@ohos-ports/vscode-vsce-sign 2.1.0-beta.0

package/LICENSE.txt

@@ -0,0 +1,41 @@
+MICROSOFT SOFTWARE LICENSE TERMS
+MICROSOFT VSCE-SIGN
+  
+These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software, except to the extent those have different terms.
+
+IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW.
+
+1. INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software only with Microsoft Visual Studio, Visual Studio for Mac, Visual Studio Code, Azure DevOps, Team Foundation Server, Code Spaces and successor Microsoft products and services (collectively, the "Visual Studio Products and Services") to develop and test your applications.
+
+2. TERMS FOR SPECIFIC COMPONENTS. The software may include third party components with separate legal notices or governed by other agreements, as may be described in the notices file(s) accompanying the software.
+
+3. SCOPE OF LICENSE. The software is licensed, not sold. This agreement only gives you some rights to use the software. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not
+* work around any technical limitations in the software;
+* reverse engineer, decompile or disassemble the software, or otherwise attempt to derive the source code for the software except, and only to the extent required by third party licensing terms governing the use of certain open source components that may be included in the software;
+* remove, minimize, block or modify any notices of Microsoft or its suppliers in the software; 
+* use the software in any way that is against the law; 
+* share, publish, rent or lease the software; or 
+* provide the software as a stand-alone offering or combined with any of your applications for others to use, or transfer the software or this agreement to any third party.
+
+4. EXPORT RESTRICTIONS. You must comply with all domestic and international export laws and regulations that apply to the software, which include restrictions on destinations, end users, and end use. For further information on export restrictions, visit www.microsoft.com/exporting. 
+
+5. SUPPORT SERVICES. Because this software is "as is," we may not provide support services for it.
+
+6. ENTIRE AGREEMENT. This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.
+
+7. APPLICABLE LAW. If you acquired the software in the United States, Washington law applies to interpretation of and claims for breach of this agreement, and the laws of the state where you live apply to all other claims. If you acquired the software in any other country, its laws apply.
+
+8. CONSUMER RIGHTS; REGIONAL VARIATIONS. This agreement describes certain legal rights. You may have other rights, including consumer rights, under the laws of your state or country. Separate and apart from your relationship with Microsoft, you may also have rights with respect to the party from which you acquired the software. This agreement does not change those other rights if the laws of your state or country do not permit it to do so. For example, if you acquired the software in one of the below regions, or mandatory country law applies, then the following provisions apply to you:
+a. Australia. You have statutory guarantees under the Australian Consumer Law and nothing in this agreement is intended to affect those rights.
+
+b. Canada. If you acquired this software in Canada, you may stop receiving updates by turning off the automatic update feature, disconnecting your device from the Internet (if and when you re-connect to the Internet, however, the software will resume checking for and installing updates), or uninstalling the software. The product documentation, if any, may also specify how to turn off updates for your specific device or software.
+
+c. Germany and Austria.
+(i)	Warranty. The properly licensed software will perform substantially as described in any Microsoft materials that accompany the software. However, Microsoft gives no contractual guarantee in relation to the licensed software.
+(ii)	Limitation of Liability. In case of intentional conduct, gross negligence, claims based on the Product Liability Act, as well as, in case of death or personal or physical injury, Microsoft is liable according to the statutory law.
+Subject to the foregoing clause (ii), Microsoft will only be liable for slight negligence if Microsoft is in breach of such material contractual obligations, the fulfillment of which facilitate the due performance of this agreement, the breach of which would endanger the purpose of this agreement and the compliance with which a party may constantly trust in (so-called "cardinal obligations"). In other cases of slight negligence, Microsoft will not be liable for slight negligence.
+
+9. DISCLAIMER OF WARRANTY. THE SOFTWARE IS LICENSED "AS-IS." YOU BEAR THE RISK OF USING IT. MICROSOFT GIVES NO EXPRESS WARRANTIES, GUARANTEES OR CONDITIONS. TO THE EXTENT PERMITTED UNDER YOUR LOCAL LAWS, MICROSOFT EXCLUDES THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
+10. LIMITATION ON AND EXCLUSION OF DAMAGES. YOU CAN RECOVER FROM MICROSOFT AND ITS SUPPLIERS ONLY DIRECT DAMAGES UP TO U.S. $5.00. YOU CANNOT RECOVER ANY OTHER DAMAGES, INCLUDING CONSEQUENTIAL, LOST PROFITS, SPECIAL, INDIRECT OR INCIDENTAL DAMAGES.
