tynd keygen

tynd keygen                                 # default: tynd-updater.{key,pub}
tynd keygen --out release/updater           # custom base path

Generates an Ed25519 keypair for signing auto-updater artifacts. Uses WebCrypto — no OpenSSL / external signing tool needed.

Flags

Global flags: --verbose, --quiet.

Output

• <base>.key — PKCS#8 private key.
  Store offline. Never commit. Compromise of this key lets an attacker ship malicious updates to every user of your app.

• <base>.pub — raw 32-byte public key (base64).

Workflow

tynd keygen --out release/updater

echo "release/updater.key" >> .gitignore
git add release/updater.pub

export const UPDATER_PUB_KEY = "cFpG...RVDv/RQ=";

tynd sign release/MyApp-1.2.3-setup.exe \
  --key release/updater.key \
  --out release/MyApp-1.2.3-setup.exe.sig

Rotating the key

Ed25519 keys don’t expire, but if compromised:

1. Generate a new keypair.
2. Ship an update signed with the old key that bakes in the new pubkey.
3. After that update rolls out, sign future updates only with the new key.

Users who haven’t applied the migration are stuck on the old trust root — there’s no remote revocation.

Related

• tynd sign — sign files with the generated key.
• updater API — runtime verification.
• Auto-Updates guide.