@pnpm/tools.plugin-commands-self-updater 1000.1.57 → 1000.1.59

package/lib/index.d.ts

@@ -1,3 +1,4 @@
 import * as selfUpdate from './selfUpdate.js';
 export { installPnpmToTools } from './installPnpmToTools.js';
+export { getNpmSigningKeys, verifyPnpmEngineIdentity, type RegistryKey, type VerifyPnpmEngineIdentityOptions } from './verifyPnpmEngineIdentity.js';
 export { selfUpdate };

package/lib/index.js

@@ -23,9 +23,12 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.selfUpdate = exports.installPnpmToTools = void 0;
+exports.selfUpdate = exports.verifyPnpmEngineIdentity = exports.getNpmSigningKeys = exports.installPnpmToTools = void 0;
 const selfUpdate = __importStar(require("./selfUpdate.js"));
 exports.selfUpdate = selfUpdate;
 var installPnpmToTools_js_1 = require("./installPnpmToTools.js");
 Object.defineProperty(exports, "installPnpmToTools", { enumerable: true, get: function () { return installPnpmToTools_js_1.installPnpmToTools; } });
+var verifyPnpmEngineIdentity_js_1 = require("./verifyPnpmEngineIdentity.js");
+Object.defineProperty(exports, "getNpmSigningKeys", { enumerable: true, get: function () { return verifyPnpmEngineIdentity_js_1.getNpmSigningKeys; } });
+Object.defineProperty(exports, "verifyPnpmEngineIdentity", { enumerable: true, get: function () { return verifyPnpmEngineIdentity_js_1.verifyPnpmEngineIdentity; } });
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4DAA6C;AAGpC,gCAAU;AAFnB,iEAA4D;AAAnD,2HAAA,kBAAkB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4DAA6C;AAIpC,gCAAU;AAHnB,iEAA4D;AAAnD,2HAAA,kBAAkB,OAAA;AAC3B,6EAAmJ;AAA1I,gIAAA,iBAAiB,OAAA;AAAE,uIAAA,wBAAwB,OAAA"}

package/lib/installPnpmToTools.js

@@ -14,6 +14,7 @@ const rimraf_1 = require("@zkochan/rimraf");
 const path_temp_1 = require("path-temp");
 const semver_1 = __importDefault(require("semver"));
 const symlink_dir_1 = __importDefault(require("symlink-dir"));
+const verifyPnpmEngineIdentity_js_1 = require("./verifyPnpmEngineIdentity.js");
 async function installPnpmToTools(pnpmVersion, opts) {
     const currentPkgName = (0, cli_meta_1.getCurrentPackageName)();
     // pnpm v11 dropped the darwin-x64 artifact from @pnpm/exe because Node.js
@@ -91,6 +92,11 @@ async function installPnpmToTools(pnpmVersion, opts) {
         if (targetPkgName === '@pnpm/exe') {
             linkExePlatformBinary(stage);
         }
+        // Reached only when the wanted version is not yet in the tools directory
+        // (an actual download), so the signature check does not run on every
+        // invocation. Verify before the staged install is linked into place and
+        // spawned — on failure the stage is removed by the catch below.
+        await (0, verifyPnpmEngineIdentity_js_1.verifyPnpmEngineIdentity)(stage, targetPkgName, pnpmVersion, opts);
         // We need the operation of installing pnpm to be atomic.
         // However, we cannot use a rename as that breaks the command shim created for pnpm.
         // Hence, we use a symlink.

