Conan2 包签名指南

#!/bin/bash

# 1. 确保 Conan 插件存放目录存在
PLUGIN_DIR="$HOME/.conan2/extensions/plugins/sign"
ORG_DIR="$PLUGIN_DIR/my-organization"
mkdir -p "$ORG_DIR"

# 2. 生成 RSA 私钥和公钥 (仅做演示，存放在插件同级目录)
echo "=> 生成 OpenSSL 密钥对..."
openssl genpkey -algorithm RSA -out "$ORG_DIR/private_key.pem" -pkeyopt rsa_keygen_bits:2048
openssl pkey -in "$ORG_DIR/private_key.pem" -pubout -out "$ORG_DIR/public_key.pem"

# 3. 创建 Conan 的签名插件 sign.py
echo "=> 正在写入 Conan 签名插件..."
cat << 'EOF' > "$PLUGIN_DIR/sign.py"
import os
import json
import subprocess
from conan.errors import ConanException
from conan.api.output import ConanOutput

def sign(ref, artifacts_folder, signature_folder, **kwargs):
    """该函数用于为生成的包进行签名"""
    manifest_filepath = os.path.join(signature_folder, "pkgsign-manifest.json")
    signature_filepath = os.path.join(signature_folder, "pkgsign-manifest.json.sig")

    # 获取存放在缓存目录里的私钥（生产环境中请替换为从环境变量/KMS服务读取）
    privkey_filepath = os.path.join(os.path.dirname(__file__), "my-organization", "private_key.pem")

    openssl_sign_cmd = [
        "openssl", "dgst", "-sha256", "-sign", privkey_filepath,
        "-out", signature_filepath, manifest_filepath
    ]

    try:
        subprocess.run(openssl_sign_cmd, check=True, capture_output=True)
        ConanOutput().success(f"Package successfully signed: {ref}")
    except subprocess.CalledProcessError as exc:
        raise ConanException(f"Error signing artifact: {exc.stderr.decode()}")

    # 将签名的元数据信息返回给 Conan 保存
    return [{
        "method": "openssl-dgst",
        "provider": "my-organization",
        "sign_artifacts": {
            "manifest": "pkgsign-manifest.json",
            "signature": "pkgsign-manifest.json.sig"
        }
    }]

def verify(ref, artifacts_folder, signature_folder, files, **kwargs):
    """该函数用于在下载/使用包前验证签名"""
    signatures_filepath = os.path.join(signature_folder, "pkgsign-signatures.json")
    if not os.path.exists(signatures_filepath):
        raise ConanException(f"No signatures found for {ref}")

    with open(signatures_filepath, "r") as f:
        signatures = json.loads(f.read()).get("signatures", [])

    pubkey_filepath = os.path.join(os.path.dirname(__file__), "my-organization", "public_key.pem")

    for signature in signatures:
        signature_filename = signature.get("sign_artifacts").get("signature")
        manifest_filename = signature.get("sign_artifacts").get("manifest")

        signature_filepath = os.path.join(signature_folder, signature_filename)
        manifest_filepath = os.path.join(signature_folder, manifest_filename)

        openssl_verify_cmd = [
            "openssl", "dgst", "-sha256", "-verify", pubkey_filepath,
            "-signature", signature_filepath, manifest_filepath
        ]

        try:
            subprocess.run(openssl_verify_cmd, check=True, capture_output=True)
            ConanOutput().success(f"Signature correctly verified for: {ref}")
        except subprocess.CalledProcessError as exc:
            raise ConanException(f"Signature validation failed for {ref}: {exc.stderr.decode()}")
EOF

# 4. 创建一个用于测试用的虚拟包 (hello/1.0)
echo "=> 创建测试包 hello/1.0..."
mkdir -p /tmp/conan_hello_test && cd /tmp/conan_hello_test
conan new cmake_lib -d name=hello -d version=1.0
conan create .

# 5. 执行包签名（对 hello/1.0 及其所有 Revision 进行签名）
echo "=> 对缓存中的包执行签名命令..."
conan cache sign "hello/1.0:*"

# 6. 验证包签名
echo "=> 验证该包的签名..."
conan cache verify "hello/1.0:*"

echo "=> 演示完成！清理测试数据..."
rm -rf /tmp/conan_hello_test