+This limitation applies to (a) anything related to the software, services, content (including code) on third party Internet sites, or third party applications; and (b) claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.
+It also applies even if Microsoft knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@ohos-ports/vscode-vsce-sign",
+  "description": "HarmonyOS (OpenHarmony) port of @vscode/vsce-sign - Visual Studio Code extension package signing and verification module",
+  "version": "2.1.0-beta.0",
+  "author": {
+    "name": "Microsoft"
+  },
+  "contributors": [
+    {
+      "name": "@ohos-ports"
+    }
+  ],
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "homepage": "https://github.com/Microsoft/node-vsce-sign",
+  "main": "src/main.js",
+  "ohos_ports": {
+    "upstream": "@vscode/vsce-sign@2.1.0",
+    "platform": "openharmony",
+    "arch": "arm64",
+    "notes": "Upstream node-vsce-sign repository (Rust source) was deleted and is unavailable; native binary is provisioned via the package bin/ directory at packaging time. Without a bundled binary, install succeeds and sign/verify APIs degrade gracefully (ENOENT)."
+  },
+  "scripts": {
+    "postinstall": "node ./src/postinstall.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ohos-ports/ohos-ports.git",
+    "directory": "ports/vscode-vsce-sign/2.1.0"
+  },
+  "bugs": {
+    "url": "https://github.com/ohos-ports/ohos-ports/issues"
+  },
+  "files": [
+    "src"
+  ]
+}

package/src/main.d.ts

@@ -0,0 +1,46 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for
+ *  license information.
+ *--------------------------------------------------------------------------------------------*/
+
+export function verify(vsixFilePath: string, signatureArchiveFilePath: string, verbose?: boolean): Promise<ExtensionSignatureVerificationResult>;
+export function generateManifest(vsixFilePath: string, manifestFilePath?: string, verbose?: boolean): Promise<string>;
+export function zip(manifestFilePath: string, signatureFilePath: string, signatureArchiveFilePath?: string, verbose?: boolean): Promise<string>;
+
+export enum ExtensionSignatureVerificationCode {
+    'Success' = 'Success',
+    'RequiredArgumentMissing' = 'RequiredArgumentMissing',
+    'InvalidArgument' = 'InvalidArgument',
+    'PackageIsUnreadable' = 'PackageIsUnreadable',
+    'UnhandledException' = 'UnhandledException',
+    'SignatureManifestIsMissing' = 'SignatureManifestIsMissing',
+    'SignatureManifestIsUnreadable' = 'SignatureManifestIsUnreadable',
+    'SignatureIsMissing' = 'SignatureIsMissing',
+    'SignatureIsUnreadable' = 'SignatureIsUnreadable',
+    'CertificateIsUnreadable' = 'CertificateIsUnreadable',
+    'SignatureArchiveIsUnreadable' = 'SignatureArchiveIsUnreadable',
+    'FileAlreadyExists' = 'FileAlreadyExists',
+    'SignatureArchiveIsInvalidZip' = 'SignatureArchiveIsInvalidZip',
+    'SignatureArchiveHasSameSignatureFile' = 'SignatureArchiveHasSameSignatureFile',
+
+    'PackageIntegrityCheckFailed' = 'PackageIntegrityCheckFailed',
+    'SignatureIsInvalid' = 'SignatureIsInvalid',
+    'SignatureManifestIsInvalid' = 'SignatureManifestIsInvalid',
+    'SignatureIntegrityCheckFailed' = 'SignatureIntegrityCheckFailed',
+    'EntryIsMissing' = 'EntryIsMissing',
+    'EntryIsTampered' = 'EntryIsTampered',
+    'Untrusted' = 'Untrusted',
+    'CertificateRevoked' = 'CertificateRevoked',
+    'SignatureIsNotValid' = 'SignatureIsNotValid',
+    'UnknownError' = 'UnknownError',
+    'PackageIsInvalidZip' = 'PackageIsInvalidZip',
+    'SignatureArchiveHasTooManyEntries' = 'SignatureArchiveHasTooManyEntries',
+}
+
+export class ExtensionSignatureVerificationResult {
+    readonly code: ExtensionSignatureVerificationCode;
+    readonly didExecute: boolean;
+    readonly internalCode?: number;
+    readonly output?: string;
+}

package/src/main.js

@@ -0,0 +1,194 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  See LICENSE.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+// @ts-check
+'use strict';
+
+const { execFile } = require('child_process');
+const Path = require('path');
+
+const command = process.platform === 'win32' ? 'vsce-sign.exe' : 'vsce-sign';
+const vsceSignFilePath = Path.join(__dirname, '..', 'bin', command);
+
+// If this module is in an .asar file, then the binary is unpacked.