package/lib/installPnpmToTools.js.map

@@ -1 +1 @@
-{"version":3,"file":"installPnpmToTools.js","sourceRoot":"","sources":["../src/installPnpmToTools.ts"],"names":[],"mappings":";;;;;AAkBA,gDAkGC;AApHD,4CAAmB;AACnB,gDAAuB;AACvB,6CAAsD;AACtD,qEAAuD;AACvD,yCAAyC;AACzC,iDAAiD;AACjD,4CAAgD;AAChD,yCAAoD;AACpD,oDAA2B;AAC3B,8DAAoC;AAS7B,KAAK,UAAU,kBAAkB,CAAE,WAAmB,EAAE,IAA8B;IAC3F,MAAM,cAAc,GAAG,IAAA,gCAAqB,GAAE,CAAA;IAC9C,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,aAAa,GAAG,CACpB,cAAc,KAAK,WAAW;QAC9B,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC7B,OAAO,CAAC,IAAI,KAAK,KAAK;QACtB,gBAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAChC;QACC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,cAAc,CAAA;IAClB,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;QACrC,IAAA,mBAAU,EACR,yEAAyE,WAAW,yKAAyK,CAC9P,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,2BAAc,EAAC;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE;YACJ,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,WAAW;SACrB;KACF,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,YAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;YACL,cAAc;YACd,OAAO,EAAE,GAAG;YACZ,MAAM;SACP,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,wBAAQ,EAAC,GAAG,CAAC,CAAA;IAC3B,YAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,YAAE,CAAC,aAAa,CAAC,cAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,CAAC;QACH,gHAAgH;QAChH,2DAA2D;QAC3D,mGAAmG;QACnG,iHAAiH;QACjH,0EAA0E;QAC1E,IAAA,iCAAU,EAAC;YACT,KAAK;YACL,GAAG,aAAa,IAAI,WAAW,EAAE;YACjC,kBAAkB;YAClB,kBAAkB;YAClB,kCAAkC;YAClC,wDAAwD;YACxD,yCAAyC;YACzC,8BAA8B;YAC9B,kBAAkB;YAClB,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,yEAAyE;YACzE,oBAAoB;SACrB,EAAE;YACD,GAAG,EAAE,KAAK;YACV,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,+DAA+D;YAC/D,qDAAqD;YACrD,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,0CAA0C,EAAE,OAAO;gBACnD,sBAAsB,EAAE,QAAQ;aACjC;SACF,CAAC,CAAA;QACF,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YAClC,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QACD,yDAAyD;QACzD,oFAAoF;QACpF,2BAA2B;QAC3B,+FAA+F;QAC/F,qBAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,IAAA,aAAM,EAAC,KAAK,CAAC,CAAA;QACf,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC,CAAC,+BAA+B;QAC1C,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO;QACL,cAAc;QACd,OAAO,EAAE,GAAG;QACZ,MAAM;KACP,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,2DAA2D;AAC3D,qDAAqD;AACrD,kFAAkF;AAClF,6EAA6E;AAC7E,wCAAwC;AACxC,SAAS,qBAAqB,CAAE,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC7B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;IACtB,MAAM,IAAI,GAAG,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAA;IACjF,MAAM,UAAU,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAA;IAC3D,MAAM,cAAc,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;IAC1F,MAAM,GAAG,GAAG,cAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;IACjD,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAM;IAC/B,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IACD,YAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACtB,YAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACzB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;QAClE,YAAE,CAAC,aAAa,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,oCAAoC,CAAC,CAAA;QACpF,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,UAAU,CAAA;QAC5B,YAAE,CAAC,aAAa,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACnE,CAAC;AACH,CAAC"}
+{"version":3,"file":"installPnpmToTools.js","sourceRoot":"","sources":["../src/installPnpmToTools.ts"],"names":[],"mappings":";;;;;AAmBA,gDAuGC;AA1HD,4CAAmB;AACnB,gDAAuB;AACvB,6CAAsD;AACtD,qEAAuD;AACvD,yCAAyC;AACzC,iDAAiD;AACjD,4CAAgD;AAChD,yCAAoD;AACpD,oDAA2B;AAC3B,8DAAoC;AAEpC,+EAAwE;AAQjE,KAAK,UAAU,kBAAkB,CAAE,WAAmB,EAAE,IAA8B;IAC3F,MAAM,cAAc,GAAG,IAAA,gCAAqB,GAAE,CAAA;IAC9C,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,aAAa,GAAG,CACpB,cAAc,KAAK,WAAW;QAC9B,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC7B,OAAO,CAAC,IAAI,KAAK,KAAK;QACtB,gBAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAChC;QACC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,cAAc,CAAA;IAClB,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;QACrC,IAAA,mBAAU,EACR,yEAAyE,WAAW,yKAAyK,CAC9P,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,2BAAc,EAAC;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE;YACJ,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,WAAW;SACrB;KACF,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,YAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;YACL,cAAc;YACd,OAAO,EAAE,GAAG;YACZ,MAAM;SACP,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,wBAAQ,EAAC,GAAG,CAAC,CAAA;IAC3B,YAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,YAAE,CAAC,aAAa,CAAC,cAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,CAAC;QACH,gHAAgH;QAChH,2DAA2D;QAC3D,mGAAmG;QACnG,iHAAiH;QACjH,0EAA0E;QAC1E,IAAA,iCAAU,EAAC;YACT,KAAK;YACL,GAAG,aAAa,IAAI,WAAW,EAAE;YACjC,kBAAkB;YAClB,kBAAkB;YAClB,kCAAkC;YAClC,wDAAwD;YACxD,yCAAyC;YACzC,8BAA8B;YAC9B,kBAAkB;YAClB,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,yEAAyE;YACzE,oBAAoB;SACrB,EAAE;YACD,GAAG,EAAE,KAAK;YACV,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,+DAA+D;YAC/D,qDAAqD;YACrD,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,0CAA0C,EAAE,OAAO;gBACnD,sBAAsB,EAAE,QAAQ;aACjC;SACF,CAAC,CAAA;QACF,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YAClC,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,IAAA,sDAAwB,EAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;QACvE,yDAAyD;QACzD,oFAAoF;QACpF,2BAA2B;QAC3B,+FAA+F;QAC/F,qBAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,IAAA,aAAM,EAAC,KAAK,CAAC,CAAA;QACf,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC,CAAC,+BAA+B;QAC1C,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO;QACL,cAAc;QACd,OAAO,EAAE,GAAG;QACZ,MAAM;KACP,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,2DAA2D;AAC3D,qDAAqD;AACrD,kFAAkF;AAClF,6EAA6E;AAC7E,wCAAwC;AACxC,SAAS,qBAAqB,CAAE,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC7B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;IACtB,MAAM,IAAI,GAAG,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAA;IACjF,MAAM,UAAU,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAA;IAC3D,MAAM,cAAc,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;IAC1F,MAAM,GAAG,GAAG,cAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;IACjD,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAM;IAC/B,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IACD,YAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACtB,YAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACzB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;QAClE,YAAE,CAAC,aAAa,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,oCAAoC,CAAC,CAAA;QACpF,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,UAAU,CAAA;QAC5B,YAAE,CAAC,aAAa,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACnE,CAAC;AACH,CAAC"}

package/lib/npmSigningKeys.d.ts

@@ -0,0 +1,13 @@
+export declare const NPM_SIGNING_KEYS: readonly [{
+    readonly expires: "2025-01-29T00:00:00.000Z";
+    readonly keyid: "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA";
+    readonly keytype: "ecdsa-sha2-nistp256";
+    readonly scheme: "ecdsa-sha2-nistp256";
+    readonly key: "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg==";
+}, {
+    readonly expires: null;
+    readonly keyid: "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U";
+    readonly keytype: "ecdsa-sha2-nistp256";
+    readonly scheme: "ecdsa-sha2-nistp256";
+    readonly key: "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g==";
+}];

package/lib/npmSigningKeys.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NPM_SIGNING_KEYS = void 0;
+/* eslint-disable */
+// GENERATED — npm's public registry signing keys, mirrored from
+// https://registry.npmjs.org/-/npm/v1/keys
+//
+// Refresh with: node tools/plugin-commands-self-updater/scripts/update-npm-signing-keys.mjs --update
+// The release workflow runs `--check` and fails if these drift from npm, so a
+// rotated key cannot silently break (or weaken) signature verification.
+exports.NPM_SIGNING_KEYS = [
+    {
+        "expires": "2025-01-29T00:00:00.000Z",
+        "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="
+    },
+    {
+        "expires": null,
+        "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="
+    }
+];
+//# sourceMappingURL=npmSigningKeys.js.map

