From b663f0e77439ffa1381af1bed8a6b73896dd370e Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Wed, 30 Sep 2026 14:24:29 +0200
Subject: [PATCH] fix: treat an empty PLUGIN_SIGNING_KEY_FILE as unset #996

---
 lib/admin/__tests__/plugin-signing.test.ts | 12 ++++++++++++
 lib/admin/plugin-signing.ts                |  7 +++++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/lib/admin/__tests__/plugin-signing.test.ts b/lib/admin/__tests__/plugin-signing.test.ts
index 20d6d1ddf..92f625d53 100644
--- a/lib/admin/__tests__/plugin-signing.test.ts
+++ b/lib/admin/__tests__/plugin-signing.test.ts
@@ -64,6 +64,18 @@ describe('plugin signing key storage', () => {
     await expect(getPublicKeyBase64()).resolves.toBe(expected.subarray(-32).toString('base64'));
   });
 
+  it('treats an empty PLUGIN_SIGNING_KEY_FILE as unset', async () => {
+    const configDir = path.join(dir, 'config');
+    const pem = privateKeyPem();
+    await mkdir(configDir);
+    await writeFile(path.join(configDir, 'plugin-signing.key'), pem);
+    vi.stubEnv('PLUGIN_SIGNING_KEY_FILE', '');
+    vi.stubEnv('ADMIN_CONFIG_DIR', configDir);
+
+    const expected = createPublicKey(pem).export({ type: 'spki', format: 'der' }) as Buffer;
+    await expect(getPublicKeyBase64()).resolves.toBe(expected.subarray(-32).toString('base64'));
+  });
+
   it('keeps generating plugin-signing.key when external path is unset', async () => {
     const configDir = path.join(dir, 'config');
     vi.stubEnv('ADMIN_CONFIG_DIR', configDir);
diff --git a/lib/admin/plugin-signing.ts b/lib/admin/plugin-signing.ts
index 977f8233b..f4591a9f8 100644
--- a/lib/admin/plugin-signing.ts
+++ b/lib/admin/plugin-signing.ts
@@ -47,8 +47,11 @@ async function loadExternal(path: string): Promise<{ privateKey: KeyObject; publ
 }
 
 async function loadOrCreate(): Promise<{ privateKey: KeyObject; publicKey: KeyObject }> {
-  const externalPath = process.env.PLUGIN_SIGNING_KEY_FILE;
-  if (externalPath !== undefined) return loadExternal(externalPath);
+  // An empty value (`PLUGIN_SIGNING_KEY_FILE=` in an env file) means unset,
+  // like the other *_FILE variables. Reading '' fails, and a failed load
+  // makes every bundle ship unsigned with only a console warning.
+  const externalPath = process.env.PLUGIN_SIGNING_KEY_FILE?.trim();
+  if (externalPath) return loadExternal(externalPath);
 
   await ensureConfigDir();
   const path = getConfigPath(KEY_FILENAME);