@pnpm/deps.security.signatures 1101.2.6 → 1101.2.7

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @pnpm/deps.security.signatures
 
+## 1101.2.7
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.0
+  - @pnpm/fetching.types@1100.0.3
+  - @pnpm/network.fetch@1100.1.8
+
 ## 1101.2.6
 
 ### Patch Changes

package/lib/index.d.ts

@@ -0,0 +1 @@
+export * from './verifySignatures.js';

package/lib/npmSigningKeys.d.ts

@@ -0,0 +1,13 @@
+export declare const NPM_SIGNING_KEYS: readonly [{
+    readonly expires: null;
+    readonly keyid: "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U";
+    readonly keytype: "ecdsa-sha2-nistp256";
+    readonly scheme: "ecdsa-sha2-nistp256";
+    readonly key: "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g==";
+}, {
+    readonly expires: "2025-01-29T00:00:00.000Z";
+    readonly keyid: "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA";
+    readonly keytype: "ecdsa-sha2-nistp256";
+    readonly scheme: "ecdsa-sha2-nistp256";
+    readonly key: "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg==";
+}];

package/lib/npmSigningKeys.js

@@ -0,0 +1,24 @@
+/* eslint-disable */
+// GENERATED — npm's public registry signing keys, mirrored from
+// https://registry.npmjs.org/-/npm/v1/keys
+//
+// Refresh with: node deps/security/signatures/scripts/update-npm-signing-keys.mjs --update
+// The create-release-pr workflow refreshes these automatically, so a rotated
+// key cannot silently break (or weaken) signature verification.
+export const NPM_SIGNING_KEYS = [
+    {
+        "expires": null,
+        "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="
+    },
+    {
+        "expires": "2025-01-29T00:00:00.000Z",
+        "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="
+    }
+];
+//# sourceMappingURL=npmSigningKeys.js.map

package/lib/verifySignatures.d.ts

@@ -0,0 +1,89 @@
+import type { GetAuthHeader } from '@pnpm/fetching.types';
+import { type CreateFetchFromRegistryOptions, type RetryTimeoutOptions } from '@pnpm/network.fetch';
+export interface SignaturePackage {
+    name: string;
+    registry: string;
+    version: string;
+}
+export interface SignatureIssue extends SignaturePackage {
+    integrity?: string;
+    reason?: string;
+    resolved?: string;
+}
+export interface SignatureVerificationResult {
+    audited: number;
+    invalid: SignatureIssue[];
+    missing: SignatureIssue[];
+    verified: number;
+}
+export interface VerifySignaturesOptions extends CreateFetchFromRegistryOptions {
+    networkConcurrency?: number;
+    retry?: RetryTimeoutOptions;
+    timeout?: number;
+}
+interface RegistryKey {
+    expires: string | null;
+    key: string;
+    keyid: string;
+    keytype: string;
+    scheme: string;
+}
+export declare function verifySignatures(packages: SignaturePackage[], getAuthHeader: GetAuthHeader, opts: VerifySignaturesOptions): Promise<SignatureVerificationResult>;
+export type { RegistryKey };
+/**
+ * The trusted npm signing keys used to verify package-manager binaries before
+ * pnpm spawns them — npm's public keys embedded in the CLI. There is
+ * deliberately no way to override or disable them at runtime: a verification
+ * off-switch would be a footgun, and npm mirrors work without one (they proxy
+ * the same signed packument, which is verified against these keys). The keys
+ * are refreshed at release time by the update-npm-signing-keys script.
+ */
+export declare function getNpmSigningKeys(): RegistryKey[];
+export interface InstalledPackageToVerify {
+    name: string;
+    /** The registry the package was installed from — the packument (and its signatures) is fetched from here. */
+    registry: string;
+    version: string;
+    /** Integrity of the bytes actually installed on disk (from the lockfile). */
+    integrity: string;
+}
+/**
+ * Why a package failed signature verification:
+ * - `invalid`: a registry signature is present but does not validate over the
+ *   installed bytes — a strong tamper signal.
+ * - `absent`: the package/version is not on the (canonical) registry, or carries
+ *   no signature — suspicious for a package that is expected to be signed.
+ * - `unreachable`: the trust root could not be consulted (registry advertised no
+ *   signing keys, or the network request failed) — typically transient/offline,
+ *   not evidence of tampering.
+ */
+export type SignatureFailureCategory = 'invalid' | 'absent' | 'unreachable';
+export interface InstalledSignatureFailure {
+    name: string;
+    version: string;
+    reason: string;
+    category: SignatureFailureCategory;
+}
+export interface InstalledSignatureVerificationResult {
+    verified: boolean;
+    failures: InstalledSignatureFailure[];
+}
+/**
+ * Verifies that the bytes installed on disk are exactly what the registry
+ * signed for `name@version`. The signed message is built from the
+ * caller-supplied installed {@link InstalledPackageToVerify.integrity}, not
+ * from the integrity in the freshly-fetched packument — so if the integrity
+ * on disk was tampered with (or fetched from a different registry), the
+ * registry's signature will not validate over it.
+ *
+ * Signatures are verified against the caller-supplied `trustedKeys` (npm's
+ * embedded public keys, see {@link getNpmSigningKeys}) rather than keys fetched
+ * from a registry — so a registry the caller cannot vouch for cannot answer with
+ * its own key pair. The packument (which carries the signatures) is fetched from
+ * each package's own registry; an npm mirror works transparently because it
+ * proxies the same signed packument.
+ *
+ * A package counts as a failure when the package is unsigned/unpublished, or
+ * when a signature is present but does not validate over the installed bytes.
+ */
+export declare function verifyInstalledPackageSignatures(packages: InstalledPackageToVerify[], trustedKeys: RegistryKey[], getAuthHeader: GetAuthHeader, opts: VerifySignaturesOptions): Promise<InstalledSignatureVerificationResult>;