package/lib/npmSigningKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmSigningKeys.js","sourceRoot":"","sources":["../src/npmSigningKeys.ts"],"names":[],"mappings":";;;AAAA,oBAAoB;AACpB,gEAAgE;AAChE,2CAA2C;AAC3C,EAAE;AACF,qGAAqG;AACrG,8EAA8E;AAC9E,wEAAwE;AAC3D,QAAA,gBAAgB,GAAG;IAC9B;QACE,SAAS,EAAE,0BAA0B;QACrC,OAAO,EAAE,oDAAoD;QAC7D,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,qBAAqB;QAC/B,KAAK,EAAE,8HAA8H;KACtI;IACD;QACE,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,oDAAoD;QAC7D,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,qBAAqB;QAC/B,KAAK,EAAE,8HAA8H;KACtI;CAOD,CAAA"}

package/lib/selfUpdate.d.ts

@@ -1,7 +1,11 @@
 import { type Config } from '@pnpm/config';
+import { type VerifyPnpmEngineIdentityOptions } from './verifyPnpmEngineIdentity.js';
 export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare function cliOptionsTypes(): Record<string, unknown>;
 export declare const commandNames: string[];
 export declare function help(): string;
-export type SelfUpdateCommandOptions = Pick<Config, 'cacheDir' | 'dir' | 'lockfileDir' | 'managePackageManagerVersions' | 'modulesDir' | 'pnpmHomeDir' | 'rawConfig' | 'registries' | 'rootProjectManifestDir' | 'wantedPackageManager'>;
+export type SelfUpdateCommandOptions = Pick<Config, 'cacheDir' | 'dir' | 'lockfileDir' | 'managePackageManagerVersions' | 'modulesDir' | 'pnpmHomeDir' | 'rawConfig' | 'registries' | 'rootProjectManifestDir' | 'wantedPackageManager'> & {
+    /** See {@link VerifyPnpmEngineIdentityOptions.trustedKeys} — a test seam. */
+    trustedKeys?: VerifyPnpmEngineIdentityOptions['trustedKeys'];
+};
 export declare function handler(opts: SelfUpdateCommandOptions, params: string[]): Promise<undefined | string>;

