Generates an Ed25519 key pair for signing DSOs, plus the fingerprint the manifest records.

Synopsis

dso-keygen --name <name> --email <email>
           [--key-id <id>]
           [--out-dir <dir>] [--separate]
           [--out-private-dir <dir>] [--out-public-dir <dir>]

--name and --email are required.

Options

Option	Meaning
--name <name>	Developer name. Recorded in the key file header and used as the default --key-id. Required.
--email <email>	Developer e-mail, same. Required.
--key-id <id>	Base name for the output files. Default: a slug of name-email.
--out-dir <dir>	Base output directory. Default: . (current directory). Created if missing.
--separate	Split --out-dir into private/ and public/ subdirectories.
--out-private-dir <dir>	Explicit directory for .key + .fingerprint. Overrides --separate for the private role.
--out-public-dir <dir>	Explicit directory for .pub. Overrides --separate for the public role.
-h, --help	Usage.

Directory resolution, per role: an explicit --out-*-dir wins; else --separate gives <out-dir>/private and <out-dir>/public; else both land in <out-dir>.

Output

File	Role	Notes
<key-id>.key	private	PEM Ed25519 private key, chmod 400, with # Name / # Email / # KeyId header comments.
<key-id>.pub	public	PEM Ed25519 public key. This is what goes in a trusted-keys directory.
<key-id>.fingerprint	private (dev reference)	Hex SHA-256 of the DER-encoded public key — the publicKeyId a signed manifest carries.

The fingerprint file is written next to the private key so a public/ directory stays clean (only *.pub, exactly what a runtime trusted-keys directory wants).

Examples

# everything in the current directory
dso-keygen --name "Alice" --email alice@example.com

# tidy split, custom id
dso-keygen --name "Build Server" --email ci@example.com \
           --key-id build-ci --separate --out-dir /srv/signing-keys
#   /srv/signing-keys/private/build-ci.key
#   /srv/signing-keys/private/build-ci.fingerprint
#   /srv/signing-keys/public/build-ci.pub

# publish the public half to a host
scp /srv/signing-keys/public/build-ci.pub host:/etc/app/trusted-keys.d/

Exit codes

0 success · 1 missing --name / --email, unwritable directory, or an OpenSSL failure.

Notes

• Keep .key offline / access-controlled. Anyone with it can produce a TRUSTED add-on for every host that trusts the matching .pub.
• Losing .key means re-keying: generate a new pair, redistribute the new .pub, re-sign. There is no key rotation protocol beyond that.
• The fingerprint is stable for the life of the key — it identifies the signer in every manifest.