@libp2p/floodsub 11.0.31-e48eabf67 → 11.0.32-2d4c93ed6

package/dist/src/sign.d.ts

@@ -1,9 +1,9 @@
 import type { PubSubRPCMessage } from './floodsub.ts';
 import type { SignedMessage } from './index.ts';
-import type { PeerId, PrivateKey, PublicKey } from '@libp2p/interface';
+import type { PeerId, PrivateKey } from '@libp2p/interface';
 export declare const SignPrefix: Uint8Array<ArrayBuffer>;
 /**
- * Signs the provided message with the given `peerId`
+ * Signs the provided message with the given private key
  */
 export declare function signMessage(privateKey: PrivateKey, message: {
     from: PeerId;
@@ -12,12 +12,8 @@ export declare function signMessage(privateKey: PrivateKey, message: {
     sequenceNumber: bigint;
 }, encode: (rpc: PubSubRPCMessage) => Uint8Array): Promise<SignedMessage>;
 /**
- * Verifies the signature of the given message
+ * Verifies the signature of the given message, returning false if its key does
+ * not belong to the author
  */
 export declare function verifySignature(message: SignedMessage, encode: (rpc: PubSubRPCMessage) => Uint8Array): Promise<boolean>;
-/**
- * Returns the PublicKey associated with the given message.
- * If no valid PublicKey can be retrieved an error will be returned.
- */
-export declare function messagePublicKey(message: SignedMessage): PublicKey;
 //# sourceMappingURL=sign.d.ts.map

package/dist/src/sign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/sign.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAEtE,eAAO,MAAM,UAAU,yBAAyC,CAAA;AAEhE;;GAEG;AACH,wBAAsB,WAAW,CAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAoBpN;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA4B9H;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAE,OAAO,EAAE,aAAa,GAAG,SAAS,CAwBnE"}
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/sign.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAa,MAAM,mBAAmB,CAAA;AAEtE,eAAO,MAAM,UAAU,yBAAyC,CAAA;AAEhE;;GAEG;AACH,wBAAsB,WAAW,CAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAoBpN;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAsC9H"}

package/dist/src/sign.js

@@ -1,10 +1,11 @@
+import { publicKeyForPeer } from '@libp2p/crypto/keys';
 import { peerIdFromPrivateKey } from '@libp2p/peer-id';
 import { concat as uint8ArrayConcat } from 'uint8arrays/concat';
 import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string';
 import { toRpcMessage } from "./utils.js";
 export const SignPrefix = uint8ArrayFromString('libp2p-pubsub:');
 /**
- * Signs the provided message with the given `peerId`
+ * Signs the provided message with the given private key
  */
 export async function signMessage(privateKey, message, encode) {
     // @ts-expect-error signature field is missing, added below
@@ -25,7 +26,8 @@ export async function signMessage(privateKey, message, encode) {
     return outputMessage;
 }
 /**
- * Verifies the signature of the given message
+ * Verifies the signature of the given message, returning false if its key does
+ * not belong to the author
  */
 export async function verifySignature(message, encode) {
     if (message.type !== 'signed') {
@@ -46,34 +48,18 @@ export async function verifySignature(message, encode) {
             key: undefined
         }).subarray()
     ]);
-    // Get the public key
-    const pubKey = messagePublicKey(message);
-    // verify the base message
-    return pubKey.verify(bytes, message.signature);
-}
-/**
- * Returns the PublicKey associated with the given message.
- * If no valid PublicKey can be retrieved an error will be returned.
- */
-export function messagePublicKey(message) {
-    if (message.type !== 'signed') {
-        throw new Error('Message type must be "signed" to have a public key');
+    let pubKey;
+    try {
+        // only trust a supplied key if it derives to the author
+        pubKey = await publicKeyForPeer(message.from, message.key);
     }
-    // should be available in the from property of the message (peer id)
-    if (message.from == null) {
-        throw new Error('Could not get the public key from the originator id');
-    }
-    // an Ed25519/secp256k1 peer id embeds its own public key, so a key recovered
-    // from `from` is provably the author's; trust it over the supplied message.key
-    if (message.from.publicKey != null) {
-        return message.from.publicKey;
-    }
-    // otherwise the supplied key must derive to the from peer id, else a message
-    // could be signed by one key while claiming a different author
-    if (message.key != null && message.from.equals(message.key.toMultihash().bytes)) {
-        return message.key;
+    catch (err) {
+        if (err.name === 'InvalidPublicKeyError') {
+            return false;
+        }
+        throw err;
     }
-    // We couldn't validate pubkey is from the originator, error
-    throw new Error('Could not get the public key from the originator id');
+    // verify the base message
+    return pubKey.verify(bytes, message.signature);
 }
 //# sourceMappingURL=sign.js.map

