@pnpm/deps.security.signatures 1101.1.6 → 1101.2.1

package/lib/npmSigningKeys.d.ts

@@ -0,0 +1,13 @@
+export declare const NPM_SIGNING_KEYS: readonly [{
+    readonly expires: "2025-01-29T00:00:00.000Z";
+    readonly keyid: "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA";
+    readonly keytype: "ecdsa-sha2-nistp256";
+    readonly scheme: "ecdsa-sha2-nistp256";
+    readonly key: "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg==";
+}, {
+    readonly expires: null;
+    readonly keyid: "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U";
+    readonly keytype: "ecdsa-sha2-nistp256";
+    readonly scheme: "ecdsa-sha2-nistp256";
+    readonly key: "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g==";
+}];

package/lib/npmSigningKeys.js

@@ -0,0 +1,24 @@
+/* eslint-disable */
+// GENERATED — npm's public registry signing keys, mirrored from
+// https://registry.npmjs.org/-/npm/v1/keys
+//
+// Refresh with: node deps/security/signatures/scripts/update-npm-signing-keys.mjs --update
+// The release workflow runs `--check` and fails if these drift from npm, so a
+// rotated key cannot silently break (or weaken) signature verification.
+export const NPM_SIGNING_KEYS = [
+    {
+        "expires": "2025-01-29T00:00:00.000Z",
+        "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="
+    },
+    {
+        "expires": null,
+        "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="
+    }
+];
+//# sourceMappingURL=npmSigningKeys.js.map

package/lib/verifySignatures.d.ts

@@ -21,4 +21,69 @@ export interface VerifySignaturesOptions extends CreateFetchFromRegistryOptions
     retry?: RetryTimeoutOptions;
     timeout?: number;
 }
+interface RegistryKey {
+    expires: string | null;
+    key: string;
+    keyid: string;
+    keytype: string;
+    scheme: string;
+}
 export declare function verifySignatures(packages: SignaturePackage[], getAuthHeader: GetAuthHeader, opts: VerifySignaturesOptions): Promise<SignatureVerificationResult>;
+export type { RegistryKey };
+/**
+ * The trusted npm signing keys used to verify package-manager binaries before
+ * pnpm spawns them — npm's public keys embedded in the CLI. There is
+ * deliberately no way to override or disable them at runtime: a verification
+ * off-switch would be a footgun, and npm mirrors work without one (they proxy
+ * the same signed packument, which is verified against these keys). The keys
+ * are refreshed at release time by the update-npm-signing-keys script.
+ */
+export declare function getNpmSigningKeys(): RegistryKey[];
+export interface InstalledPackageToVerify {
+    name: string;
+    /** The registry the package was installed from — the packument (and its signatures) is fetched from here. */
+    registry: string;
+    version: string;
+    /** Integrity of the bytes actually installed on disk (from the lockfile). */
+    integrity: string;
+}
+/**
+ * Why a package failed signature verification:
+ * - `invalid`: a registry signature is present but does not validate over the
+ *   installed bytes — a strong tamper signal.
+ * - `absent`: the package/version is not on the (canonical) registry, or carries
+ *   no signature — suspicious for a package that is expected to be signed.
+ * - `unreachable`: the trust root could not be consulted (registry advertised no
+ *   signing keys, or the network request failed) — typically transient/offline,
+ *   not evidence of tampering.
+ */
+export type SignatureFailureCategory = 'invalid' | 'absent' | 'unreachable';
+export interface InstalledSignatureFailure {
+    name: string;
+    version: string;
+    reason: string;
+    category: SignatureFailureCategory;
+}
+export interface InstalledSignatureVerificationResult {
+    verified: boolean;
+    failures: InstalledSignatureFailure[];
+}
+/**
+ * Verifies that the bytes installed on disk are exactly what the registry
+ * signed for `name@version`. The signed message is built from the
+ * caller-supplied installed {@link InstalledPackageToVerify.integrity}, not
+ * from the integrity in the freshly-fetched packument — so if the integrity
+ * on disk was tampered with (or fetched from a different registry), the
+ * registry's signature will not validate over it.
+ *
+ * Signatures are verified against the caller-supplied `trustedKeys` (npm's
+ * embedded public keys, see {@link getNpmSigningKeys}) rather than keys fetched
+ * from a registry — so a registry the caller cannot vouch for cannot answer with
+ * its own key pair. The packument (which carries the signatures) is fetched from
+ * each package's own registry; an npm mirror works transparently because it
+ * proxies the same signed packument.
+ *
+ * A package counts as a failure when the package is unsigned/unpublished, or
+ * when a signature is present but does not validate over the installed bytes.
+ */
+export declare function verifyInstalledPackageSignatures(packages: InstalledPackageToVerify[], trustedKeys: RegistryKey[], getAuthHeader: GetAuthHeader, opts: VerifySignaturesOptions): Promise<InstalledSignatureVerificationResult>;