+const vsceSignOnDiskFilePath = vsceSignFilePath.replace(/\bnode_modules\.asar\b/, 'node_modules.asar.unpacked');
+
+const ExtensionSignatureVerificationCode = {
+    'Success': 'Success',
+    'RequiredArgumentMissing': 'RequiredArgumentMissing',
+    'InvalidArgument': 'InvalidArgument',
+    'PackageIsUnreadable': 'PackageIsUnreadable',
+    'UnhandledException': 'UnhandledException',
+    'SignatureManifestIsMissing': 'SignatureManifestIsMissing',
+    'SignatureManifestIsUnreadable': 'SignatureManifestIsUnreadable',
+    'SignatureIsMissing': 'SignatureIsMissing',
+    'SignatureIsUnreadable': 'SignatureIsUnreadable',
+    'CertificateIsUnreadable': 'CertificateIsUnreadable',
+    'SignatureArchiveIsUnreadable': 'SignatureArchiveIsUnreadable',
+    'FileAlreadyExists': 'FileAlreadyExists',
+    'SignatureArchiveIsInvalidZip': 'SignatureArchiveIsInvalidZip',
+    'SignatureArchiveHasSameSignatureFile': 'SignatureArchiveHasSameSignatureFile',
+
+    'PackageIntegrityCheckFailed': 'PackageIntegrityCheckFailed',
+    'SignatureIsInvalid': 'SignatureIsInvalid',
+    'SignatureManifestIsInvalid': 'SignatureManifestIsInvalid',
+    'SignatureIntegrityCheckFailed': 'SignatureIntegrityCheckFailed',
+    'EntryIsMissing': 'EntryIsMissing',
+    'EntryIsTampered': 'EntryIsTampered',
+    'Untrusted': 'Untrusted',
+    'CertificateRevoked': 'CertificateRevoked',
+    'SignatureIsNotValid': 'SignatureIsNotValid',
+    'UnknownError': 'UnknownError',
+    'PackageIsInvalidZip': 'PackageIsInvalidZip',
+    'SignatureArchiveHasTooManyEntries': 'SignatureArchiveHasTooManyEntries',
+};
+
+// Must stay in sync with Microsoft.VisualStudio.Extensions.Signing.ReturnCode (https://github.com/microsoft/vsce-sign/blob/main/src/Core/ReturnCode.cs).
+const ReturnCode = {};
+
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.Success] = 0] = ExtensionSignatureVerificationCode.Success;  // The operation succeeded.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.RequiredArgumentMissing] = 3] = ExtensionSignatureVerificationCode.RequiredArgumentMissing; // A required argument is missing.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.InvalidArgument] = 4] = ExtensionSignatureVerificationCode.InvalidArgument;  // An argument is invalid.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.PackageIsUnreadable] = 5] = ExtensionSignatureVerificationCode.PackageIsUnreadable;  // The extension package is unreadable.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.UnhandledException] = 6] = ExtensionSignatureVerificationCode.UnhandledException; // An unhandled exception occurred.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureManifestIsMissing] = 7] = ExtensionSignatureVerificationCode.SignatureManifestIsMissing; // The extension is missing a signature manifest file (.signature.manifest).
