@pnpm/deps.security.signatures 1101.2.3 → 1101.2.5

package/CHANGELOG.md

@@ -0,0 +1,113 @@
+# @pnpm/deps.security.signatures
+
+## 1101.2.5
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/network.fetch@1100.1.6
+
+## 1101.2.4
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/network.fetch@1100.1.5
+
+## 1101.2.3
+
+### Patch Changes
+
+- Updated dependencies [05b95ab]
+- Updated dependencies [852d537]
+  - @pnpm/network.fetch@1100.1.4
+  - @pnpm/error@1100.0.1
+
+## 1101.2.2
+
+### Patch Changes
+
+- a31faa7: Updated dependency ranges. Notably:
+
+  - `@pnpm/logger` peer dependency range moved to `^1100.0.0`.
+  - `msgpackr` 1.11.8 → 2.0.4 (store index files remain byte-compatible in both directions).
+  - `open` ^7.4.2 → ^11.0.0, `memoize` ^10 → ^11, `cli-truncate` ^5 → ^6, `pidtree` ^0.6 → ^1.
+  - `@yarnpkg/core` 4.5.0 → 4.8.0, `@rushstack/worker-pool` 0.7.7 → 0.7.18, `@cyclonedx/cyclonedx-library` 10.0.0 → 10.1.0, `@pnpm/config.nerf-dart` ^1 → ^2, `@pnpm/log.group` 3.0.2 → 4.0.1, `@pnpm/util.lex-comparator` ^3 → ^4.
+
+- Updated dependencies [681b593]
+- Updated dependencies [a31faa7]
+  - @pnpm/fetching.types@1100.0.2
+  - @pnpm/network.fetch@1100.1.3
+
+## 1101.2.1
+
+### Patch Changes
+
+- @pnpm/network.fetch@1100.1.2
+
+## 1101.2.0
+
+### Minor Changes
+
+- 5f2bb9f: Security: pnpm now verifies the npm registry signature of a package-manager binary before spawning it, so a cloned repository cannot make pnpm download and execute an arbitrary native binary.
+
+  This covers two paths that select an executable from repository-controlled input:
+
+  - **pacquet install engine** — declaring `pacquet` (or `@pnpm/pacquet`) in `configDependencies` opts in to pnpm's Rust install engine. pnpm now verifies that the installed `pacquet` shim and the host's `@pacquet/<platform>-<arch>` binary carry a valid npm registry signature for their exact `name@version`, and refuses to run pacquet (failing the command) if the signature does not verify or cannot be checked. The only graceful fallback to pnpm's own engine is when pacquet has no binary for the current platform.
+  - **automatic version switch / `self-update`** — the `packageManager` / `devEngines.packageManager` field makes pnpm download and run a specific pnpm version. pnpm now verifies the registry signature of `pnpm`, `@pnpm/exe`, and the host platform binary before installing/spawning them, and refuses to run an engine whose signature does not match a published, signed release. The check runs only on an actual download (store cache miss), so it does not add a network round trip to every command.
+
+  In both cases the signature is verified over the _installed_ integrity, against npm's public signing keys that ship embedded in the pnpm CLI (like corepack), so bytes substituted via a tampered lockfile or a repository-controlled registry fail verification — and a registry the user did not vouch for cannot supply its own signing keys. The signed packument is fetched from the configured registry, so an npm mirror works transparently. Verification fails closed: if it cannot be completed (for example, the registry is unreachable), the command fails rather than running an unverified binary. The embedded keys are kept current by a release-time check against npm's signing-keys endpoint.
+
+### Patch Changes
+
+- @pnpm/network.fetch@1100.1.1
+
+## 1101.1.6
+
+### Patch Changes
+
+- Updated dependencies [60a1eec]
+  - @pnpm/network.fetch@1100.1.0
+
+## 1101.1.5
+
+### Patch Changes
+
+- Updated dependencies [b1fa2d5]
+  - @pnpm/network.fetch@1100.0.8
+
+## 1101.1.4
+
+### Patch Changes
+
+- @pnpm/network.fetch@1100.0.7
+
+## 1101.1.3
+
+### Patch Changes
+
+- @pnpm/network.fetch@1100.0.6
+
+## 1101.1.2
+
+### Patch Changes
+
+- @pnpm/network.fetch@1100.0.5
+
+## 1101.1.1
+
+### Patch Changes
+
+- Updated dependencies [18a464f]
+  - @pnpm/network.fetch@1100.0.4
+
+## 1101.1.0
+
+### Minor Changes
+
+- 6ac06cb: Added `pnpm audit signatures` to verify ECDSA registry signatures for installed packages against keys from `/-/npm/v1/keys` [#7909](https://github.com/pnpm/pnpm/issues/7909). Scoped registries are respected, and registries without signing keys are skipped.
+
+### Patch Changes
+
+- Updated dependencies [20e7aff]
+  - @pnpm/network.fetch@1100.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.security.signatures",
-  "version": "1101.2.3",
+  "version": "1101.2.5",
   "description": "Verify package signatures from npm registries",
   "keywords": [
     "pnpm",
@@ -29,19 +29,19 @@
     "!*.map"
   ],
   "dependencies": {
-    "p-limit": "^7.3.0",
-    "@pnpm/fetching.types": "1100.0.2",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/network.fetch": "1100.1.4"
+    "@pnpm/fetching.types": "1100.0.2",
+    "@pnpm/network.fetch": "1100.1.6",
+    "p-limit": "^7.3.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
+    "@pnpm/deps.security.signatures": "1101.2.5",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/deps.security.signatures": "1101.2.3"
+    "@pnpm/testing.mock-agent": "1101.0.6"
   },
   "engines": {
     "node": ">=22.13"