package/lib/verifySignatures.js

@@ -0,0 +1,328 @@
+import crypto from 'node:crypto';
+import url from 'node:url';
+import util from 'node:util';
+import { PnpmError } from '@pnpm/error';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import pLimit from 'p-limit';
+import { NPM_SIGNING_KEYS } from './npmSigningKeys.js';
+export async function verifySignatures(packages, getAuthHeader, opts) {
+    const registries = new Set(packages.map(({ registry }) => registry));
+    const keysByRegistry = await getKeysByRegistry(registries, getAuthHeader, opts);
+    const result = {
+        audited: 0,
+        invalid: [],
+        missing: [],
+        verified: 0,
+    };
+    // Registries without signing keys are not counted as audited: there is no
+    // registry trust root to verify against.
+    const packumentCache = new Map();
+    const limit = pLimit(opts.networkConcurrency ?? 16);
+    await Promise.all(packages.map((pkg) => limit(async () => {
+        const keys = keysByRegistry.get(pkg.registry) ?? [];
+        if (keys.length === 0)
+            return;
+        let version;
+        let publishedAt;
+        try {
+            const packument = await getPackument(pkg, getAuthHeader, opts, packumentCache);
+            if (!packument)
+                return;
+            result.audited++;
+            version = packument.versions?.[pkg.version];
+            publishedAt = packument.time?.[pkg.version];
+        }
+        catch (err) {
+            result.invalid.push({ ...pkg, reason: util.types.isNativeError(err) ? err.message : String(err) });
+            return;
+        }
+        const integrity = version?.dist?.integrity;
+        const resolved = version?.dist?.tarball;
+        const rawSignatures = version?.dist?.signatures;
+        if (rawSignatures != null && !Array.isArray(rawSignatures)) {
+            result.invalid.push({ ...pkg, integrity, resolved, reason: `Malformed registry signatures metadata for ${pkg.name}@${pkg.version}` });
+            return;
+        }
+        const signatures = rawSignatures ?? [];
+        if (!signatures.every(isPackageSignature)) {
+            result.invalid.push({ ...pkg, integrity, resolved, reason: `Malformed registry signatures metadata for ${pkg.name}@${pkg.version}` });
+            return;
+        }
+        if (!version) {
+            result.invalid.push({ ...pkg, reason: `Missing registry metadata for ${pkg.name}@${pkg.version}` });
+            return;
+        }
+        if (!integrity) {
+            result.missing.push({ ...pkg, resolved });
+            return;
+        }
+        if (signatures.length === 0) {
+            result.missing.push({ ...pkg, integrity, resolved });
+            return;
+        }
+        const issue = verifyPackageSignatures({ ...pkg, integrity, publishedAt, resolved, signatures }, keys);
+        if (issue) {
+            result.invalid.push(issue);
+            return;
+        }
+        result.verified++;
+    })));
+    result.invalid.sort(sortIssue);
+    result.missing.sort(sortIssue);
+    return result;
+}
+async function getKeysByRegistry(registries, getAuthHeader, opts) {
+    const keysByRegistry = new Map();
+    await Promise.all(Array.from(registries, async (registry) => {
+        const keys = await fetchRegistryKeys(registry, getAuthHeader, opts);
+        keysByRegistry.set(registry, keys);
+    }));
+    return keysByRegistry;
+}
+async function fetchRegistryKeys(registry, getAuthHeader, opts) {
+    const registryUrl = registry.endsWith('/') ? registry : `${registry}/`;
+    const keysUrl = new url.URL('-/npm/v1/keys', registryUrl).toString();
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const response = await fetchFromRegistry(keysUrl, {
+        authHeaderValue: getAuthHeader(registryUrl),
+        method: 'GET',
+        retry: opts.retry,
+        timeout: opts.timeout,
+    });
+    if (response.status === 404 || response.status === 400) {
+        return [];
+    }
+    if (response.status !== 200) {
+        const code = 'AUDIT_SIGNATURE_KEYS_FETCH_FAIL';
+        const message = `The registry keys endpoint (at ${response.url}) responded with ${response.status}: ${await response.text()}`;