package/lib/selfUpdate.js.map

@@ -1 +1 @@
-{"version":3,"file":"selfUpdate.js","sourceRoot":"","sources":["../src/selfUpdate.ts"],"names":[],"mappings":";;;;;;AAcA,wCAEC;AAED,0CAIC;AAaD,oBAYC;AAeD,0BA+EC;AA7ID,gDAAuB;AACvB,+CAAyC;AACzC,6CAAqE;AACrE,yCAA6C;AAC7C,yCAA6D;AAC7D,uCAAuC;AACvC,yCAAyC;AACzC,uEAAiE;AACjE,+CAA0C;AAC1C,0DAAiC;AACjC,8DAAoC;AACpC,oDAA2B;AAC3B,mEAA4D;AAE5D,SAAgB,cAAc;IAC5B,OAAO,IAAA,cAAI,EAAC,EAAE,EAAE,cAAQ,CAAC,CAAA;AAC3B,CAAC;AAED,SAAgB,eAAe;IAC7B,OAAO;QACL,GAAG,cAAc,EAAE;KACpB,CAAA;AACH,CAAC;AAEY,QAAA,YAAY,GAAG,CAAC,aAAa,CAAC,CAAA;AAE3C,0EAA0E;AAC1E,wEAAwE;AACxE,gCAAgC;AAChC,MAAM,mBAAmB,GAA2B;IAClD,EAAE,EACA,oDAAoD;QACpD,gEAAgE;CACnE,CAAA;AAED,SAAgB,IAAI;IAClB,OAAO,IAAA,qBAAU,EAAC;QAChB,WAAW,EAAE,2DAA2D;QACxE,gBAAgB,EAAE,EAAE;QACpB,GAAG,EAAE,IAAA,mBAAO,EAAC,aAAa,CAAC;QAC3B,MAAM,EAAE;YACN,kBAAkB;YAClB,oBAAoB;YACpB,0BAA0B;YAC1B,yBAAyB;SAC1B;KACF,CAAC,CAAA;AACJ,CAAC;AAeM,KAAK,UAAU,OAAO,CAC3B,IAA8B,EAC9B,MAAgB;IAEhB,IAAI,IAAA,+BAAoB,GAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAS,CAAC,8BAA8B,EAAE,sCAAsC,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,uBAAc,EAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAA;IACtB,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAA;IAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE;QAClE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG;QACzC,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,iBAAS,CAAC,qBAAqB,EAAE,gBAAgB,aAAa,mBAAmB,CAAC,CAAA;IAC9F,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,6CAA6C;IAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAA;IACjD,IAAI,eAAmC,CAAA;IACvC,IAAI,IAAI,CAAC,oBAAoB,EAAE,IAAI,KAAK,yBAAc,CAAC,IAAI,IAAI,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACjG,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACxD,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAA;QACrD,CAAC;IACH,CAAC;SAAM,IAAI,yBAAc,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACpD,eAAe,GAAG,yBAAc,CAAC,OAAO,CAAA;IAC1C,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,IAAI,IAAI;QAC3C,CAAC,CAAC,gBAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK;QACvC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,WAAW,GAAG,gBAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC/C,IAAI,aAAa,IAAI,IAAI,IAAI,WAAW,GAAG,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAC7C,IAAI,IAAI;YAAE,IAAA,mBAAU,EAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IAED,IAAI,IAAI,CAAC,oBAAoB,EAAE,IAAI,KAAK,yBAAc,CAAC,IAAI,IAAI,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACjG,IAAI,IAAI,CAAC,oBAAoB,EAAE,OAAO,KAAK,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvE,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAA;YACvD,IAAI,gBAAgB,IAAI,aAAa,IAAI,IAAI,IAAI,gBAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBACvG,OAAO,2CAA2C,aAAa,gEAAgE,UAAU,CAAC,QAAQ,CAAC,OAAO,qEAAqE,CAAA;YACjO,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,MAAM,IAAA,2CAAmB,EAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YACjG,QAAQ,CAAC,cAAc,GAAG,QAAQ,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/D,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAA;YACpC,OAAO,qDAAqD,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QAC3F,CAAC;aAAM,CAAC;YACN,OAAO,mDAAmD,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QACzF,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,KAAK,yBAAc,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,wBAAwB,yBAAc,CAAC,IAAI,KAAK,yBAAc,CAAC,OAAO,gBAAgB,aAAa,8BAA8B,CAAA;IAC1I,CAAC;IACD,IAAI,gBAAgB,IAAI,gBAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,yBAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,OAAO,wBAAwB,yBAAc,CAAC,IAAI,KAAK,yBAAc,CAAC,OAAO,yDAAyD,UAAU,CAAC,QAAQ,CAAC,OAAO,qEAAqE,CAAA;IACxO,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,IAAA,0CAAkB,EAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC/F,MAAM,IAAA,oBAAQ,EAAC,cAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,WAAW,EACjE;QACE,IAAI,EAAE,mBAAU;KACjB,CACF,CAAA;IACD,OAAO,cAAc;QACnB,CAAC,CAAC,OAAO,aAAa,cAAc,UAAU,CAAC,QAAQ,CAAC,OAAO,2EAA2E,OAAO,GAAG;QACpJ,CAAC,CAAC,SAAS,CAAA;AACf,CAAC"}
+{"version":3,"file":"selfUpdate.js","sourceRoot":"","sources":["../src/selfUpdate.ts"],"names":[],"mappings":";;;;;;AAeA,wCAEC;AAED,0CAIC;AAaD,oBAYC;AAkBD,0BA+EC;AAjJD,gDAAuB;AACvB,+CAAyC;AACzC,6CAAqE;AACrE,yCAA6C;AAC7C,yCAA6D;AAC7D,uCAAuC;AACvC,yCAAyC;AACzC,uEAAiE;AACjE,+CAA0C;AAC1C,0DAAiC;AACjC,8DAAoC;AACpC,oDAA2B;AAC3B,mEAA4D;AAG5D,SAAgB,cAAc;IAC5B,OAAO,IAAA,cAAI,EAAC,EAAE,EAAE,cAAQ,CAAC,CAAA;AAC3B,CAAC;AAED,SAAgB,eAAe;IAC7B,OAAO;QACL,GAAG,cAAc,EAAE;KACpB,CAAA;AACH,CAAC;AAEY,QAAA,YAAY,GAAG,CAAC,aAAa,CAAC,CAAA;AAE3C,0EAA0E;AAC1E,wEAAwE;AACxE,gCAAgC;AAChC,MAAM,mBAAmB,GAA2B;IAClD,EAAE,EACA,oDAAoD;QACpD,gEAAgE;CACnE,CAAA;AAED,SAAgB,IAAI;IAClB,OAAO,IAAA,qBAAU,EAAC;QAChB,WAAW,EAAE,2DAA2D;QACxE,gBAAgB,EAAE,EAAE;QACpB,GAAG,EAAE,IAAA,mBAAO,EAAC,aAAa,CAAC;QAC3B,MAAM,EAAE;YACN,kBAAkB;YAClB,oBAAoB;YACpB,0BAA0B;YAC1B,yBAAyB;SAC1B;KACF,CAAC,CAAA;AACJ,CAAC;AAkBM,KAAK,UAAU,OAAO,CAC3B,IAA8B,EAC9B,MAAgB;IAEhB,IAAI,IAAA,+BAAoB,GAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAS,CAAC,8BAA8B,EAAE,sCAAsC,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,uBAAc,EAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAA;IACtB,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAA;IAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE;QAClE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG;QACzC,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,iBAAS,CAAC,qBAAqB,EAAE,gBAAgB,aAAa,mBAAmB,CAAC,CAAA;IAC9F,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,6CAA6C;IAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAA;IACjD,IAAI,eAAmC,CAAA;IACvC,IAAI,IAAI,CAAC,oBAAoB,EAAE,IAAI,KAAK,yBAAc,CAAC,IAAI,IAAI,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACjG,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACxD,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAA;QACrD,CAAC;IACH,CAAC;SAAM,IAAI,yBAAc,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACpD,eAAe,GAAG,yBAAc,CAAC,OAAO,CAAA;IAC1C,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,IAAI,IAAI;QAC3C,CAAC,CAAC,gBAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK;QACvC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,WAAW,GAAG,gBAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC/C,IAAI,aAAa,IAAI,IAAI,IAAI,WAAW,GAAG,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAC7C,IAAI,IAAI;YAAE,IAAA,mBAAU,EAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IAED,IAAI,IAAI,CAAC,oBAAoB,EAAE,IAAI,KAAK,yBAAc,CAAC,IAAI,IAAI,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACjG,IAAI,IAAI,CAAC,oBAAoB,EAAE,OAAO,KAAK,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvE,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAA;YACvD,IAAI,gBAAgB,IAAI,aAAa,IAAI,IAAI,IAAI,gBAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBACvG,OAAO,2CAA2C,aAAa,gEAAgE,UAAU,CAAC,QAAQ,CAAC,OAAO,qEAAqE,CAAA;YACjO,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,MAAM,IAAA,2CAAmB,EAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YACjG,QAAQ,CAAC,cAAc,GAAG,QAAQ,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/D,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAA;YACpC,OAAO,qDAAqD,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QAC3F,CAAC;aAAM,CAAC;YACN,OAAO,mDAAmD,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QACzF,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,KAAK,yBAAc,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,wBAAwB,yBAAc,CAAC,IAAI,KAAK,yBAAc,CAAC,OAAO,gBAAgB,aAAa,8BAA8B,CAAA;IAC1I,CAAC;IACD,IAAI,gBAAgB,IAAI,gBAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,yBAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,OAAO,wBAAwB,yBAAc,CAAC,IAAI,KAAK,yBAAc,CAAC,OAAO,yDAAyD,UAAU,CAAC,QAAQ,CAAC,OAAO,qEAAqE,CAAA;IACxO,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,IAAA,0CAAkB,EAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC/F,MAAM,IAAA,oBAAQ,EAAC,cAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,WAAW,EACjE;QACE,IAAI,EAAE,mBAAU;KACjB,CACF,CAAA;IACD,OAAO,cAAc;QACnB,CAAC,CAAC,OAAO,aAAa,cAAc,UAAU,CAAC,QAAQ,CAAC,OAAO,2EAA2E,OAAO,GAAG;QACpJ,CAAC,CAAC,SAAS,CAAA;AACf,CAAC"}

