* feat(templates): require signatures for javascript templates
Unsigned javascript templates should not be
accepted into execution paths when template
signing is enforced.
Apply the signature check to javascript protocol
templates in both direct loading and workflows,
and report those skips separately from code
templates.
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(signer): normalize line endings when signing
The verifier already canonicalizes CRLF to LF
before checking the digest, but the signer still
hashed the raw file content. Templates signed from
a CRLF checkout could fail verification later,
which showed up on Windows after javascript
fixtures started being signed in the integration
harness.
Use the same canonical content for signing and
verification, and add a CRLF sign-and-verify
regression.
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
Dwi Siswanto