Fix self-signing private key lost

Author: Aeliux

src/EasySign.Cli/Properties/launchSettings.json

@@ -13,7 +13,7 @@
     },
     "Sign": {
       "commandName": "Project",
-      "commandLineArgs": "sign ."
+      "commandLineArgs": "sign . -s"
     }
   }
 }

src/EasySign.CommandLine/BundleWorker.cs

@@ -18,7 +18,42 @@ public abstract partial class CommandProvider<T>
         /// Initializes the bundle.
         /// </summary>
         /// <param name="bundlePath">Path of the bundle.</param>
-        public abstract void InitializeBundle(string bundlePath);
+        protected abstract void InitializeBundle(string bundlePath);
+
+        /// <summary>
+        /// Loads the bundle from file and handles load errors.
+        /// </summary>
+        /// <param name="readOnly">
+        /// A value indicating whether to load the bundle in read-only mode.
+        /// </param>
+        protected bool LoadBundle(bool readOnly = true)
+        {
+            if (Bundle == null)
+            {
+                throw new ApplicationException("Bundle is not initialized");
+            }
+
+            try
+            {
+                Bundle.LoadFromFile(readOnly);
+
+                if (!string.IsNullOrEmpty(Bundle.Manifest.UpdatedBy) && Bundle.Manifest.UpdatedBy != Bundle.GetType().FullName)
+                {
+                    Logger.LogWarning("Bundle was created by a different application");
+                    AnsiConsole.MarkupLine($"[{Color.Orange1}]Warning:[/] Bundle was created by a different application");
+                }
+
+                return true;
+            }
+            catch (Exception ex)
+            {
+                Logger.LogError(ex, "Failed to load bundle from file: {BundlePath}", Bundle.BundlePath);
+                AnsiConsole.MarkupLine($"[{Color.Red}]Failed to load bundle from file: {Bundle.BundlePath}[/]");
+                AnsiConsole.MarkupLine($"[{Color.Red}]Error:[/] {ex.GetType().Name}: {ex.Message}");
+            }
+
+            return false;
+        }
 
         /// <summary>
         /// Runs the add command.
@@ -45,7 +80,8 @@ protected virtual void RunAdd(StatusContext statusContext, bool replace, bool co
             {
                 Logger.LogDebug("A bundle file exists, loading bundle");
                 statusContext.Status("[yellow]Loading Bundle[/]");
-                Bundle.LoadFromFile(false);
+                
+                if (!LoadBundle(false)) return;
             }
 
             statusContext.Status("[yellow]Adding Files[/]");
@@ -151,7 +187,7 @@ protected virtual void RunSign(StatusContext statusContext, X509Certificate2Coll
 
             Logger.LogDebug("Loading bundle");
             statusContext.Status("[yellow]Loading Bundle[/]");
-            Bundle.LoadFromFile(false);
+            if (!LoadBundle(false)) return;
 
             int divider = 0;
             int signs = 0;
@@ -194,7 +230,7 @@ protected virtual void RunSign(StatusContext statusContext, X509Certificate2Coll
                 if (prvKey == null)
                 {
                     Logger.LogError("Failed to acquire RSA private key for {cert}", cert);
-                    AnsiConsole.MarkupLine($"[{Color.Green}] Failed to Acquire RSA Private Key[/]");
+                    AnsiConsole.MarkupLine($"[{Color.Red}] Failed to Acquire RSA Private Key[/]");
                     continue;
                 }
 
@@ -246,7 +282,7 @@ protected virtual void RunVerify(StatusContext statusContext)
 
             Logger.LogDebug("Loading bundle");
             statusContext.Status("[yellow]Loading Bundle[/]");
-            Bundle.LoadFromFile();
+            if (!LoadBundle()) return;
 
             Logger.LogInformation("Starting certificate and signature verification");
             statusContext.Status("[yellow]Verification Phase 1: Certificates and signatures[/]");
@@ -414,7 +450,7 @@ protected bool VerifyCertificate(X509Certificate2 certificate)
 
                 Logger.LogInformation("Certificate verification with self-signing root CA for {cert}: {result}", certificate, selfSignVerification);
 
-                if (!selfSignVerification)
+                if (selfSignVerification)
                 {
                     AnsiConsole.MarkupLine($"[{Color.Green}] Certificate Verification with Self-Signing Root CA Successful[/]");
                     return true;

src/EasySign.CommandLine/CertificateUtilities.cs

@@ -122,6 +122,8 @@ public static X509Certificate2Collection GetCertificates(string pfxFilePath, str
                     store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
 
                     collection = store.Certificates;
+
+                    store.Close();
                 }
                 catch
                 {
@@ -201,9 +203,9 @@ public static X509Certificate2 CreateSelfSignedCACertificate(string subjectName)
 
                 // Export and re-import to mark the key as exportable (if needed for further signing).
 #if NET9_0_OR_GREATER
-                var cert = X509CertificateLoader.LoadPkcs12(rootCert.Export(X509ContentType.Pfx), null);
+                var cert = X509CertificateLoader.LoadPkcs12(rootCert.Export(X509ContentType.Pfx), null, X509KeyStorageFlags.EphemeralKeySet | X509KeyStorageFlags.Exportable);
 #else
-                var cert = new X509Certificate2(rootCert.Export(X509ContentType.Pfx));
+                var cert = new X509Certificate2(rootCert.Export(X509ContentType.Pfx), "", X509KeyStorageFlags.EphemeralKeySet | X509KeyStorageFlags.Exportable);
 #endif
 
                 return cert;
@@ -220,6 +222,8 @@ public static X509Certificate2 IssueCertificate(string subjectName, X509Certific
         {
             using (RSA rsa = RSA.Create(2048))
             {
+                _ = rsa.ExportRSAPrivateKey(); // Ensure the RSA key is created.
+
                 // Build the certificate request for the issued certificate.
                 var req = new CertificateRequest(subjectName, rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
 
@@ -255,14 +259,7 @@ public static X509Certificate2 IssueCertificate(string subjectName, X509Certific
                     var issuedCert = req.Create(caCert, DateTimeOffset.UtcNow.AddDays(-1),
                                                   DateTimeOffset.UtcNow.AddYears(2), serialNumber);
 
-                    // Export and re-import to ensure the certificate includes the private key.
-#if NET9_0_OR_GREATER
-                    var cert = X509CertificateLoader.LoadPkcs12(issuedCert.Export(X509ContentType.Pfx), null);
-#else
-                    var cert = new X509Certificate2(issuedCert.Export(X509ContentType.Pfx));
-#endif
-
-                    return cert;
+                    return issuedCert.CopyWithPrivateKey(rsa);
                 }
             }
         }