package/lib/verifyPnpmEngineIdentity.d.ts

@@ -0,0 +1,52 @@
+import { type CreateFetchFromRegistryOptions } from '@pnpm/fetch';
+import { type Registries } from '@pnpm/types';
+export interface RegistryKey {
+    expires: string | null;
+    key: string;
+    keyid: string;
+    keytype: string;
+    scheme: string;
+}
+/**
+ * The trusted npm signing keys used to verify package-manager binaries before
+ * pnpm spawns them — npm's public keys embedded in the CLI. There is
+ * deliberately no way to override or disable them at runtime: a verification
+ * off-switch would be a footgun, and npm mirrors work without one (they proxy
+ * the same signed packument, which is verified against these keys). The keys
+ * are refreshed at release time by the update-npm-signing-keys script.
+ */
+export declare function getNpmSigningKeys(): RegistryKey[];
+export interface VerifyPnpmEngineIdentityOptions extends CreateFetchFromRegistryOptions {
+    registries: Registries;
+    rawConfig: Record<string, string>;
+    retry?: {
+        retries?: number;
+    };
+    timeout?: number;
+    /**
+     * The npm signing keys to trust. Defaults to {@link getNpmSigningKeys} (npm's
+     * embedded public keys). A test seam only — passing an empty array skips
+     * verification. Not reachable from project config, so it cannot be used to
+     * weaken verification for a real install.
+     */
+    trustedKeys?: RegistryKey[];
+}
+/**
+ * Verifies that the pnpm engine staged at `stageDir` (and about to be linked
+ * into the tools directory and executed) is genuinely the published `pnpm` /
+ * `@pnpm/exe` — i.e. the bytes recorded in the staged lockfile carry a valid
+ * npm registry signature for their exact `name@version`.
+ *
+ * The wanted pnpm version comes from a repository's `packageManager` field,
+ * so without this check a cloned repository could make pnpm download and run
+ * an arbitrary native binary. Signatures are verified against npm's embedded
+ * public keys (see {@link getNpmSigningKeys}), so a registry cannot answer
+ * with its own key pair; the signed packument is fetched from the configured
+ * registry, which an npm mirror proxies transparently.
+ *
+ * Fails closed: verification failure — including an unreachable registry —
+ * refuses the version switch rather than running an unverified binary. This
+ * runs only when the engine is actually being installed (a tools-directory
+ * cache miss), so it does not add a network round trip to every command.
+ */
+export declare function verifyPnpmEngineIdentity(stageDir: string, targetPkgName: string, pnpmVersion: string, opts: VerifyPnpmEngineIdentityOptions): Promise<void>;