package/lib/index.d.ts

@@ -1 +0,0 @@
-export * from './verifySignatures.js';

package/lib/npmSigningKeys.d.ts

@@ -1,13 +0,0 @@
-export declare const NPM_SIGNING_KEYS: readonly [{
-    readonly expires: "2025-01-29T00:00:00.000Z";
-    readonly keyid: "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA";
-    readonly keytype: "ecdsa-sha2-nistp256";
-    readonly scheme: "ecdsa-sha2-nistp256";
-    readonly key: "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg==";
-}, {
-    readonly expires: null;
-    readonly keyid: "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U";
-    readonly keytype: "ecdsa-sha2-nistp256";
-    readonly scheme: "ecdsa-sha2-nistp256";
-    readonly key: "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g==";
-}];

package/lib/npmSigningKeys.js

@@ -1,24 +0,0 @@
-/* eslint-disable */
-// GENERATED — npm's public registry signing keys, mirrored from
-// https://registry.npmjs.org/-/npm/v1/keys
-//
-// Refresh with: node deps/security/signatures/scripts/update-npm-signing-keys.mjs --update
-// The release workflow runs `--check` and fails if these drift from npm, so a
-// rotated key cannot silently break (or weaken) signature verification.
-export const NPM_SIGNING_KEYS = [
-    {
-        "expires": "2025-01-29T00:00:00.000Z",
-        "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",
-        "keytype": "ecdsa-sha2-nistp256",
-        "scheme": "ecdsa-sha2-nistp256",
-        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="
-    },
-    {
-        "expires": null,
-        "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
-        "keytype": "ecdsa-sha2-nistp256",
-        "scheme": "ecdsa-sha2-nistp256",
-        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="
-    }
-];
-//# sourceMappingURL=npmSigningKeys.js.map

