Administracion-Abierta/AutoFirme

选用指南

AI 根据 README 整理 · 2026/10/16 00:46:25

使用方式

通过浏览器访问，支持拖放文件进行签名或验证，也可作为PWA安装使用。

查看 README 依据

| `src/routes/` | Pages — `/` is the sign flow | | `src/lib/App.svelte` | Sign workflow shell (2/3 drop + file list, 1/3 sticky actions on ≥1024px; stacked below) and verify workflow | | `src/lib/components/` | `FileDrop`, `FileCard`, `CertPicker`, `BatchQueue`, `VerifyReport` | | `src/lib/components/ui/` | shadcn-svelte primitives (button, card, table, badge, input, dropdown-menu, dialog, tooltip) + their snapshot test (#27) | | `src/lib/utils.ts` | `cn()` class merger used by the primitives | | `components.json` | shadcn-svelte CLI config (`#lib` aliases, neutral base, `src/app.css`) |

Build context is the repo root: ```bash docker build -f Containerfile -t autofirme-web . docker run --rm -p 8080:80 autofirme-web # http://localhost:8080/ ``` Multi-stage: `node:22-alpine` builds the static site, `caddy:2-alpine` serves it with the SPA fallback (`try_files {path} {path}/ /404.html`). ## Installable app (PWA) — #47 `pnpm build` emits `build/manifest.webmanifest` and `build/service-worker.js`, and the prerendered HTML registers the worker — all of it SvelteKit's own service-worker support (no plugin, no

部署要求

需要现代浏览器支持WebCrypto，构建需要Node 22和pnpm，部署需要HTTPS（localhost除外）。

查看 README 依据

core this rewrite follows, and [AGENTS.md](AGENTS.md) for the repo rules. The app lives at the repo root; from the root: ```bash pnpm install pnpm test pnpm build ``` ## Stack - SvelteKit 3 (static adapter) + Svelte 5 runes + Vite + TypeScript - Tailwind CSS v4 (`@tailwindcss/vite`) - shadcn-svelte components (bits-ui) on the same tokens; dark mode is the `.dark` class on `<html>`, driven by the system preference from an inline script in `src/app.html` (#27) - pnpm, Node 22 for builds - Vitest + `@testing-library/svelte` + jsdom for the smoke test | Path | Contents | |---|---|

the click posts `SKIP_WAITING` and the page reloads once the new worker takes control. Self-hosting notes: - **HTTPS is required** for the service worker (and therefore for install) — the only exception is `http://localhost`. Behind a Cloudflare Tunnel the site is already HTTPS, so there is nothing to configure; on bare nginx/k3s, terminate TLS first. - `.webmanifest` needs `application/manifest+json`. Caddy's Go mime table has no entry for it, so the `Caddyfile` sets it explicitly; on nginx add `types { application/manifest+json webmanifest; }`.

已知限制

不支持OCSP/CRL吊销检查、验证传入签名的时间戳和证书策略；仅支持SHA-256算法；签名时仅嵌入签名者证书，不包含证书链。

查看 README 依据

algorithms or transforms are reported as a red check with a reason instead of a silent pass. Revocation (OCSP/CRL), *validating* a timestamp of an incoming signature and certificate policies are out of scope. Timestamps can be **added** when signing, though — see the TSA section below. Fixtures: `bash test/fixtures/generate.sh` rebuilds them (throwaway test PKI, keys gitignored), `bash test/fixtures/verify-fixtures.sh` cross-checks them with `openssl cms -verify` and an independent python digest recomputation. `pnpm test` runs that cross-check as part of the suite. ## Container

is expected there — the signature checks are what it demonstrates. - The report's `certChain` line is printed as it comes. Signing embeds only the signer certificate (#6), so even with the real FNMT keystore — whose container carries `AC FNMT Usuarios` — it reads `issuer certificate not included`, and verifying *your own* fresh `.csig` in the app shows a red *Trust chain* card. Embedding the chain is a separate change. - `--cert work/certs/old-cert.p12` is expected to fail `certValidity`: that keystore expired 2026-03-29 (issue #40 owns the expired-certificate path).