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureManifestIsUnreadable] = 8] = ExtensionSignatureVerificationCode.SignatureManifestIsUnreadable; // The signature manifest is unreadable.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureIsMissing] = 9] = ExtensionSignatureVerificationCode.SignatureIsMissing; // The extension is missing a signature file (.signature.p7s).
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureIsUnreadable] = 10] = ExtensionSignatureVerificationCode.SignatureIsUnreadable; // The signature is unreadable.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.CertificateIsUnreadable] = 11] = ExtensionSignatureVerificationCode.CertificateIsUnreadable; // The certificate is unreadable.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureArchiveIsUnreadable] = 12] = ExtensionSignatureVerificationCode.SignatureArchiveIsUnreadable; // The signature archive is unreadable.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.FileAlreadyExists] = 13] = ExtensionSignatureVerificationCode.FileAlreadyExists; // The output file already exists.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureArchiveIsInvalidZip] = 14] = ExtensionSignatureVerificationCode.SignatureArchiveIsInvalidZip; // The signature archive is not valid ZIP format.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureArchiveHasSameSignatureFile] = 15] = ExtensionSignatureVerificationCode.SignatureArchiveHasSameSignatureFile; // The signature archive has the same signature file.
+
+// Space reserved for additional CLI-specific return codes.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.PackageIntegrityCheckFailed] = 30] = ExtensionSignatureVerificationCode.PackageIntegrityCheckFailed; // The package integrity check failed.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureIsInvalid] = 31] = ExtensionSignatureVerificationCode.SignatureIsInvalid; // The extension has an invalid signature file (.signature.p7s).
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureManifestIsInvalid] = 32] = ExtensionSignatureVerificationCode.SignatureManifestIsInvalid; // The extension has an invalid signature manifest file (.signature.manifest).
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureIntegrityCheckFailed] = 33] = ExtensionSignatureVerificationCode.SignatureIntegrityCheckFailed; // The extension's signature integrity check failed.  Extension integrity is suspect.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.EntryIsMissing] = 34] = ExtensionSignatureVerificationCode.EntryIsMissing; // An entry referenced in the signature manifest was not found in the extension.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.EntryIsTampered] = 35] = ExtensionSignatureVerificationCode.EntryIsTampered; // The integrity check for an entry referenced in the signature manifest failed.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.Untrusted] = 36] = ExtensionSignatureVerificationCode.Untrusted; // An X.509 certificate in the extension signature is untrusted.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.CertificateRevoked] = 37] = ExtensionSignatureVerificationCode.CertificateRevoked; // An X.509 certificate in the extension signature has been revoked.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureIsNotValid] = 38] = ExtensionSignatureVerificationCode.SignatureIsNotValid; // The extension signature is invalid.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.UnknownError] = 39] = ExtensionSignatureVerificationCode.UnknownError; // An unknown error occurred.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.PackageIsInvalidZip] = 40] = ExtensionSignatureVerificationCode.PackageIsInvalidZip; // The extension package is not valid ZIP format.
+ReturnCode[ReturnCode[ExtensionSignatureVerificationCode.SignatureArchiveHasTooManyEntries] = 41] = ExtensionSignatureVerificationCode.SignatureArchiveHasTooManyEntries; // The signature archive has too many entries.