package/lib/verifySignatures.d.ts

@@ -1,89 +0,0 @@
-import type { GetAuthHeader } from '@pnpm/fetching.types';
-import { type CreateFetchFromRegistryOptions, type RetryTimeoutOptions } from '@pnpm/network.fetch';
-export interface SignaturePackage {
-    name: string;
-    registry: string;
-    version: string;
-}
-export interface SignatureIssue extends SignaturePackage {
-    integrity?: string;
-    reason?: string;
-    resolved?: string;
-}
-export interface SignatureVerificationResult {
-    audited: number;
-    invalid: SignatureIssue[];
-    missing: SignatureIssue[];
-    verified: number;
-}
-export interface VerifySignaturesOptions extends CreateFetchFromRegistryOptions {
-    networkConcurrency?: number;
-    retry?: RetryTimeoutOptions;
-    timeout?: number;
-}
-interface RegistryKey {
-    expires: string | null;
-    key: string;
-    keyid: string;
-    keytype: string;
-    scheme: string;
-}
-export declare function verifySignatures(packages: SignaturePackage[], getAuthHeader: GetAuthHeader, opts: VerifySignaturesOptions): Promise<SignatureVerificationResult>;
-export type { RegistryKey };
-/**
- * The trusted npm signing keys used to verify package-manager binaries before
- * pnpm spawns them — npm's public keys embedded in the CLI. There is
- * deliberately no way to override or disable them at runtime: a verification
- * off-switch would be a footgun, and npm mirrors work without one (they proxy
- * the same signed packument, which is verified against these keys). The keys
- * are refreshed at release time by the update-npm-signing-keys script.
- */
-export declare function getNpmSigningKeys(): RegistryKey[];
-export interface InstalledPackageToVerify {
-    name: string;
-    /** The registry the package was installed from — the packument (and its signatures) is fetched from here. */
-    registry: string;
-    version: string;
-    /** Integrity of the bytes actually installed on disk (from the lockfile). */
-    integrity: string;
-}
-/**
- * Why a package failed signature verification:
- * - `invalid`: a registry signature is present but does not validate over the
- *   installed bytes — a strong tamper signal.
- * - `absent`: the package/version is not on the (canonical) registry, or carries
- *   no signature — suspicious for a package that is expected to be signed.
- * - `unreachable`: the trust root could not be consulted (registry advertised no
- *   signing keys, or the network request failed) — typically transient/offline,
- *   not evidence of tampering.
- */
-export type SignatureFailureCategory = 'invalid' | 'absent' | 'unreachable';
-export interface InstalledSignatureFailure {
-    name: string;
-    version: string;
-    reason: string;
-    category: SignatureFailureCategory;
-}
-export interface InstalledSignatureVerificationResult {
-    verified: boolean;
-    failures: InstalledSignatureFailure[];
-}
-/**
- * Verifies that the bytes installed on disk are exactly what the registry
- * signed for `name@version`. The signed message is built from the
- * caller-supplied installed {@link InstalledPackageToVerify.integrity}, not
- * from the integrity in the freshly-fetched packument — so if the integrity
- * on disk was tampered with (or fetched from a different registry), the
- * registry's signature will not validate over it.
- *
- * Signatures are verified against the caller-supplied `trustedKeys` (npm's
- * embedded public keys, see {@link getNpmSigningKeys}) rather than keys fetched
- * from a registry — so a registry the caller cannot vouch for cannot answer with
- * its own key pair. The packument (which carries the signatures) is fetched from
- * each package's own registry; an npm mirror works transparently because it
- * proxies the same signed packument.
- *
- * A package counts as a failure when the package is unsigned/unpublished, or
- * when a signature is present but does not validate over the installed bytes.
- */
-export declare function verifyInstalledPackageSignatures(packages: InstalledPackageToVerify[], trustedKeys: RegistryKey[], getAuthHeader: GetAuthHeader, opts: VerifySignaturesOptions): Promise<InstalledSignatureVerificationResult>;

