@c9up/vellum 0.1.2 → 0.1.4

package/README.md

@@ -318,6 +318,19 @@ signers: {
 }
 ```
 
+**Where this signer's limits are.** It signs with `rsa`, whose modular
+exponentiation is not constant-time — RUSTSEC-2023-0071, which recognises no
+fixed release. Vellum blinds the operation, which is the mitigation the
+advisory itself points to, and that is enough for a key you hold and use on
+work your own application starts.
+
+It is not enough when the signer is reachable from remote input: an HTTP
+endpoint that signs on request, or a queue a client can feed, hands an
+attacker both the timing and the repetition the attack needs. That deployment
+wants an HSM, a remote signing service, or an audited constant-time backend —
+`Signer` is an interface, so one can be dropped in without touching the rest.
+
+
 It builds a CAdES `SignedData` whose signed attributes carry the content type,
 the document's digest, the signing time and — as PAdES requires —
 `signing-certificate-v2`. That last one is not decoration: without it a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/vellum",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "PDF toolkit — convert PDF pages to images, author and inspect documents",
   "type": "module",
   "main": "./dist/index.js",
@@ -31,13 +31,16 @@
       "import": "./dist/services/main.js"
     }
   },
+  "engines": {
+    "node": ">=22.0.0"
+  },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.10",
+    "@biomejs/biome": "^2.5.12",
     "@c9up/ream": "^0.2.0",
-    "@types/node": "^22.19.15",
-    "@vitest/coverage-v8": "^4.1.2",
-    "typescript": "^6.0.2",
-    "vitest": "^4.1.2"
+    "@types/node": "^22.20.1",
+    "@vitest/coverage-v8": "4.1.11",
+    "typescript": "^6.0.3",
+    "vitest": "4.1.11"
   },
   "publishConfig": {
     "access": "public"

package/scripts/copy-napi.mjs

@@ -1,5 +1,5 @@
 import { copyFileSync, existsSync } from 'node:fs'
-import { dirname, join } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
 import { arch, env, platform } from 'node:process'
 import { fileURLToPath } from 'node:url'
 
@@ -20,16 +20,24 @@ const hostSuffixMap = {
   'darwin-x64': 'darwin-x64', 'darwin-arm64': 'darwin-arm64', 'win32-x64': 'win32-x64-msvc',
 }
 
+// Cargo writes its artifacts under CARGO_TARGET_DIR when that is set — a
+// shared cache, a CI mount — so they are not under this package's `target/` at
+// all. A relative value is resolved against the directory cargo ran in, which
+// is this package root.
+const targetDir = env.CARGO_TARGET_DIR
+  ? resolve(root, env.CARGO_TARGET_DIR)
+  : join(root, 'target')
+
 const triple = env.CARGO_BUILD_TARGET ?? ''
 let suffix, os, releaseDir
 if (triple) {
   const entry = tripleMap[triple]
   if (!entry) throw new Error(`${TAG} unsupported CARGO_BUILD_TARGET: ${triple}`)
   suffix = entry.suffix; os = entry.os
-  releaseDir = join(root, 'target', triple, 'release')
+  releaseDir = join(targetDir, triple, 'release')
 } else {
   suffix = hostSuffixMap[`${platform}-${arch}`]; os = platform
-  releaseDir = join(root, 'target', 'release')
+  releaseDir = join(targetDir, 'release')
   if (!suffix) throw new Error(`${TAG} unsupported platform/arch: ${platform}-${arch}`)
 }