package/lib/verifySignatures.js

@@ -4,6 +4,7 @@ import util from 'node:util';
 import { PnpmError } from '@pnpm/error';
 import { createFetchFromRegistry } from '@pnpm/network.fetch';
 import pLimit from 'p-limit';
+import { NPM_SIGNING_KEYS } from './npmSigningKeys.js';
 export async function verifySignatures(packages, getAuthHeader, opts) {
     const registries = new Set(packages.map(({ registry }) => registry));
     const keysByRegistry = await getKeysByRegistry(registries, getAuthHeader, opts);
@@ -147,38 +148,60 @@ function verifyPackageSignatures(pkg, keys) {
     // Registry signatures cover the package identity and content integrity.
     const message = `${pkg.name}@${pkg.version}:${pkg.integrity}`;
     const publishedTime = pkg.publishedAt ? Date.parse(pkg.publishedAt) : undefined;
+    // A package is accepted as soon as ONE signature made by a trusted key
+    // validates. Signatures from unknown/expired/invalid keys are recorded but do
+    // not on their own fail the package — otherwise a key rotation (a packument
+    // carrying multiple signatures) breaks, and a mirror could force a failure
+    // just by appending a junk signature. We fail only when no signature validates
+    // against a trusted key.
+    const failures = [];
     for (const signature of pkg.signatures) {
         const key = keys.find(({ keyid }) => keyid === signature.keyid);
         if (!key) {
-            const reason = `${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but no corresponding public key can be found`;
-            return toSignatureIssue(pkg, reason);
+            failures.push(`${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but no corresponding public key can be found`);
+            continue;
         }
-        // Without publish time metadata we cannot safely compare against key expiry,
-        // so keep verifying with the key instead of failing closed on incomplete metadata.
+        // Key expiry is a consistency check, not a security boundary: the publish
+        // time comes from the same unauthenticated packument as the signatures, so
+        // a forger holding an expired trusted key could backdate it anyway. The
+        // signature verification below is what gates acceptance. That is why a
+        // missing publish time keeps the key usable instead of failing closed —
+        // the same trade-off npm's pacote makes by substituting a pre-expiry date.
         if (key.expires && publishedTime != null && publishedTime >= Date.parse(key.expires)) {
-            const reason = `${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but the corresponding public key has expired ${key.expires}`;
-            return toSignatureIssue(pkg, reason);
+            failures.push(`${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but the corresponding public key has expired ${key.expires}`);
+            continue;
         }
-        const verifier = crypto.createVerify('SHA256');
-        verifier.write(message);
-        verifier.end();
         const pem = `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`;
         // crypto.verify can throw on malformed PEM key material or signature bytes
         // returned by the registry; treat any failure as an invalid signature so
         // one bad key doesn't crash the whole audit.
         let verified;
         try {
+            const verifier = crypto.createVerify('SHA256');
+            verifier.write(message);
+            verifier.end();
             verified = verifier.verify(pem, signature.sig, 'base64');
         }
         catch {
             verified = false;
         }
-        if (!verified) {
-            const reason = `${pkg.name}@${pkg.version} has an invalid registry signature with keyid ${signature.keyid}`;
-            return toSignatureIssue(pkg, reason);
-        }
+        if (verified)
+            return undefined;
+        failures.push(`${pkg.name}@${pkg.version} has an invalid registry signature with keyid ${signature.keyid}`);
+    }
+    return toSignatureIssue(pkg, pickMostTellingFailure(pkg, failures));
+}
+/**
+ * The reason to surface when no signature validated against a trusted key.
+ * Prefer an invalid signature from a known key (a tamper signal) over an
+ * unknown-key or expiry reason, since unknown keys may just be junk a mirror
+ * appended.
+ */
+function pickMostTellingFailure(pkg, failures) {
+    if (failures.length === 0) {
+        return `${pkg.name}@${pkg.version} has no registry signature from a trusted key`;
     }
-    return undefined;
+    return failures.find((reason) => reason.includes('invalid registry signature')) ?? failures[0];
 }
 function toSignatureIssue(pkg, reason) {
     return {
@@ -231,4 +254,75 @@ function isPackageSignature(signature) {
 function sortIssue(a, b) {