package/lib/verifySignatures.js

@@ -1,328 +0,0 @@
-import crypto from 'node:crypto';
-import url from 'node:url';
-import util from 'node:util';
-import { PnpmError } from '@pnpm/error';
-import { createFetchFromRegistry } from '@pnpm/network.fetch';
-import pLimit from 'p-limit';
-import { NPM_SIGNING_KEYS } from './npmSigningKeys.js';
-export async function verifySignatures(packages, getAuthHeader, opts) {
-    const registries = new Set(packages.map(({ registry }) => registry));
-    const keysByRegistry = await getKeysByRegistry(registries, getAuthHeader, opts);
-    const result = {
-        audited: 0,
-        invalid: [],
-        missing: [],
-        verified: 0,
-    };
-    // Registries without signing keys are not counted as audited: there is no
-    // registry trust root to verify against.
-    const packumentCache = new Map();
-    const limit = pLimit(opts.networkConcurrency ?? 16);
-    await Promise.all(packages.map((pkg) => limit(async () => {
-        const keys = keysByRegistry.get(pkg.registry) ?? [];
-        if (keys.length === 0)
-            return;
-        let version;
-        let publishedAt;
-        try {
-            const packument = await getPackument(pkg, getAuthHeader, opts, packumentCache);
-            if (!packument)
-                return;
-            result.audited++;
-            version = packument.versions?.[pkg.version];
-            publishedAt = packument.time?.[pkg.version];
-        }
-        catch (err) {
-            result.invalid.push({ ...pkg, reason: util.types.isNativeError(err) ? err.message : String(err) });
-            return;
-        }
-        const integrity = version?.dist?.integrity;
-        const resolved = version?.dist?.tarball;
-        const rawSignatures = version?.dist?.signatures;
-        if (rawSignatures != null && !Array.isArray(rawSignatures)) {
-            result.invalid.push({ ...pkg, integrity, resolved, reason: `Malformed registry signatures metadata for ${pkg.name}@${pkg.version}` });
-            return;
-        }
-        const signatures = rawSignatures ?? [];
-        if (!signatures.every(isPackageSignature)) {
-            result.invalid.push({ ...pkg, integrity, resolved, reason: `Malformed registry signatures metadata for ${pkg.name}@${pkg.version}` });
-            return;
-        }
-        if (!version) {
-            result.invalid.push({ ...pkg, reason: `Missing registry metadata for ${pkg.name}@${pkg.version}` });
-            return;
-        }
-        if (!integrity) {
-            result.missing.push({ ...pkg, resolved });
-            return;
-        }
-        if (signatures.length === 0) {
-            result.missing.push({ ...pkg, integrity, resolved });
-            return;
-        }
-        const issue = verifyPackageSignatures({ ...pkg, integrity, publishedAt, resolved, signatures }, keys);
-        if (issue) {
-            result.invalid.push(issue);
-            return;
-        }
-        result.verified++;
-    })));
-    result.invalid.sort(sortIssue);
-    result.missing.sort(sortIssue);
-    return result;
-}
-async function getKeysByRegistry(registries, getAuthHeader, opts) {
-    const keysByRegistry = new Map();
-    await Promise.all(Array.from(registries, async (registry) => {
-        const keys = await fetchRegistryKeys(registry, getAuthHeader, opts);
-        keysByRegistry.set(registry, keys);
-    }));
-    return keysByRegistry;
-}
-async function fetchRegistryKeys(registry, getAuthHeader, opts) {
-    const registryUrl = registry.endsWith('/') ? registry : `${registry}/`;
-    const keysUrl = new url.URL('-/npm/v1/keys', registryUrl).toString();
-    const fetchFromRegistry = createFetchFromRegistry(opts);
-    const response = await fetchFromRegistry(keysUrl, {
-        authHeaderValue: getAuthHeader(registryUrl),
-        method: 'GET',
-        retry: opts.retry,
-        timeout: opts.timeout,
-    });
-    if (response.status === 404 || response.status === 400) {
-        return [];
-    }
-    if (response.status !== 200) {
-        const code = 'AUDIT_SIGNATURE_KEYS_FETCH_FAIL';
-        const message = `The registry keys endpoint (at ${response.url}) responded with ${response.status}: ${await response.text()}`;
-        throw new PnpmError(code, message);
-    }
-    const body = await parseJsonResponse(response, 'AUDIT_SIGNATURE_KEYS_FETCH_FAIL', 'The registry keys endpoint');
-    if (!isRegistryKeysResponse(body)) {
-        const code = 'AUDIT_SIGNATURE_KEYS_FETCH_FAIL';
-        const message = `The registry keys endpoint (at ${response.url}) returned an unexpected body. Expected an object with a keys array; got: ${JSON.stringify(body)?.slice(0, 500) ?? String(body)}`;
-        throw new PnpmError(code, message);
-    }
-    // npm registry signing currently uses ECDSA P-256 keys. Sigstore provenance
-    // attestations are intentionally handled separately from this registry check.
-    return body.keys.filter(({ keytype, scheme }) => keytype === 'ecdsa-sha2-nistp256' && scheme === 'ecdsa-sha2-nistp256');
-}
-async function getPackument(pkg, getAuthHeader, opts, packumentCache) {
-    const cacheKey = `${pkg.registry}:${pkg.name}`;
-    let packument = packumentCache.get(cacheKey);
-    if (!packument) {
-        // Multiple installed versions share one full packument fetch.