+
+class ExtensionSignatureVerificationResult {
+    /**
+     * @param {string} code
+     * @param {boolean} didExecute
+     * @param {number | undefined} internalCode
+     * @param {string | undefined} output
+     */
+    constructor(code, didExecute, internalCode, output) {
+        this.code = code;
+        this.internalCode = internalCode;
+        this.didExecute = didExecute;
+        this.output = output;
+    }
+}
+
+/**
+ * @param {string} vsixFilePath
+ * @param {string} signatureArchiveFilePath
+ * @param {boolean} verbose
+ * @returns {Promise<ExtensionSignatureVerificationResult>}
+ */
+async function verify(vsixFilePath, signatureArchiveFilePath, verbose) {
+    const args = ['verify', '--package', vsixFilePath, '--signaturearchive', signatureArchiveFilePath];
+    return await execCommand(args, verbose, false);
+}
+
+/**
+ * @param {string} vsixFilePath
+ * @param {string | undefined} manifestFilePath
+ * @param {boolean} verbose
+ * @returns {Promise<string>}
+ */
+async function generateManifest(vsixFilePath, manifestFilePath, verbose) {
+    const args = ['generatemanifest', '--package', vsixFilePath];
+
+    if (typeof manifestFilePath === 'string') {
+        args.push('--output');
+        args.push(manifestFilePath);
+    }
+
+    await execCommand(args, verbose, true);
+
+    return manifestFilePath ?? Path.join(Path.dirname(vsixFilePath), '.signature.manifest');
+}
+
+/**
+ * @param {string} manifestFilePath
+ * @param {string} signatureFilePath
+ * @param {string | undefined} signatureArchiveFilePath
+ * @param {boolean} verbose
+ * @returns {Promise<string>}
+ */
+async function zip(manifestFilePath, signatureFilePath, signatureArchiveFilePath, verbose) {
+    const args = ['zip', '--manifest', manifestFilePath, '--signature', signatureFilePath];
+
+    if (typeof signatureArchiveFilePath === 'string') {
+        args.push('--output');
+        args.push(signatureArchiveFilePath);
+    }
+
+    await execCommand(args, verbose, true);
+
+    return signatureArchiveFilePath ?? Path.join(Path.dirname(manifestFilePath), '.signature.zip');
+}
+
+/**
+ * @param {string[]} args
+ * @param {boolean} verbose
+ * @param {boolean} throwIfNotSuccess
+ * @returns {Promise<ExtensionSignatureVerificationResult>}
+ */
+function execCommand(args, verbose, throwIfNotSuccess) {
+    return new Promise((resolve, reject) => {
+
+        if (verbose === true) {
+            args.push('--verbose');
+        }
+
+        execFile(vsceSignOnDiskFilePath, args, (error, stdout) => {
+            let internalCode = undefined;
+            let returnCode;
+            let didExecute = false;
+
+            const code = error === null ? 0 : error?.code;
+            const output = verbose ? stdout : undefined;
+
+            // vsce-sign returns exit codes (numbers), whereas execFile(...), in the absence of an exit code, returns an error code (string) (e.g.:  ENOENT) to indicate failure.
+            if (typeof code === 'number') {
+                didExecute = true;
+                internalCode = code;
+                returnCode = ReturnCode[code];
+            } else if (typeof code === 'string') {
+                returnCode = code;
+            }
+
+            returnCode = returnCode ?? ExtensionSignatureVerificationCode.UnknownError;
+
+            if (throwIfNotSuccess && returnCode !== ExtensionSignatureVerificationCode.Success) {
+                reject(new ExtensionSignatureVerificationResult(returnCode, didExecute, internalCode, output));
+                return;
+            }
+
+            resolve(new ExtensionSignatureVerificationResult(returnCode, didExecute, internalCode, output));
+        });
+    });
+}
+
+module.exports = {
+    verify,
+    generateManifest,
+    zip,
+    ReturnCode,
+    ExtensionSignatureVerificationCode,
+    ExtensionSignatureVerificationResult
+};

package/src/permissions.js

@@ -0,0 +1,42 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  See LICENSE.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+// @ts-check
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * See https://github.com/nodejs/node-v0.x-archive/issues/3045#issuecomment-4862588
+ * mode is a combination of file type and permissions.