+        throw new PnpmError(code, message);
+    }
+    const body = await parseJsonResponse(response, 'AUDIT_SIGNATURE_KEYS_FETCH_FAIL', 'The registry keys endpoint');
+    if (!isRegistryKeysResponse(body)) {
+        const code = 'AUDIT_SIGNATURE_KEYS_FETCH_FAIL';
+        const message = `The registry keys endpoint (at ${response.url}) returned an unexpected body. Expected an object with a keys array; got: ${JSON.stringify(body)?.slice(0, 500) ?? String(body)}`;
+        throw new PnpmError(code, message);
+    }
+    // npm registry signing currently uses ECDSA P-256 keys. Sigstore provenance
+    // attestations are intentionally handled separately from this registry check.
+    return body.keys.filter(({ keytype, scheme }) => keytype === 'ecdsa-sha2-nistp256' && scheme === 'ecdsa-sha2-nistp256');
+}
+async function getPackument(pkg, getAuthHeader, opts, packumentCache) {
+    const cacheKey = `${pkg.registry}:${pkg.name}`;
+    let packument = packumentCache.get(cacheKey);
+    if (!packument) {
+        // Multiple installed versions share one full packument fetch.
+        packument = fetchPackument(pkg, getAuthHeader, opts);
+        packumentCache.set(cacheKey, packument);
+    }
+    return packument;
+}
+async function fetchPackument(pkg, getAuthHeader, opts) {
+    const registryUrl = pkg.registry.endsWith('/') ? pkg.registry : `${pkg.registry}/`;
+    const packumentUrl = toUri(pkg.name, registryUrl);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const response = await fetchFromRegistry(packumentUrl, {
+        authHeaderValue: getAuthHeader(registryUrl),
+        fullMetadata: true,
+        method: 'GET',
+        retry: opts.retry,
+        timeout: opts.timeout,
+    });
+    if (response.status === 404) {
+        return undefined;
+    }
+    if (response.status !== 200) {
+        const code = 'AUDIT_SIGNATURE_PACKUMENT_FETCH_FAIL';
+        const message = `The packument endpoint (at ${response.url}) responded with ${response.status}: ${await response.text()}`;
+        throw new PnpmError(code, message);
+    }
+    const body = await parseJsonResponse(response, 'AUDIT_SIGNATURE_PACKUMENT_FETCH_FAIL', 'The packument endpoint');
+    if (!isPackument(body)) {
+        const code = 'AUDIT_SIGNATURE_PACKUMENT_FETCH_FAIL';
+        const message = `The packument endpoint (at ${response.url}) returned an unexpected body. Expected an object with versions; got: ${JSON.stringify(body)?.slice(0, 500) ?? String(body)}`;
+        throw new PnpmError(code, message);
+    }
+    return body;
+}
+function verifyPackageSignatures(pkg, keys) {
+    // Registry signatures cover the package identity and content integrity.
+    const message = `${pkg.name}@${pkg.version}:${pkg.integrity}`;
+    const publishedTime = pkg.publishedAt ? Date.parse(pkg.publishedAt) : undefined;
+    // A package is accepted as soon as ONE signature made by a trusted key
+    // validates. Signatures from unknown/expired/invalid keys are recorded but do
+    // not on their own fail the package — otherwise a key rotation (a packument
+    // carrying multiple signatures) breaks, and a mirror could force a failure
+    // just by appending a junk signature. We fail only when no signature validates
+    // against a trusted key.
+    const failures = [];
+    for (const signature of pkg.signatures) {
+        const key = keys.find(({ keyid }) => keyid === signature.keyid);
+        if (!key) {
+            failures.push(`${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but no corresponding public key can be found`);
+            continue;
+        }
+        // Key expiry is a consistency check, not a security boundary: the publish
+        // time comes from the same unauthenticated packument as the signatures, so
+        // a forger holding an expired trusted key could backdate it anyway. The
+        // signature verification below is what gates acceptance. That is why a
+        // missing publish time keeps the key usable instead of failing closed —
+        // the same trade-off npm's pacote makes by substituting a pre-expiry date.
