fix(ci): text=auto catch-all for line endings, and qualify the genrsa pitfall

.env.example

@@ -216,9 +216,12 @@ DEFAULT_REALM_NAME=master
 # id_token signature test, so a certification deployment MUST set this. See
 # docs/oidf-op-certification-runbook.md.
 #
-# MUST be PKCS#8 PEM ("-----BEGIN PRIVATE KEY-----"). Note that `openssl genrsa`
-# emits PKCS#1 ("-----BEGIN RSA PRIVATE KEY-----"), which is REJECTED — use
-# `openssl genpkey` below, or convert an existing key with:
+# MUST be PKCS#8 PEM ("-----BEGIN PRIVATE KEY-----"). A PKCS#1 key
+# ("-----BEGIN RSA PRIVATE KEY-----") is REJECTED. Which command yields which
+# depends on your OpenSSL: `openssl genrsa` defaults to PKCS#8 since 3.0 (use
+# `-traditional` for PKCS#1), but emits PKCS#1 on 1.1.x and earlier. The
+# `openssl genpkey` form below emits PKCS#8 on every version — prefer it. To
+# convert an existing PKCS#1 key:
 #   openssl pkcs8 -topk8 -nocrypt -in old.pem -out jwt-rs256-private.pem
 #
 # Generate with (RSA MUST be >= 2048-bit):

.gitattributes

@@ -1,10 +1,45 @@
-# Force unix line endings for shell scripts (fixes Windows execution issues)
-*.sh text eol=lf
-*.bash text eol=lf
-*.js text eol=lf
-*.ts text eol=lf
-*.json text eol=lf
-*.yml text eol=lf
-*.yaml text eol=lf
-*.md text eol=lf
-*.mdx text eol=lf
+# Line-ending policy.
+#
+# The catch-all is deliberate. This file previously enumerated eight extensions
+# (*.sh, *.bash, *.js, *.ts, *.json, *.yml, *.yaml, *.md) and every text type
+# added since — *.tsx, *.mjs, *.mts, *.astro, *.mdx, *.css, *.sql, *.toml, *.rs —
+# fell through it. On a checkout with core.autocrlf=true (the Windows default)
+# those files land CRLF against LF blobs, and both `prettier --check` and the
+# `prettier/prettier` ESLint rule then reject them with `Delete ␍` on lines the
+# developer never touched, while `git status` stays clean. CI runs ubuntu-latest,
+# so it never reproduces there. See #363.
+#
+# Enumerating them one at a time is what fails: #389 hit exactly this on the
+# docs site and answered it by appending `*.mdx` to the list, leaving *.astro,
+# *.mjs and *.css — the other extensions that PR introduced — still falling
+# through. That entry is superseded here rather than lost; the rule below covers
+# it and every extension nobody has thought of yet.
+#
+# `text=auto` lets Git detect which files are text; `eol=lf` fixes the working-tree
+# ending for those it does. Binary files are unaffected by the detection, and the
+# explicit `binary` entries below make that independent of heuristics.
+* text=auto eol=lf
+
+# Explicitly binary — never diffed, never line-ending normalised.
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.webp binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.eot binary
+*.otf binary
+*.pdf binary
+*.zip binary
+*.gz binary
+*.wasm binary
+*.node binary
+*.so binary
+*.dylib binary
+*.dll binary
+
+# Generated lockfile — keep it out of diffs and reviews.
+pnpm-lock.yaml -diff linguist-generated

docs/oidf-op-certification-runbook.md

@@ -41,7 +41,7 @@ Therefore:
 - **Public keys (optional) MUST be SPKI PEM** — first line `-----BEGIN PUBLIC KEY-----`. QAuth derives the public key from the private key if you omit it.
 - **RSA MUST be ≥2048-bit.** The conformance test fixture uses exactly `rsa` `modulusLength: 2048` exported pkcs8/pem, ed25519 as pkcs8/spki, example kid `'rsa-2026'` (`apps/auth-server/src/app/routes/oauth/oidc-conformance.test.ts:53-56, 61-63, 68`).
 
-> **Pitfall:** `openssl genrsa` emits **PKCS#1** (`-----BEGIN RSA PRIVATE KEY-----`), which `importPKCS8` rejects. Use `openssl genpkey` (PKCS#8) below, or convert: `openssl pkcs8 -topk8 -nocrypt -in old.pem -out jwt-rs256-private.pem`.
+> **Pitfall:** a **PKCS#1** private key (`-----BEGIN RSA PRIVATE KEY-----`) is rejected — `importPKCS8` reads PKCS#8 only. Which command produces which depends on your OpenSSL: since **3.0**, `openssl genrsa` defaults to PKCS#8, and `-traditional` is needed to get PKCS#1; on **1.1.x and earlier** it emits PKCS#1 unconditionally. Check with `openssl version`, or just look at the first line of the file. `openssl genpkey` (below) emits PKCS#8 on every version, which is why it is the recommendation here. To convert an existing PKCS#1 key: `openssl pkcs8 -topk8 -nocrypt -in old.pem -out jwt-rs256-private.pem`.
 
 ### (a) EdDSA (Ed25519) — required; signs access tokens (and ID tokens when RS256 absent)