package/dist/src/sign.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAKzC,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;AAEhE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,UAAsB,EAAE,OAAkF,EAAE,MAA6C;IAC1L,2DAA2D;IAC3D,MAAM,aAAa,GAAkB;QACnC,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,oBAAoB,CAAC,UAAU,CAAC;KACvC,CAAA;IAED,+DAA+D;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC;QAC7B,UAAU;QACV,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAA;IAEF,aAAa,CAAC,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtD,aAAa,CAAC,GAAG,GAAG,UAAU,CAAC,SAAS,CAAA;IAExC,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAE,OAAsB,EAAE,MAA6C;IAC1G,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IAED,iCAAiC;IACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC;QAC7B,UAAU;QACV,MAAM,CAAC;YACL,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,SAAS;SACf,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAA;IAEF,qBAAqB;IACrB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAExC,0BAA0B;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAE,OAAsB;IACtD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAA;IAC/B,CAAC;IAED,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,OAAO,CAAC,GAAG,CAAA;IACpB,CAAC;IAED,4DAA4D;IAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;AACxE,CAAC"}
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAKzC,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;AAEhE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,UAAsB,EAAE,OAAkF,EAAE,MAA6C;IAC1L,2DAA2D;IAC3D,MAAM,aAAa,GAAkB;QACnC,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,oBAAoB,CAAC,UAAU,CAAC;KACvC,CAAA;IAED,+DAA+D;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC;QAC7B,UAAU;QACV,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAA;IAEF,aAAa,CAAC,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtD,aAAa,CAAC,GAAG,GAAG,UAAU,CAAC,SAAS,CAAA;IAExC,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAE,OAAsB,EAAE,MAA6C;IAC1G,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IAED,iCAAiC;IACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC;QAC7B,UAAU;QACV,MAAM,CAAC;YACL,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,SAAS;SACf,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAA;IAEF,IAAI,MAAiB,CAAA;IAErB,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACzC,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,GAAG,CAAA;IACX,CAAC;IAED,0BAA0B;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@libp2p/floodsub",
-  "version": "11.0.31-e48eabf67",
+  "version": "11.0.32-2d4c93ed6",
   "description": "libp2p-floodsub, also known as pubsub-flood or just dumbsub, this implementation of pubsub focused on delivering an API for Publish/Subscribe, but with no CastTree Forming (it just floods the network).",
   "license": "Apache-2.0 OR MIT",
   "homepage": "https://github.com/libp2p/js-libp2p/tree/main/packages/floodsub#readme",
@@ -54,22 +54,22 @@
     "test:electron-main": "aegir test -t electron-main"
   },
   "dependencies": {
-    "@libp2p/crypto": "5.1.24-e48eabf67",
-    "@libp2p/interface": "3.3.1-e48eabf67",
-    "@libp2p/interface-internal": "3.1.14-e48eabf67",
-    "@libp2p/peer-collections": "7.0.29-e48eabf67",
-    "@libp2p/peer-id": "6.0.16-e48eabf67",
-    "@libp2p/utils": "7.4.2-e48eabf67",
+    "@libp2p/crypto": "5.1.25-2d4c93ed6",
+    "@libp2p/interface": "3.4.0-2d4c93ed6",
+    "@libp2p/interface-internal": "3.2.0-2d4c93ed6",
+    "@libp2p/peer-collections": "7.0.30-2d4c93ed6",
+    "@libp2p/peer-id": "6.0.17-2d4c93ed6",
+    "@libp2p/utils": "7.4.3-2d4c93ed6",
     "it-length-prefixed": "^11.0.1",
     "main-event": "^1.0.5",
     "multiformats": "^14.0.0",
-    "p-queue": "^9.0.0",
+    "p-queue": "^10.0.0",
     "protons-runtime": "^7.0.0",
     "uint8arraylist": "^3.0.2",
     "uint8arrays": "^6.1.1"
   },
   "devDependencies": {
-    "@libp2p/logger": "6.2.14-e48eabf67",
+    "@libp2p/logger": "6.2.15-2d4c93ed6",
     "@multiformats/multiaddr": "^13.0.3",
     "@types/sinon": "^22.0.0",
     "aegir": "^48.1.1",

