`icon` moves from a per-variant copy to a single assets/icon.png at the
package root, so a host can read it without unpacking a platform build —
the precondition for showing icons before install. Covered by the Merkle
tree, so it is authenticated by manifest.sig for free.
Adds `lgx add --icon` and Package::setIcon(). Validation (PNG, exactly
256x256) runs at verify/sign, not at create/add — a package is
legitimately incomplete mid-assembly.
Required for type ui_qml only; core modules render no tile.
Manifests below 0.4.0 are exempt: icon: "" was legal at 0.3.0 and is what
lgx create defaulted to, so enforcing it would make every published
package uninstallable
* add `lgx signature` — dump raw manifest.sig bytes
Symmetric to `lgx manifest --json`: a machine-readable extractor for
the package's signature blob. Until now the only way to get the raw
manifest.sig out of an .lgx was to extract via `tar -O -xzf` — fine in
CI (release.yml does it) but awkward elsewhere.
Out-of-CI tooling that reproduces what `logos-modules-release-action`
records under `sidecar.json#signature` (e.g. a local index.json builder
for a non-GitHub-hosted catalog) needs the raw signature alongside the
manifest. With `lgx manifest --json` + this new `lgx signature`, both
halves of a signed package's envelope are available without shelling
out to `tar` or knowing the archive layout.
Contract:
- Signed package: stdout = manifest.sig bytes verbatim
(byte-identical to the file inside the .lgx), exit 0.
- Unsigned package: stdout empty, exit 0.
- Bad / missing package: stderr message, exit 1.
Callers distinguish "no signature" from "error" via the exit status,
not the stream length — matches the existing convention for
unsigned-package handling elsewhere in the codebase.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* address PR #23 review
* Distinguish malformed package from unsigned. `Package::load` accepts
any valid-tar-gzip .lgx, including pathological ones with no
`manifest.json` at all — in which case the previous code exited 0
with empty stdout, indistinguishable from a genuinely unsigned
package. Now: missing manifest.json → exit 1 with a message, so the
"signed-vs-unsigned-vs-error" contract holds for malformed inputs
too.
* Set stdout to binary on Windows before writing the signature bytes
so `\n` doesn't get translated to `\r\n`. POSIX stdout is already
binary; the `#ifdef _WIN32` guard is the whole Windows-only
difference. Without this, the "byte-identical to the file inside
the .lgx" contract silently broke on Windows.
* Add CLI tests in tests/test_cli.cpp covering the three branches of
the documented contract: unsigned → empty + exit 0; signed →
manifest.sig JSON (with `did` + `signature` fields) + exit 0;
missing path → message + non-zero exit. Test infra reuses the
existing CLITest fixture / runLgx helper.
* Clarify the README example that pipes `lgx signature` into `jq` —
it's a signed-package-only pipeline, and the unsigned case would
make jq error on the empty stream. Gate the example accordingly.
Verified locally: `ws test logos-package` PASSes; a hand-crafted
tar+gzip with no manifest.json now produces the explicit
"malformed .lgx — not the same as an unsigned package" error and
exits 1, where previously it silently returned exit 0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Khushboo Mehta