package/lib/verifyPnpmEngineIdentity.js

@@ -0,0 +1,235 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getNpmSigningKeys = getNpmSigningKeys;
+exports.verifyPnpmEngineIdentity = verifyPnpmEngineIdentity;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const url_1 = __importDefault(require("url"));
+const util_1 = __importDefault(require("util"));
+const error_1 = require("@pnpm/error");
+const fetch_1 = require("@pnpm/fetch");
+const lockfile_fs_1 = require("@pnpm/lockfile.fs");
+const network_auth_header_1 = require("@pnpm/network.auth-header");
+const pick_registry_for_package_1 = require("@pnpm/pick-registry-for-package");
+const npmSigningKeys_js_1 = require("./npmSigningKeys.js");
+/**
+ * The trusted npm signing keys used to verify package-manager binaries before
+ * pnpm spawns them — npm's public keys embedded in the CLI. There is
+ * deliberately no way to override or disable them at runtime: a verification
+ * off-switch would be a footgun, and npm mirrors work without one (they proxy
+ * the same signed packument, which is verified against these keys). The keys
+ * are refreshed at release time by the update-npm-signing-keys script.
+ */
+function getNpmSigningKeys() {
+    return npmSigningKeys_js_1.NPM_SIGNING_KEYS.map((k) => ({ ...k }));
+}
+/**
+ * Verifies that the pnpm engine staged at `stageDir` (and about to be linked
+ * into the tools directory and executed) is genuinely the published `pnpm` /
+ * `@pnpm/exe` — i.e. the bytes recorded in the staged lockfile carry a valid
+ * npm registry signature for their exact `name@version`.
+ *
+ * The wanted pnpm version comes from a repository's `packageManager` field,
+ * so without this check a cloned repository could make pnpm download and run
+ * an arbitrary native binary. Signatures are verified against npm's embedded
+ * public keys (see {@link getNpmSigningKeys}), so a registry cannot answer
+ * with its own key pair; the signed packument is fetched from the configured
+ * registry, which an npm mirror proxies transparently.
+ *
+ * Fails closed: verification failure — including an unreachable registry —
+ * refuses the version switch rather than running an unverified binary. This
+ * runs only when the engine is actually being installed (a tools-directory
+ * cache miss), so it does not add a network round trip to every command.
+ */
+async function verifyPnpmEngineIdentity(stageDir, targetPkgName, pnpmVersion, opts) {
+    const trustedKeys = opts.trustedKeys ?? getNpmSigningKeys();
+    if (trustedKeys.length === 0)
+        return; // test seam: no trusted keys means skip
+    const lockfile = await (0, lockfile_fs_1.readWantedLockfile)(stageDir, { ignoreIncompatible: true });
+    if (lockfile == null) {
+        throw new error_1.PnpmError('PNPM_ENGINE_IDENTITY_UNVERIFIABLE', `Cannot verify the identity of pnpm@${pnpmVersion}: the staged install has no lockfile.`);
+    }
+    const toVerify = collectEnginePackagesToVerify(lockfile, stageDir, targetPkgName, pnpmVersion, opts.registries);
+    const getAuthHeader = (0, network_auth_header_1.createGetAuthHeaderByURI)({ allSettings: opts.rawConfig });
+    const fetchFromRegistry = (0, fetch_1.createFetchFromRegistry)(opts);
+    const failures = [];
+    await Promise.all(toVerify.map(async (pkg) => {
+        const failure = await findSignatureFailure(pkg, trustedKeys, { fetchFromRegistry, getAuthHeader, retry: opts.retry, timeout: opts.timeout });
+        if (failure != null) {
+            failures.push({ name: pkg.name, version: pkg.version, ...failure });
+        }
+    }));
+    if (failures.length === 0)
+        return;
+    failures.sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+    const onlyUnreachable = failures.every((f) => f.category === 'unreachable');
+    throw new error_1.PnpmError(onlyUnreachable ? 'PNPM_ENGINE_IDENTITY_UNVERIFIABLE' : 'PNPM_ENGINE_IDENTITY_MISMATCH', `Refusing to run pnpm@${pnpmVersion}: its npm registry signature could not be verified ` +
+        `(${failures.map(({ name, version, reason }) => `${name}@${version}: ${reason}`).join('; ')}). ` +
+        'The bytes selected by this install do not match a published, signed pnpm release.', { hint: 'This can indicate a tampered download or a malicious/unreachable registry. Set `manage-package-manager-versions` to `false` to skip the version switch if this is unexpected.' });
+}
+function collectEnginePackagesToVerify(lockfile, stageDir, targetPkgName, version, registries) {
+    const toVerify = [engineComponentToVerify(lockfile, registries, targetPkgName, version)];
+    if (targetPkgName === '@pnpm/exe') {
+        // The bytes actually executed are the host's platform binary, listed as an
+        // optional dependency of `@pnpm/exe`. Verify every platform package the
+        // staged install actually materialized on disk.
+        const optionalDeps = lockfile.packages?.[`@pnpm/exe@${version}`]?.optionalDependencies ?? {};
+        for (const [name, platformVersion] of Object.entries(optionalDeps)) {
+            if (!fs_1.default.existsSync(path_1.default.join(stageDir, 'node_modules', name)))
+                continue;
+            toVerify.push(engineComponentToVerify(lockfile, registries, name, platformVersion));
+        }
+    }
+    return toVerify;
+}
+function engineComponentToVerify(lockfile, registries, name, version) {
+    const resolution = lockfile.packages?.[`${name}@${version}`]?.resolution;
+    const integrity = resolution?.integrity;
+    if (typeof integrity !== 'string' || !integrity) {
+        // pnpm can install a tarball without integrity, so a missing integrity must
+        // fail closed rather than silently exempt that component from verification.
+        throw new error_1.PnpmError('PNPM_ENGINE_IDENTITY_UNVERIFIABLE', `Cannot verify the identity of ${name}@${version}: its integrity metadata is missing from the staged lockfile.`);
+    }
+    return { name, version, registry: (0, pick_registry_for_package_1.pickRegistryForPackage)(registries, name), integrity };
+}
+async function findSignatureFailure(pkg, trustedKeys, ctx) {
+    let packument;
+    try {
+        packument = await fetchPackument(pkg, ctx);
+    }
+    catch (err) {
+        // Fetch-layer errors embed the request URL, which may carry credentials.
+        return { reason: redactTextCredentials(util_1.default.types.isNativeError(err) ? err.message : String(err)), category: 'unreachable' };
+    }
+    if (!packument)