-        packument = fetchPackument(pkg, getAuthHeader, opts);
-        packumentCache.set(cacheKey, packument);
-    }
-    return packument;
-}
-async function fetchPackument(pkg, getAuthHeader, opts) {
-    const registryUrl = pkg.registry.endsWith('/') ? pkg.registry : `${pkg.registry}/`;
-    const packumentUrl = toUri(pkg.name, registryUrl);
-    const fetchFromRegistry = createFetchFromRegistry(opts);
-    const response = await fetchFromRegistry(packumentUrl, {
-        authHeaderValue: getAuthHeader(registryUrl),
-        fullMetadata: true,
-        method: 'GET',
-        retry: opts.retry,
-        timeout: opts.timeout,
-    });
-    if (response.status === 404) {
-        return undefined;
-    }
-    if (response.status !== 200) {
-        const code = 'AUDIT_SIGNATURE_PACKUMENT_FETCH_FAIL';
-        const message = `The packument endpoint (at ${response.url}) responded with ${response.status}: ${await response.text()}`;
-        throw new PnpmError(code, message);
-    }
-    const body = await parseJsonResponse(response, 'AUDIT_SIGNATURE_PACKUMENT_FETCH_FAIL', 'The packument endpoint');
-    if (!isPackument(body)) {
-        const code = 'AUDIT_SIGNATURE_PACKUMENT_FETCH_FAIL';
-        const message = `The packument endpoint (at ${response.url}) returned an unexpected body. Expected an object with versions; got: ${JSON.stringify(body)?.slice(0, 500) ?? String(body)}`;
-        throw new PnpmError(code, message);
-    }
-    return body;
-}
-function verifyPackageSignatures(pkg, keys) {
-    // Registry signatures cover the package identity and content integrity.
-    const message = `${pkg.name}@${pkg.version}:${pkg.integrity}`;
-    const publishedTime = pkg.publishedAt ? Date.parse(pkg.publishedAt) : undefined;
-    // A package is accepted as soon as ONE signature made by a trusted key
-    // validates. Signatures from unknown/expired/invalid keys are recorded but do
-    // not on their own fail the package — otherwise a key rotation (a packument
-    // carrying multiple signatures) breaks, and a mirror could force a failure
-    // just by appending a junk signature. We fail only when no signature validates
-    // against a trusted key.
-    const failures = [];
-    for (const signature of pkg.signatures) {
-        const key = keys.find(({ keyid }) => keyid === signature.keyid);
-        if (!key) {
-            failures.push(`${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but no corresponding public key can be found`);
-            continue;
-        }
-        // Key expiry is a consistency check, not a security boundary: the publish
-        // time comes from the same unauthenticated packument as the signatures, so
-        // a forger holding an expired trusted key could backdate it anyway. The
-        // signature verification below is what gates acceptance. That is why a
-        // missing publish time keeps the key usable instead of failing closed —
-        // the same trade-off npm's pacote makes by substituting a pre-expiry date.
-        if (key.expires && publishedTime != null && publishedTime >= Date.parse(key.expires)) {
-            failures.push(`${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but the corresponding public key has expired ${key.expires}`);
-            continue;
-        }
-        const pem = `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`;
-        // crypto.verify can throw on malformed PEM key material or signature bytes
-        // returned by the registry; treat any failure as an invalid signature so
-        // one bad key doesn't crash the whole audit.
-        let verified;
-        try {
-            const verifier = crypto.createVerify('SHA256');
-            verifier.write(message);
-            verifier.end();
-            verified = verifier.verify(pem, signature.sig, 'base64');
-        }
-        catch {
-            verified = false;
-        }
-        if (verified)
-            return undefined;
-        failures.push(`${pkg.name}@${pkg.version} has an invalid registry signature with keyid ${signature.keyid}`);
-    }
-    return toSignatureIssue(pkg, pickMostTellingFailure(pkg, failures));
-}
-/**
- * The reason to surface when no signature validated against a trusted key.
- * Prefer an invalid signature from a known key (a tamper signal) over an
- * unknown-key or expiry reason, since unknown keys may just be junk a mirror
- * appended.
- */
-function pickMostTellingFailure(pkg, failures) {
-    if (failures.length === 0) {
-        return `${pkg.name}@${pkg.version} has no registry signature from a trusted key`;
-    }
-    return failures.find((reason) => reason.includes('invalid registry signature')) ?? failures[0];
-}
-function toSignatureIssue(pkg, reason) {
-    return {
-        integrity: pkg.integrity,
-        name: pkg.name,
-        reason,
-        registry: pkg.registry,
-        resolved: pkg.resolved,
-        version: pkg.version,
-    };
-}
-async function parseJsonResponse(response, errorCode, endpointDescription) {
-    const rawBody = await response.text();
-    try {
-        return JSON.parse(rawBody);
-    }
-    catch (err) {
-        const reason = util.types.isNativeError(err) ? err.message : String(err);
