Adding Manifest Signatures

[vimalb]

To meet the security requirements of my organization, we needed to implement manifest signing for hot code pushes.

This pull request adds support for the following in the CLI:

1. Using alternate hash functions inside chcp.manifest - the current default (md5) is just fine for detecting normal changes, but it's not secure from intentional tampering. I have added support for sha256 - this can be opted into by setting the "hash_algorithm": "sha256" in cordova-hcp.json or passing the --hash_alogrithm CLI argument
2. Signing chcp.manifest via CLI argument --signing_private_key_file=/path/to/rsa_rivate_key - this will generate a new file in the bundle directory, chcp.signature

Full usage example:

1. Generate 2048-bit RSA private key openssl genrsa -out private.pem 2048
2. Build a signed update bundle with sha256 signatures cordova-hcp build --signing_private_key_file=private.pem --hash_algorithm=sha256

TODO: Update this pull request with a link to the corresponding pull with support in cordova-hot-code-push

Notes:

• Alternate hash algorithms is independent of the signature feature - you may switch hash algorithm to sha256 without signing builds and vice versa
• Switching hash algorithm is a breaking change - existing clients which were build with only md5 support will not recognize the new hashes and will treat all files as corrupted
• Signing manifests is a backwards-compatible change - existing clients which do not support validating manifest signatures will simply ignore the chcp.signature file

Please review these changes and let me know what I should change, test, or fix before you are comfortable accepting this pull.

[vimalb]

Update: corresponding plugin changes are here: https://github.com/nordnet/cordova-hot-code-push/pull/199

Also I should note that I only committed my changes to src, not to dist - once this pull is reviewed, I'm happy to also include a dist build commit but I'd rather focus on src right now.

[nikDemyankov]

Thanks again for this PR! :)

[nordnet-deprecation-bot]

👋 Hi! Thank you for your interest in this repo.

😢 We are not using nordnet/cordova-hot-code-push-cli anymore, and we lack the manpower and the experience needed to maintain it. We are aware of the inconveniece that this may cause you. Feel free to use it as is, or create your own fork.

🔒 This will now be closed & locked.

ℹ️ Please see #79 for more information.