package/src/sign.ts

@@ -1,3 +1,4 @@
+import { publicKeyForPeer } from '@libp2p/crypto/keys'
 import { peerIdFromPrivateKey } from '@libp2p/peer-id'
 import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
 import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
@@ -9,7 +10,7 @@ import type { PeerId, PrivateKey, PublicKey } from '@libp2p/interface'
 export const SignPrefix = uint8ArrayFromString('libp2p-pubsub:')
 
 /**
- * Signs the provided message with the given `peerId`
+ * Signs the provided message with the given private key
  */
 export async function signMessage (privateKey: PrivateKey, message: { from: PeerId, topic: string, data: Uint8Array, sequenceNumber: bigint }, encode: (rpc: PubSubRPCMessage) => Uint8Array): Promise<SignedMessage> {
   // @ts-expect-error signature field is missing, added below
@@ -34,7 +35,8 @@ export async function signMessage (privateKey: PrivateKey, message: { from: Peer
 }
 
 /**
- * Verifies the signature of the given message
+ * Verifies the signature of the given message, returning false if its key does
+ * not belong to the author
  */
 export async function verifySignature (message: SignedMessage, encode: (rpc: PubSubRPCMessage) => Uint8Array): Promise<boolean> {
   if (message.type !== 'signed') {
@@ -59,39 +61,19 @@ export async function verifySignature (message: SignedMessage, encode: (rpc: Pub
     }).subarray()
   ])
 
-  // Get the public key
-  const pubKey = messagePublicKey(message)
+  let pubKey: PublicKey
 
-  // verify the base message
-  return pubKey.verify(bytes, message.signature)
-}
+  try {
+    // only trust a supplied key if it derives to the author
+    pubKey = await publicKeyForPeer(message.from, message.key)
+  } catch (err: any) {
+    if (err.name === 'InvalidPublicKeyError') {
+      return false
+    }
 
-/**
- * Returns the PublicKey associated with the given message.
- * If no valid PublicKey can be retrieved an error will be returned.
- */
-export function messagePublicKey (message: SignedMessage): PublicKey {
-  if (message.type !== 'signed') {
-    throw new Error('Message type must be "signed" to have a public key')
+    throw err
   }
 
-  // should be available in the from property of the message (peer id)
-  if (message.from == null) {
-    throw new Error('Could not get the public key from the originator id')
-  }
-
-  // an Ed25519/secp256k1 peer id embeds its own public key, so a key recovered
-  // from `from` is provably the author's; trust it over the supplied message.key
-  if (message.from.publicKey != null) {
-    return message.from.publicKey
-  }
-
-  // otherwise the supplied key must derive to the from peer id, else a message
-  // could be signed by one key while claiming a different author
-  if (message.key != null && message.from.equals(message.key.toMultihash().bytes)) {
-    return message.key
-  }
-
-  // We couldn't validate pubkey is from the originator, error
-  throw new Error('Could not get the public key from the originator id')
+  // verify the base message
+  return pubKey.verify(bytes, message.signature)
 }