-        throw new PnpmError(errorCode, `${endpointDescription} (at ${response.url}) returned invalid JSON: ${reason}. Response body: ${rawBody.slice(0, 500)}`);
-    }
-}
-function toUri(pkgName, registry) {
-    let encodedName;
-    if (pkgName[0] === '@') {
-        encodedName = `@${encodeURIComponent(pkgName.slice(1))}`;
-    }
-    else {
-        encodedName = encodeURIComponent(pkgName);
-    }
-    return new url.URL(encodedName, registry.endsWith('/') ? registry : `${registry}/`).toString();
-}
-function isRegistryKeysResponse(body) {
-    return typeof body === 'object' && body != null &&
-        Array.isArray(body.keys) &&
-        body.keys.every((key) => typeof key === 'object' && key != null &&
-            typeof key.keyid === 'string' &&
-            typeof key.keytype === 'string' &&
-            typeof key.scheme === 'string' &&
-            typeof key.key === 'string' &&
-            (key.expires == null || typeof key.expires === 'string'));
-}
-function isPackument(body) {
-    return typeof body === 'object' && body != null && typeof body.versions === 'object' && body.versions != null;
-}
-function isPackageSignature(signature) {
-    return typeof signature === 'object' && signature != null &&
-        typeof signature.keyid === 'string' &&
-        typeof signature.sig === 'string';
-}
-function sortIssue(a, b) {
-    return `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`);
-}
-/**
- * The trusted npm signing keys used to verify package-manager binaries before
- * pnpm spawns them — npm's public keys embedded in the CLI. There is
- * deliberately no way to override or disable them at runtime: a verification
- * off-switch would be a footgun, and npm mirrors work without one (they proxy
- * the same signed packument, which is verified against these keys). The keys
- * are refreshed at release time by the update-npm-signing-keys script.
- */
-export function getNpmSigningKeys() {
-    return NPM_SIGNING_KEYS.map((k) => ({ ...k }));
-}
-/**
- * Verifies that the bytes installed on disk are exactly what the registry
- * signed for `name@version`. The signed message is built from the
- * caller-supplied installed {@link InstalledPackageToVerify.integrity}, not
- * from the integrity in the freshly-fetched packument — so if the integrity
- * on disk was tampered with (or fetched from a different registry), the
- * registry's signature will not validate over it.
- *
- * Signatures are verified against the caller-supplied `trustedKeys` (npm's
- * embedded public keys, see {@link getNpmSigningKeys}) rather than keys fetched
- * from a registry — so a registry the caller cannot vouch for cannot answer with
- * its own key pair. The packument (which carries the signatures) is fetched from
- * each package's own registry; an npm mirror works transparently because it
- * proxies the same signed packument.
- *
- * A package counts as a failure when the package is unsigned/unpublished, or
- * when a signature is present but does not validate over the installed bytes.
- */
-export async function verifyInstalledPackageSignatures(packages, trustedKeys, getAuthHeader, opts) {
-    const packumentCache = new Map();
-    const limit = pLimit(opts.networkConcurrency ?? 16);
-    const failures = [];
-    await Promise.all(packages.map((pkg) => limit(async () => {
-        const failure = await findSignatureFailure(pkg, trustedKeys, getAuthHeader, opts, packumentCache);
-        if (failure != null) {
-            failures.push({ name: pkg.name, version: pkg.version, ...failure });
-        }
-    })));
-    failures.sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
-    return { verified: failures.length === 0, failures };
-}
-async function findSignatureFailure(pkg, trustedKeys, getAuthHeader, opts, packumentCache) {
-    let packument;
-    try {
-        packument = await getPackument(pkg, getAuthHeader, opts, packumentCache);
-    }
-    catch (err) {
-        return { reason: util.types.isNativeError(err) ? err.message : String(err), category: 'unreachable' };
-    }
-    if (!packument)
-        return { reason: `${pkg.name} is not published on ${pkg.registry}`, category: 'absent' };
-    const version = packument.versions?.[pkg.version];
-    if (!version)
-        return { reason: `${pkg.name}@${pkg.version} was not found on ${pkg.registry}`, category: 'absent' };
-    const rawSignatures = version.dist?.signatures;
-    if (rawSignatures != null && !Array.isArray(rawSignatures)) {
-        return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
-    }
-    const signatures = rawSignatures ?? [];
-    if (!signatures.every(isPackageSignature)) {
-        return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
-    }
-    if (signatures.length === 0) {
-        return { reason: `${pkg.name}@${pkg.version} has no registry signature`, category: 'absent' };
-    }
-    // The message is built from the installed integrity, so a signature only
-    // validates when the installed bytes match what the registry signed.
-    const issue = verifyPackageSignatures({ ...pkg, integrity: pkg.integrity, publishedAt: packument.time?.[pkg.version], signatures }, trustedKeys);
-    return issue == null ? undefined : { reason: issue.reason ?? 'invalid registry signature', category: 'invalid' };
-}
-//# sourceMappingURL=verifySignatures.js.map