign() and verify()
- Handle zero-length input in base64 encode functions
- Check ensureDirectory() path is actually a directory
Clarity:
- Label signer name/URL as self-asserted in verify output
- Update manifest.cpp comment: hashes for integrity, not just signing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: make recomputeHashes return Result to fail loudly on crypto errors
Previously recomputeHashes() silently returned without setting hashes
when crypto::init() failed. Now addVariant/removeVariant propagate
the error so packages are never saved without hashes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Khushboo Mehta