Nuxt Modules Capstone: The Signed Build
Based on the official Nuxt release notesThe wall is done. It runs in the browser, persists on the server, and is typed and tested.
Now the other half of the boundary — code that only ever runs while Nuxt builds. node:crypto, the filesystem, the commit sha. At build time the module signs { handle, siteUrl, buildSha, timestamp } with an ed25519 private key and stamps the token into every page's <head>. Anyone reading the source can check it.
It's a compact lesson in getting a small crypto surface right, where two of the obvious designs are quietly wrong — one of them wrong in the way that looks like verification and checks nothing.
Continues from The Basics and Going Further. The mark is independent of the wall, so you can follow this on its own — but the module scaffolding comes from step two of The Basics.
What we cover here#
- The Signed Mark — ed25519 keys on first build, canonical signing, head injection, and a verify endpoint.
- Deploy to the Blog — installing in a real app, the packaging trap, and verifying on production output.
What "done" looks like#
The module running on this page. Open devtools:
await $presence.verify()
// { valid: true, payload: { handle: "vantolbennett", buildSha: "…", … } }
That mark was signed by the build that published this page.
How this series works#
Each step follows the same path: What it is → Why you'd care → Before → After → Do it yourself → Gotchas → Recap.