+ * @param {number} mode
+ * @returns {string}
+ */
+function getPermissions(mode) {
+    // Get 3 smallest bytes in octal
+    return (mode & 0o777).toString(8);
+}
+
+/**
+ * @param {string} filePath
+ */
+function setPermissions(filePath) {
+    let stats = fs.statSync(filePath);
+    const oldMode = stats.mode;
+
+    console.log(`Existing file permissions:  ${getPermissions(oldMode)} (octal)`);
+
+    // 755 (octal) = -rwxr-xr-x
+    const newMode = 0o755;
+
+    fs.chmodSync(filePath, newMode);
+
+    stats = fs.statSync(filePath);
+
+    console.log(`New file permissions:  ${getPermissions(stats.mode)} (octal)`);
+}
+
+module.exports = { setPermissions };

package/src/postinstall.js

@@ -0,0 +1,224 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  See LICENSE.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+// @ts-check
+'use strict';
+
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const cp = require("child_process");
+const zlib = require("zlib");
+const { setPermissions } = require('./permissions');
+const { getTarget } = require('./target');
+
+const IS_WINDOWS = process.platform === 'win32';
+
+async function main() {
+    const architecture = process.env['npm_config_arch'] ?? process.arch;
+    const target = getTarget(process.platform, architecture);
+
+    if (!target) {
+        throw new Error(`The current platform (${process.platform}) and architecture (${architecture}) is not supported.`);
+    }
+
+    const exeName = IS_WINDOWS ? 'vsce-sign.exe' : 'vsce-sign';
+    const binDir = path.join(__dirname, '..', 'bin');
+    const binPath = path.join(binDir, exeName);
+
+    // @ohos-ports port: on HarmonyOS there are no @vscode/vsce-sign-<target>
+    // binary packages on npm. The port provisions the binary either bundled in
+    // the package's own bin/ directory (added at packaging time) or not at all;
+    // in the latter case installation must still succeed and signing/verification
+    // APIs degrade gracefully (execFile returns ENOENT), matching the behaviour
+    // of the upstream module when its binary is missing.
+    if (target.startsWith('openharmony')) {
+        if (!fs.existsSync(binDir)) {
+            fs.mkdirSync(binDir);
+        }
+        if (fs.existsSync(binPath)) {
+            if (!IS_WINDOWS) {
+                setPermissions(binPath);
+            }
+            console.log(`[@ohos-ports/vscode-vsce-sign] Using bundled binary: ${binPath}`);
+        } else {
+            console.warn(`[@ohos-ports/vscode-vsce-sign] No vsce-sign binary provisioned for ${target}; sign/verify APIs will return ENOENT until a binary is bundled in ${binDir}.`);
+        }
+        return;
+    }
+
+    const subPath = `bin/${exeName}`;
+    const pkgName = `@vscode/vsce-sign-${target}`;
+
+    try {
+        setup(pkgName, subPath, binPath);
+    } catch (err) {
+        const version = require(path.join(__dirname, '..', 'package.json')).optionalDependencies?.[pkgName];
+        if (!version) {
+            console.warn(`[@ohos-ports/vscode-vsce-sign] Binary package "${pkgName}" is not declared (port build without optionalDependencies); skipping binary provisioning for ${target}.`);
+            return;
+        }
+        await fallbackSetup(pkgName, subPath, binPath, version);
+    }
+}
+
+/**
+ * @param {string} pkgName
+ * @param {string} subPath
+ * @param {string} binPath
+ */
+function setup(pkgName, subPath, binPath) {
+    const targetBinPath = require.resolve(`${pkgName}/${subPath}`);
+    fs.copyFileSync(targetBinPath, binPath);
+}
+
+/**
+ * @param {string} pkgName
+ * @param {string} subPath
+ * @param {string} binPath
+ * @param {string} version
+ */
+async function fallbackSetup(pkgName, subPath, binPath, version) {
+    console.error(`[@vscode/vsce-sign] Failed to find package "${pkgName}" on the file system
+
+This can happen if you use the "--no-optional" flag. The "optionalDependencies"
+package.json feature is used to install the correct binary executable
+for your current platform. This install script will now attempt to work around
+this. If that fails, you need to remove the "--no-optional" flag to use @vscode/vsce-sign.
