crx3-utils

Starting with Chrome 73, Chrome changed the package format for extensions to the CRX3 file format.

$ npm -g i crx3-utils

Usage:

$ crx3-new private.pem < file.zip

The util is intentionally bare bone: it doesn't generate a private key for you (use openssl for that) & it doesn't compress your directory (use zip for that).

Print info for a .crx downloaded from the Chome Web Store:

$ crx3-info < file.crx
id                   ckbpebiaofifhmkecjijobfafcfngfkj
header               1322
payload              8233
sha256_with_rsa      2 main_idx=1
sha256_with_ecdsa    1

(main_idx is the index of AsymmetricKeyProof that contains a public key from which the id was derived during the .crx creation.)

Extract zip:

$ crx3-info < file.crx | awk '/^header/ {print $2}' \
    | xargs -I% dd if=file.crx iflag=skip_bytes skip=% > file.zip

Extract the 1st rsa public key:

$ crx3-info rsa 0 < file.crx
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj/u/XDdjlDyw7gHEtaaa
sZ9GdG8WOKAyJzXd8HFrDtz2Jcuy7er7MtWvHgNDA0bwpznbI5YdZeV4UfCEsA4S
rA5b3MnWTHwA1bgbiDM+L9rrqvcadcKuOlTeN48Q0ijmhHlNFbTzvT9W0zw/GKv8
LgXAHggxtmHQ/Z9PP2QNF5O8rUHHSL4AJ6hNcEKSBVSmbbjeVm4gSXDuED5r0nwx
vRtupDxGYp8IZpP5KlExqNu1nbkPc+igCTIB6XsqijagzxewUHCdovmkb2JNtskx
/PMIEv+TvWIx2BzqGp71gSh/dV7SJ3rClvWd2xj8dtxG8FfAWDTIIi0qZXWn2Qhi
zQIDAQAB
-----END PUBLIC KEY-----

Validate (returns 0 on success):

$ crx3-verify rsa 0 public.pem < file.crx

License

MIT.