From 43b4eceb8fc6c5f5ef2fe94784eedaff90787cb9 Mon Sep 17 00:00:00 2001 From: triniwiz Date: Sat, 7 Nov 2026 12:01:55 -0400 Subject: [PATCH] fix(runtime): read the nsbundle_pack sealing key from NS_BUNDLE_KEY_HEX Command lines show up in process lists and in process-creation audit logs. --key-hex keeps working for CLIs that pass it. --- runtime/src/bin/nsbundle_pack.rs | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/runtime/src/bin/nsbundle_pack.rs b/runtime/src/bin/nsbundle_pack.rs index 03d92f8..7830b36 100644 --- a/runtime/src/bin/nsbundle_pack.rs +++ b/runtime/src/bin/nsbundle_pack.rs @@ -9,7 +9,8 @@ //! `key_mode = 1` (custom key); the app must call `runtime_set_bundle_key(sameHex)` before //! `runtime_init`, or the sealed bundle cannot be opened at startup. `--write-key` seals with a //! fresh random key and writes its hex to ``, which the app template compiles into the -//! exe and passes to `runtime_set_bundle_key`. +//! exe and passes to `runtime_set_bundle_key`. `NS_BUNDLE_KEY_HEX` works like `--key-hex` and +//! keeps the key out of process lists and command-line audit logs. //! //! This is the packer half of the CLI contract documented for the NativeScript CLI's //! `ns build windows`/`ns deploy windows`: invoke this after webpack finishes, pointing `--input` @@ -23,7 +24,8 @@ use runtime::source_protect; fn print_usage() { eprintln!( - "Usage: nsbundle_pack --input --output [--key-hex <64 hex chars> | --write-key ]" + "Usage: nsbundle_pack --input --output [--key-hex <64 hex chars> | --write-key ]\n\ + The key can also come from %NS_BUNDLE_KEY_HEX% (command lines are logged and visible)." ); } @@ -62,6 +64,12 @@ fn main() -> ExitCode { return ExitCode::FAILURE; } + if key_hex.is_none() && write_key.is_none() { + key_hex = std::env::var("NS_BUNDLE_KEY_HEX") + .ok() + .filter(|k| !k.is_empty()); + } + if let Some(path) = write_key { if key_hex.is_some() { eprintln!("--key-hex and --write-key are mutually exclusive");