+`);
+
+    try {
+        console.error(`[@vscode/vsce-sign] Trying to install package "${pkgName}" using npm`);
+        installUsingNPM(pkgName, subPath, binPath, version);
+        return;
+    } catch (err2) {
+        console.error(`[@vscode/vsce-sign] Failed to install package "${pkgName}" using npm: ${err2 && err2.message || err2}`);
+    }
+
+    try {
+        await downloadDirectlyFromNPM(pkgName, subPath, binPath, version);
+        return;
+    } catch (e3) {
+        throw new Error(`Failed to install package "${pkgName}"`);
+    }
+}
+
+/**
+ * @param {string} pkgName
+ * @param {string} subpath
+ * @param {string} binPath
+ * @param {string} version
+ */
+function installUsingNPM(pkgName, subpath, binPath, version) {
+    const env = { ...process.env, npm_config_global: void 0 };
+    const vsceSignLibDir = path.dirname(require.resolve('@vscode/vsce-sign'));
+    const installDir = path.join(vsceSignLibDir, "npm-install");
+    fs.mkdirSync(installDir);
+    try {
+        fs.writeFileSync(path.join(installDir, "package.json"), "{}");
+        // Pass --force so npm installs this deliberately-selected, platform-specific
+        // package even when the host os/cpu differ from the target (e.g. building a
+        // Linux arm64 or alpine server on an x64 host). npm otherwise rejects it with
+        // EBADPLATFORM and we fall through to a hardcoded public download, which fails
+        // in network-isolated / air-gapped environments. The install still uses the
+        // configured (authenticated) registry, so this resolves from a private feed.
+        cp.execSync(
+            `npm install --loglevel=error --prefer-offline --no-audit --progress=false --force ${pkgName}@${version}`,
+            { cwd: installDir, stdio: "pipe", env }
+        );
+        const installedBinPath = path.join(installDir, "node_modules", pkgName, subpath);
+        fs.renameSync(installedBinPath, binPath);
+    } finally {
+        try {
+            fs.rmSync(installDir, { recursive: true, force: true, maxRetries: 3 });
+        } catch {
+        }
+    }
+}
+
+/**
+ *
+ * @param {string} pkgName
+ * @param {string} subpath
+ * @param {string} binPath
+ * @param {string} version
+ */
+async function downloadDirectlyFromNPM(pkgName, subpath, binPath, version) {
+    const url = `https://registry.npmjs.org/${pkgName}/-/${pkgName.replace("@vscode/", "")}-${version}.tgz`;
+    console.error(`[@vscode/vsce-sign] Trying to download ${JSON.stringify(url)}`);
+
+    let buffer;
+    try {
+        buffer = await fetch(url);
+    } catch (e) {
+        console.error(`[@vscode/vsce-sign] Failed to download ${JSON.stringify(url)}: ${e && e.message || e}`);
+        throw e;
+    }
+
+    fs.writeFileSync(binPath, extractFileFromTarGzip(buffer, subpath));
+    if (!IS_WINDOWS) {
+        setPermissions(binPath);
+    }
+}
+
+/**
+ * @param {string} url
+ * @returns {Promise<Buffer>}
+ */
+function fetch(url) {
+    return new Promise((resolve, reject) => {
+        https.get(url, (res) => {
+            if ((res.statusCode === 301 || res.statusCode === 302) && res.headers.location) {
+                return fetch(res.headers.location).then(resolve, reject);
+            }
+            if (res.statusCode !== 200) {
+                console.error(`[@vscode/vsce-sign] Failed to download ${JSON.stringify(url)}: Server responded with ${res.statusCode}`);
+                return reject(new Error(`Server responded with ${res.statusCode}`));
+            }
+            let chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => resolve(Buffer.concat(chunks)));
+        }).on("error", reject);
+    });
+}
+
+/**
+ * @param {Buffer} buffer
+ * @param {string} subpath
+ * @returns
+ */
+function extractFileFromTarGzip(buffer, subpath) {
+    try {
+        buffer = zlib.unzipSync(buffer);
+    } catch (err) {
+        const message = `[@vscode/vsce-sign] Invalid gzip data in archive: ${err && err.message || err}`;
+        console.error(message);
+        throw new Error(message);
+    }
+    let str = (/** @type {number} */ i, /** @type {number} */ n) => String.fromCharCode(...buffer.subarray(i, i + n)).replace(/\0.*$/, "");
+    let offset = 0;
+    subpath = `package/${subpath}`;
+    while (offset < buffer.length) {