+        return { reason: `${pkg.name} is not published on ${redactUrlCredentials(pkg.registry)}`, category: 'absent' };
+    const version = packument.versions?.[pkg.version];
+    if (!version)
+        return { reason: `${pkg.name}@${pkg.version} was not found on ${redactUrlCredentials(pkg.registry)}`, category: 'absent' };
+    const rawSignatures = version.dist?.signatures;
+    if (rawSignatures != null && !Array.isArray(rawSignatures)) {
+        return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
+    }
+    const signatures = rawSignatures ?? [];
+    if (!signatures.every(isPackageSignature)) {
+        return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
+    }
+    if (signatures.length === 0) {
+        return { reason: `${pkg.name}@${pkg.version} has no registry signature`, category: 'absent' };
+    }
+    // The message is built from the installed integrity, so a signature only
+    // validates when the installed bytes match what the registry signed.
+    return verifyPackageSignatures(pkg, packument.time?.[pkg.version], signatures, trustedKeys);
+}
+async function fetchPackument(pkg, ctx) {
+    const registryUrl = pkg.registry.endsWith('/') ? pkg.registry : `${pkg.registry}/`;
+    const packumentUrl = toUri(pkg.name, registryUrl);
+    const response = await ctx.fetchFromRegistry(packumentUrl, {
+        authHeaderValue: ctx.getAuthHeader(registryUrl),
+        fullMetadata: true,
+        retry: ctx.retry,
+        timeout: ctx.timeout,
+    });
+    if (response.status === 404) {
+        return undefined;
+    }
+    if (response.status !== 200) {
+        throw new error_1.PnpmError('ENGINE_IDENTITY_PACKUMENT_FETCH_FAIL', `The packument endpoint (at ${redactUrlCredentials(packumentUrl)}) responded with ${response.status}: ${(await response.text()).slice(0, 500)}`);
+    }
+    const body = await response.json();
+    if (!isPackument(body)) {
+        throw new error_1.PnpmError('ENGINE_IDENTITY_PACKUMENT_FETCH_FAIL', `The packument endpoint (at ${redactUrlCredentials(packumentUrl)}) returned an unexpected body. Expected an object with versions; got: ${JSON.stringify(body)?.slice(0, 500) ?? String(body)}`);
+    }
+    return body;
+}
+// Registry URLs may legally embed basic-auth credentials
+// (https://user:pass@host/); never print those in error messages, which land
+// in terminal output and CI logs.
+function redactUrlCredentials(rawUrl) {
+    try {
+        const parsed = new url_1.default.URL(rawUrl);
+        parsed.username = '';
+        parsed.password = '';
+        return parsed.toString();
+    }
+    catch {
+        return rawUrl;
+    }
+}
+function redactTextCredentials(text) {
+    return text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^@/\s]+@/gi, '$1');
+}
+function verifyPackageSignatures(pkg, publishedAt, signatures, keys) {
+    // Registry signatures cover the package identity and content integrity.
+    const message = `${pkg.name}@${pkg.version}:${pkg.integrity}`;
+    const publishedTime = publishedAt ? Date.parse(publishedAt) : undefined;
+    // A package is accepted as soon as ONE signature made by a trusted key
+    // validates. Signatures from unknown/expired/invalid keys are recorded but do
+    // not on their own fail the package — otherwise a key rotation (a packument
+    // carrying multiple signatures) breaks, and a mirror could force a failure
+    // just by appending a junk signature. We fail only when no signature validates
+    // against a trusted key.
+    const failures = [];
+    for (const signature of signatures) {
+        const key = keys.find(({ keyid }) => keyid === signature.keyid);
+        if (!key) {
+            failures.push(`${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but no corresponding public key can be found`);
+            continue;
+        }
+        // Key expiry is a consistency check, not a security boundary: the publish
+        // time comes from the same unauthenticated packument as the signatures, so
+        // a forger holding an expired trusted key could backdate it anyway. The
+        // signature verification below is what gates acceptance.
+        if (key.expires && publishedTime != null && publishedTime >= Date.parse(key.expires)) {
+            failures.push(`${pkg.name}@${pkg.version} has a registry signature with keyid ${signature.keyid} but the corresponding public key has expired ${key.expires}`);
+            continue;
+        }
+        const pem = `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`;
+        // crypto.verify can throw on malformed PEM key material or signature bytes
+        // returned by the registry; treat any failure as an invalid signature so
+        // one bad key doesn't crash the whole verification.
+        let verified;
+        try {
+            const verifier = crypto_1.default.createVerify('SHA256');
+            verifier.write(message);
+            verifier.end();
+            verified = verifier.verify(pem, signature.sig, 'base64');
+        }
+        catch {
+            verified = false;
+        }
+        if (verified)
+            return undefined;
+        failures.push(`${pkg.name}@${pkg.version} has an invalid registry signature with keyid ${signature.keyid}`);
+    }
+    // Prefer an invalid signature from a known key (a tamper signal) over an
+    // unknown-key or expiry reason, since unknown keys may just be junk a mirror
+    // appended.
+    const reason = failures.find((failure) => failure.includes('invalid registry signature')) ??
+        failures[0] ??
+        `${pkg.name}@${pkg.version} has no registry signature from a trusted key`;
+    return { reason, category: 'invalid' };
+}
+function toUri(pkgName, registry) {
+    let encodedName;
+    if (pkgName[0] === '@') {
+        encodedName = `@${encodeURIComponent(pkgName.slice(1))}`;
+    }
+    else {
+        encodedName = encodeURIComponent(pkgName);
+    }
+    return new url_1.default.URL(encodedName, registry.endsWith('/') ? registry : `${registry}/`).toString();
+}
+function isPackument(body) {
+    return typeof body === 'object' && body != null && typeof body.versions === 'object' && body.versions != null;
+}
+function isPackageSignature(signature) {
+    return typeof signature === 'object' && signature != null &&
+        typeof signature.keyid === 'string' &&
+        typeof signature.sig === 'string';
+}
+//# sourceMappingURL=verifyPnpmEngineIdentity.js.map