+        if (key.expires && publishedTime != null && publishedTime >= Date.parse(key.expires)) {
+            failures.push(`${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but the corresponding public key has expired ${key.expires}`);
+            continue;
+        }
+        const pem = `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`;
+        // crypto.verify can throw on malformed PEM key material or signature bytes
+        // returned by the registry; treat any failure as an invalid signature so
+        // one bad key doesn't crash the whole audit.
+        let verified;
+        try {
+            const verifier = crypto.createVerify('SHA256');
+            verifier.write(message);
+            verifier.end();
+            verified = verifier.verify(pem, signature.sig, 'base64');
+        }
+        catch {
+            verified = false;
+        }
+        if (verified)
+            return undefined;
+        failures.push(`${pkg.name}@${pkg.version} has an invalid registry signature with keyid ${signature.keyid}`);
+    }
+    return toSignatureIssue(pkg, pickMostTellingFailure(pkg, failures));
+}
+/**
+ * The reason to surface when no signature validated against a trusted key.
+ * Prefer an invalid signature from a known key (a tamper signal) over an
+ * unknown-key or expiry reason, since unknown keys may just be junk a mirror
+ * appended.
+ */
+function pickMostTellingFailure(pkg, failures) {
+    if (failures.length === 0) {
+        return `${pkg.name}@${pkg.version} has no registry signature from a trusted key`;
+    }
+    return failures.find((reason) => reason.includes('invalid registry signature')) ?? failures[0];
+}
+function toSignatureIssue(pkg, reason) {
+    return {
+        integrity: pkg.integrity,
+        name: pkg.name,
+        reason,
+        registry: pkg.registry,
+        resolved: pkg.resolved,
+        version: pkg.version,
+    };
+}
+async function parseJsonResponse(response, errorCode, endpointDescription) {
+    const rawBody = await response.text();
+    try {
+        return JSON.parse(rawBody);
+    }
+    catch (err) {
+        const reason = util.types.isNativeError(err) ? err.message : String(err);
+        throw new PnpmError(errorCode, `${endpointDescription} (at ${response.url}) returned invalid JSON: ${reason}. Response body: ${rawBody.slice(0, 500)}`);
+    }
+}
+function toUri(pkgName, registry) {
+    let encodedName;
+    if (pkgName[0] === '@') {
+        encodedName = `@${encodeURIComponent(pkgName.slice(1))}`;
+    }
+    else {
+        encodedName = encodeURIComponent(pkgName);
+    }
+    return new url.URL(encodedName, registry.endsWith('/') ? registry : `${registry}/`).toString();
+}
+function isRegistryKeysResponse(body) {
+    return typeof body === 'object' && body != null &&
+        Array.isArray(body.keys) &&
+        body.keys.every((key) => typeof key === 'object' && key != null &&
+            typeof key.keyid === 'string' &&
+            typeof key.keytype === 'string' &&
+            typeof key.scheme === 'string' &&
+            typeof key.key === 'string' &&
+            (key.expires == null || typeof key.expires === 'string'));
+}
+function isPackument(body) {
+    return typeof body === 'object' && body != null && typeof body.versions === 'object' && body.versions != null;
+}
+function isPackageSignature(signature) {
+    return typeof signature === 'object' && signature != null &&
+        typeof signature.keyid === 'string' &&
+        typeof signature.sig === 'string';
+}
+function sortIssue(a, b) {
+    return `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`);
+}
+/**
+ * The trusted npm signing keys used to verify package-manager binaries before
+ * pnpm spawns them — npm's public keys embedded in the CLI. There is
+ * deliberately no way to override or disable them at runtime: a verification
+ * off-switch would be a footgun, and npm mirrors work without one (they proxy
+ * the same signed packument, which is verified against these keys). The keys
+ * are refreshed at release time by the update-npm-signing-keys script.
+ */
+export function getNpmSigningKeys() {