+        let name = str(offset, 100);
+        let size = parseInt(str(offset + 124, 12), 8);
+        offset += 512;
+        if (!isNaN(size)) {
+            if (name === subpath)
+                return buffer.subarray(offset, offset + size);
+            offset += size + 511 & ~511;
+        }
+    }
+
+    const message = `Could not find ${JSON.stringify(subpath)} in archive`;
+    console.error(message);
+    throw new Error(message);
+}
+
+main()
+    .then(() => process.exit(0))
+    .catch((err) => {
+        console.error(err && err.message || err);
+        process.exit(1);
+    });

package/src/target.js

@@ -0,0 +1,148 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  See LICENSE.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+// @ts-check
+'use strict';
+
+const fs = require('fs');
+
+/**
+ * @typedef {Function} BooleanFunction
+ * @returns {boolean}
+ */
+
+/**
+ * @param {string} platform
+ * @param {string} architecture
+ * @param {BooleanFunction=} isAlpineLinuxFunc
+ * @returns {string | null}
+ */
+function getTarget(platform, architecture, isAlpineLinuxFunc = isAlpineLinux) {
+    switch (platform) {
+        case 'darwin':
+            return getMacOsRuntimeIdentifier(architecture);
+
+        case 'linux':
+            if (isAlpineLinuxFunc()) {
+                return getAlpineLinuxRuntimeIdentifier(architecture);
+            }
+
+            return getLinuxRuntimeIdentifier(architecture);
+
+        case 'win32':
+            return getWindowsRuntimeIdentifier(architecture);
+
+        // HarmonyOS (OpenHarmony): mapped by the @ohos-ports port of @vscode/vsce-sign.
+        // The port provisions its binary through the package's own bin/ directory
+        // (see postinstall.js), not through @vscode/vsce-sign-<target> npm packages.
+        case 'openharmony':
+            return getOpenHarmonyRuntimeIdentifier(architecture);
+
+        default:
+            return null;
+    }
+}
+
+/**
+ * @param {string} architecture
+ * @returns {string | null}
+ */
+function getOpenHarmonyRuntimeIdentifier(architecture) {
+    switch (architecture) {
+        case 'arm64':
+            return `openharmony-arm64`;
+
+        default:
+            return null;
+    }
+}
+
+/**
+ * @param {string} architecture
+ * @returns {string | null}
+ */
+function getAlpineLinuxRuntimeIdentifier(architecture) {
+    switch (architecture) {
+        case 'arm64':
+        case 'x64':
+            return `alpine-${architecture}`;
+
+        default:
+            return null;
+    }
+}
+
+/**
+ * @param {string} architecture
+ * @returns {string | null}
+ */
+function getLinuxRuntimeIdentifier(architecture) {
+    switch (architecture) {
+        case 'arm':
+        case 'arm64':
+        case 'x64':
+            return `linux-${architecture}`;
+
+        default:
+            return null;
+    }
+}
+
+/**
+ * @param {string} architecture
+ * @returns {string | null}
+ */
+function getMacOsRuntimeIdentifier(architecture) {
+    switch (architecture) {
+        case 'arm64':
+        case 'x64':
+            return `darwin-${architecture}`;
+
+        default:
+            return null;
+    }
+}
+
+/**
+ * @param {string} architecture
+ * @returns {string | null}
+ */
+function getWindowsRuntimeIdentifier(architecture) {
+    switch (architecture) {
+        case 'arm':
+        case 'arm64':
+        case 'x64':
+            return `win32-${architecture}`;
+
+        case 'ia32':
+            return `win32-x86`;
+
+        default:
+            return null;
+    }
+}
+
+/**
+ * Borrowed from {@link https://github.com/microsoft/vscode/blob/49e696c011a868b283f7bc7f208378a5d450b5d8/src/vs/platform/extensionManagement/common/extensionManagementUtil.ts#L171-L189}
+ * @returns {boolean}
+ */
+function isAlpineLinux() {
+    let content;
+
+    try {
+        const fileContent = fs.readFileSync('/etc/os-release');
+        content = fileContent.toString();
+    } catch (error) {
+        try {
+            const fileContent = fs.readFileSync('/usr/lib/os-release');
+            content = fileContent.toString();
+        } catch (error) {
+        }
+    }
+
+    return !!content && (content.match(/^ID=([^\u001b\r\n]*)/m) || [])[1] === 'alpine';
+}
+
+module.exports = { getTarget };