package/lib/verifyPnpmEngineIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyPnpmEngineIdentity.js","sourceRoot":"","sources":["../src/verifyPnpmEngineIdentity.ts"],"names":[],"mappings":";;;;;AAgCA,8CAEC;AA2CD,4DAuCC;AApHD,oDAA2B;AAC3B,4CAAmB;AACnB,gDAAuB;AACvB,8CAAqB;AACrB,gDAAuB;AAEvB,uCAAuC;AACvC,uCAA0F;AAE1F,mDAAsD;AACtD,mEAAoE;AACpE,+EAAwE;AAGxE,2DAAsD;AAUtD;;;;;;;GAOG;AACH,SAAgB,iBAAiB;IAC/B,OAAO,oCAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AAChD,CAAC;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,aAAqB,EACrB,WAAmB,EACnB,IAAqC;IAErC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,EAAE,CAAA;IAC3D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM,CAAC,wCAAwC;IAE7E,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAkB,EAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,iBAAS,CACjB,mCAAmC,EACnC,sCAAsC,WAAW,uCAAuC,CACzF,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAE/G,MAAM,aAAa,GAAG,IAAA,8CAAwB,EAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC/E,MAAM,iBAAiB,GAAG,IAAA,+BAAuB,EAAC,IAAI,CAAC,CAAA;IAEvD,MAAM,QAAQ,GAA6B,EAAE,CAAA;IAC7C,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QAC5I,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QACrE,CAAC;IACH,CAAC,CAAC,CAAC,CAAA;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEjC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACzF,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAA;IAC3E,MAAM,IAAI,iBAAS,CACjB,eAAe,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,+BAA+B,EACvF,wBAAwB,WAAW,qDAAqD;QACxF,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAChG,mFAAmF,EACnF,EAAE,IAAI,EAAE,+KAA+K,EAAE,CAC1L,CAAA;AACH,CAAC;AAoBD,SAAS,6BAA6B,CACpC,QAAwB,EACxB,QAAgB,EAChB,aAAqB,EACrB,OAAe,EACf,UAAsB;IAEtB,MAAM,QAAQ,GAAG,CAAC,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAA;IACxF,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;QAClC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,aAAa,OAAO,EAAa,CAAC,EAAE,oBAAoB,IAAI,EAAE,CAAA;QACvG,KAAK,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;gBAAE,SAAQ;YACvE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAAwB,EACxB,UAAsB,EACtB,IAAY,EACZ,OAAe;IAEf,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAa,CAAC,EAAE,UAAU,CAAA;IACnF,MAAM,SAAS,GAAI,UAAkD,EAAE,SAAS,CAAA;IAChF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAChD,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,IAAI,iBAAS,CACjB,mCAAmC,EACnC,iCAAiC,IAAI,IAAI,OAAO,+DAA+D,CAChH,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAA,kDAAsB,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,CAAA;AACzF,CAAC;AA2BD,KAAK,UAAU,oBAAoB,CACjC,GAA6B,EAC7B,WAA0B,EAC1B,GAA0B;IAE1B,IAAI,SAAgC,CAAA;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,yEAAyE;QACzE,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,cAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAA;IAC9H,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,wBAAwB,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAE9H,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,qBAAqB,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAExI,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAA;IAC9C,IAAI,aAAa,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,8CAA8C,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAChH,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,IAAI,EAAE,CAAA;IACtC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,8CAA8C,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAChH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,4BAA4B,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/F,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,OAAO,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;AAC7F,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAA6B,EAC7B,GAA0B;IAE1B,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAA;IAClF,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAEjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAAC,YAAY,EAAE;QACzD,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC;QAC/C,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAS,CACjB,sCAAsC,EACtC,8BAA8B,oBAAoB,CAAC,YAAY,CAAC,oBAAoB,QAAQ,CAAC,MAAM,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAChJ,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC3C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAS,CACjB,sCAAsC,EACtC,8BAA8B,oBAAoB,CAAC,YAAY,CAAC,yEAAyE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAC/L,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,yDAAyD;AACzD,6EAA6E;AAC7E,kCAAkC;AAClC,SAAS,oBAAoB,CAAE,MAAc;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,aAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAA;QACpB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAA;QACpB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAE,IAAY;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,qCAAqC,EAAE,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAA6B,EAC7B,WAA+B,EAC/B,UAA8B,EAC9B,IAAmB;IAEnB,wEAAwE;IACxE,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,SAAS,EAAE,CAAA;IAC7D,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvE,uEAAuE;IACvE,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,yBAAyB;IACzB,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,CAAA;QAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,wCAAwC,SAAS,CAAC,KAAK,+CAA+C,CAAC,CAAA;YAC/I,SAAQ;QACV,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,yDAAyD;QACzD,IAAI,GAAG,CAAC,OAAO,IAAI,aAAa,IAAI,IAAI,IAAI,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,wCAAwC,SAAS,CAAC,KAAK,iDAAiD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC9J,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,+BAA+B,GAAG,CAAC,GAAG,4BAA4B,CAAA;QAC9E,2EAA2E;QAC3E,yEAAyE;QACzE,oDAAoD;QACpD,IAAI,QAAiB,CAAA;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,gBAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;YAC9C,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACvB,QAAQ,CAAC,GAAG,EAAE,CAAA;YACd,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,KAAK,CAAA;QAClB,CAAC;QACD,IAAI,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,iDAAiD,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7G,CAAC;IACD,yEAAyE;IACzE,6EAA6E;IAC7E,YAAY;IACZ,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QACvF,QAAQ,CAAC,CAAC,CAAC;QACX,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,+CAA+C,CAAA;IAC3E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AACxC,CAAC;AAED,SAAS,KAAK,CAAE,OAAe,EAAE,QAAgB;IAC/C,IAAI,WAAmB,CAAA;IACvB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACvB,WAAW,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,aAAG,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;AAChG,CAAC;AAED,SAAS,WAAW,CAAE,IAAa;IACjC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,IAAI,OAAQ,IAAkB,CAAC,QAAQ,KAAK,QAAQ,IAAK,IAAkB,CAAC,QAAQ,IAAI,IAAI,CAAA;AAC7I,CAAC;AAED,SAAS,kBAAkB,CAAE,SAAkB;IAC7C,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI;QACvD,OAAQ,SAA8B,CAAC,KAAK,KAAK,QAAQ;QACzD,OAAQ,SAA8B,CAAC,GAAG,KAAK,QAAQ,CAAA;AAC3D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/tools.plugin-commands-self-updater",
-  "version": "1000.1.57",
+  "version": "1000.1.59",
   "description": "A command for updating pnpm itself",
   "keywords": [
     "pnpm",
@@ -30,15 +30,21 @@
     "render-help": "^1.0.3",
     "semver": "^7.7.4",
     "symlink-dir": "^6.0.5",
-    "@pnpm/cli-meta": "1000.0.16",
-    "@pnpm/cli-utils": "1001.3.11",
-    "@pnpm/config": "1004.11.1",
-    "@pnpm/error": "1000.1.0",
-    "@pnpm/client": "1001.1.25",
+    "@pnpm/cli-meta": "1000.0.17",
+    "@pnpm/client": "1001.1.27",
+    "@pnpm/config": "1004.11.3",
     "@pnpm/exec.pnpm-cli-runner": "1000.1.0",
-    "@pnpm/read-project-manifest": "1001.2.6",
+    "@pnpm/link-bins": "1000.3.9",
+    "@pnpm/error": "1000.1.0",
+    "@pnpm/fetch": "1001.0.1",
+    "@pnpm/cli-utils": "1001.3.13",
+    "@pnpm/lockfile.fs": "1001.1.35",
+    "@pnpm/lockfile.types": "1002.1.2",
+    "@pnpm/network.auth-header": "1001.0.0",
+    "@pnpm/pick-registry-for-package": "1000.0.17",
+    "@pnpm/read-project-manifest": "1001.2.7",
     "@pnpm/tools.path": "1000.0.0",
-    "@pnpm/link-bins": "1000.3.8"
+    "@pnpm/types": "1001.3.1"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1001.0.1"
@@ -50,9 +56,9 @@
     "@types/semver": "7.5.3",
     "cross-spawn": "^7.0.6",
     "nock": "13.3.4",
+    "@pnpm/prepare": "1000.0.18",
     "@pnpm/env.path": "1000.0.0",
-    "@pnpm/prepare": "1000.0.17",
-    "@pnpm/tools.plugin-commands-self-updater": "1000.1.57"
+    "@pnpm/tools.plugin-commands-self-updater": "1000.1.59"
   },
   "engines": {
     "node": ">=18.12"