     return `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`);
 }
+/**
+ * The trusted npm signing keys used to verify package-manager binaries before
+ * pnpm spawns them — npm's public keys embedded in the CLI. There is
+ * deliberately no way to override or disable them at runtime: a verification
+ * off-switch would be a footgun, and npm mirrors work without one (they proxy
+ * the same signed packument, which is verified against these keys). The keys
+ * are refreshed at release time by the update-npm-signing-keys script.
+ */
+export function getNpmSigningKeys() {
+    return NPM_SIGNING_KEYS.map((k) => ({ ...k }));
+}
+/**
+ * Verifies that the bytes installed on disk are exactly what the registry
+ * signed for `name@version`. The signed message is built from the
+ * caller-supplied installed {@link InstalledPackageToVerify.integrity}, not
+ * from the integrity in the freshly-fetched packument — so if the integrity
+ * on disk was tampered with (or fetched from a different registry), the
+ * registry's signature will not validate over it.
+ *
+ * Signatures are verified against the caller-supplied `trustedKeys` (npm's
+ * embedded public keys, see {@link getNpmSigningKeys}) rather than keys fetched
+ * from a registry — so a registry the caller cannot vouch for cannot answer with
+ * its own key pair. The packument (which carries the signatures) is fetched from
+ * each package's own registry; an npm mirror works transparently because it
+ * proxies the same signed packument.
+ *
+ * A package counts as a failure when the package is unsigned/unpublished, or
+ * when a signature is present but does not validate over the installed bytes.
+ */
+export async function verifyInstalledPackageSignatures(packages, trustedKeys, getAuthHeader, opts) {
+    const packumentCache = new Map();
+    const limit = pLimit(opts.networkConcurrency ?? 16);
+    const failures = [];
+    await Promise.all(packages.map((pkg) => limit(async () => {
+        const failure = await findSignatureFailure(pkg, trustedKeys, getAuthHeader, opts, packumentCache);
+        if (failure != null) {
+            failures.push({ name: pkg.name, version: pkg.version, ...failure });
+        }
+    })));
+    failures.sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+    return { verified: failures.length === 0, failures };
+}
+async function findSignatureFailure(pkg, trustedKeys, getAuthHeader, opts, packumentCache) {
+    let packument;
+    try {
+        packument = await getPackument(pkg, getAuthHeader, opts, packumentCache);
+    }
+    catch (err) {
+        return { reason: util.types.isNativeError(err) ? err.message : String(err), category: 'unreachable' };
+    }
+    if (!packument)
+        return { reason: `${pkg.name} is not published on ${pkg.registry}`, category: 'absent' };
+    const version = packument.versions?.[pkg.version];
+    if (!version)
+        return { reason: `${pkg.name}@${pkg.version} was not found on ${pkg.registry}`, category: 'absent' };
+    const rawSignatures = version.dist?.signatures;
+    if (rawSignatures != null && !Array.isArray(rawSignatures)) {
+        return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
+    }
+    const signatures = rawSignatures ?? [];
+    if (!signatures.every(isPackageSignature)) {
+        return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
+    }
+    if (signatures.length === 0) {
+        return { reason: `${pkg.name}@${pkg.version} has no registry signature`, category: 'absent' };
+    }
+    // The message is built from the installed integrity, so a signature only
+    // validates when the installed bytes match what the registry signed.
+    const issue = verifyPackageSignatures({ ...pkg, integrity: pkg.integrity, publishedAt: packument.time?.[pkg.version], signatures }, trustedKeys);
+    return issue == null ? undefined : { reason: issue.reason ?? 'invalid registry signature', category: 'invalid' };
+}
 //# sourceMappingURL=verifySignatures.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.security.signatures",
-  "version": "1101.1.6",
+  "version": "1101.2.1",
   "description": "Verify package signatures from npm registries",
   "keywords": [
     "pnpm",
@@ -31,17 +31,17 @@
   "dependencies": {
     "p-limit": "^7.3.0",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/network.fetch": "1100.1.0"
+    "@pnpm/network.fetch": "1100.1.2",
+    "@pnpm/fetching.types": "1100.0.1"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1001.0.1"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
-    "@pnpm/deps.security.signatures": "1101.1.6",
-    "@pnpm/testing.mock-agent": "1101.0.0",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1101.0.2",
+    "@pnpm/deps.security.signatures": "1101.2.1"
   },
   "engines": {
     "node": ">=22.13"