+    return NPM_SIGNING_KEYS.map((k) => ({ ...k }));
+}
+/**
+ * Verifies that the bytes installed on disk are exactly what the registry
+ * signed for `name@version`. The signed message is built from the
+ * caller-supplied installed {@link InstalledPackageToVerify.integrity}, not
+ * from the integrity in the freshly-fetched packument — so if the integrity
+ * on disk was tampered with (or fetched from a different registry), the
+ * registry's signature will not validate over it.
+ *
+ * Signatures are verified against the caller-supplied `trustedKeys` (npm's
+ * embedded public keys, see {@link getNpmSigningKeys}) rather than keys fetched
+ * from a registry — so a registry the caller cannot vouch for cannot answer with
+ * its own key pair. The packument (which carries the signatures) is fetched from
+ * each package's own registry; an npm mirror works transparently because it
+ * proxies the same signed packument.
+ *
+ * A package counts as a failure when the package is unsigned/unpublished, or
+ * when a signature is present but does not validate over the installed bytes.
+ */
+export async function verifyInstalledPackageSignatures(packages, trustedKeys, getAuthHeader, opts) {
+    const packumentCache = new Map();
+    const limit = pLimit(opts.networkConcurrency ?? 16);
+    const failures = [];
+    await Promise.all(packages.map((pkg) => limit(async () => {
+        const failure = await findSignatureFailure(pkg, trustedKeys, getAuthHeader, opts, packumentCache);
+        if (failure != null) {
+            failures.push({ name: pkg.name, version: pkg.version, ...failure });
+        }
+    })));
+    failures.sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+    return { verified: failures.length === 0, failures };
+}
+async function findSignatureFailure(pkg, trustedKeys, getAuthHeader, opts, packumentCache) {
+    let packument;
+    try {
+        packument = await getPackument(pkg, getAuthHeader, opts, packumentCache);
+    }
+    catch (err) {
+        return { reason: util.types.isNativeError(err) ? err.message : String(err), category: 'unreachable' };
+    }
+    if (!packument)
+        return { reason: `${pkg.name} is not published on ${pkg.registry}`, category: 'absent' };
+    const version = packument.versions?.[pkg.version];
+    if (!version)
+        return { reason: `${pkg.name}@${pkg.version} was not found on ${pkg.registry}`, category: 'absent' };
+    const rawSignatures = version.dist?.signatures;
+    if (rawSignatures != null && !Array.isArray(rawSignatures)) {
+        return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
+    }
+    const signatures = rawSignatures ?? [];
+    if (!signatures.every(isPackageSignature)) {
+        return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
+    }
+    if (signatures.length === 0) {
+        return { reason: `${pkg.name}@${pkg.version} has no registry signature`, category: 'absent' };
+    }
+    // The message is built from the installed integrity, so a signature only
+    // validates when the installed bytes match what the registry signed.
+    const issue = verifyPackageSignatures({ ...pkg, integrity: pkg.integrity, publishedAt: packument.time?.[pkg.version], signatures }, trustedKeys);
+    return issue == null ? undefined : { reason: issue.reason ?? 'invalid registry signature', category: 'invalid' };
+}
+//# sourceMappingURL=verifySignatures.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.security.signatures",
-  "version": "1101.2.6",
+  "version": "1101.2.7",
   "description": "Verify package signatures from npm registries",
   "keywords": [
     "pnpm",
@@ -29,9 +29,9 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/fetching.types": "1100.0.2",
-    "@pnpm/network.fetch": "1100.1.7",
+    "@pnpm/error": "1100.1.0",
+    "@pnpm/fetching.types": "1100.0.3",
+    "@pnpm/network.fetch": "1100.1.8",
     "p-limit": "^7.3.0"
   },
   "peerDependencies": {
@@ -39,7 +39,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.security.signatures": "1101.2.6",
+    "@pnpm/deps.security.signatures": "1101.2.7",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/testing.mock-agent": "1101.0.7"
   },