@push.rocks/smartlinuxrepo 0.0.0-stage → 0.1.0

package/dist_ts/signing/openpgpframing.js

@@ -0,0 +1,93 @@
+import { LinuxRepoError } from '../shared/errors.js';
+import { assertAsyncIterable, assertBytes, assertString, assertTimestamp } from '../shared/validation.js';
+import { singleChunk } from './signers.js';
+/**
+ * The OpenPGP framing the codec owns: only the bytes of the signature packet
+ * may vary; framing and armor are deterministic.
+ * Armor has no headers, 64-column base64 and a CRC-24 line.
+ */
+const BASE64_LINE = 64;
+/**
+ * Signs the concatenation of the chunks of `data` and returns the signer's
+ * binary packet unchanged (Arch `.sig`, RPM header tags). The signer reads
+ * `data` to its end exactly once.
+ */
+export async function createDetachedBinarySignature(inputArg) {
+    assertAsyncIterable(inputArg.data, 'data');
+    assertTimestamp(inputArg.timestamp);
+    const packet = await inputArg.signer.signBinary(inputArg.data, inputArg.timestamp);
+    assertSignatureBytes(packet);
+    return packet;
+}
+/** Signs `data` and returns an armored detached signature (`Release.gpg`, `repomd.xml.asc`). */
+export async function createDetachedArmoredSignature(inputArg) {
+    assertBytes(inputArg.data, 'data');
+    return armorSignature(await createDetachedBinarySignature({
+        data: singleChunk(inputArg.data),
+        signer: inputArg.signer,
+        timestamp: inputArg.timestamp,
+    }));
+}
+/**
+ * Cleartext-signs `text` (`InRelease`). The text must be canonical: no CR and
+ * no trailing spaces or tabs on any line. The signed text is `text` without
+ * its final line break; the output always ends the text with one line break
+ * before the signature block, as GnuPG and Go do. Lines starting with `-` are
+ * dash-escaped. The header is always `Hash: SHA256`.
+ */
+export async function createCleartextSignedMessage(inputArg) {
+    assertCanonicalText(inputArg.text);
+    assertTimestamp(inputArg.timestamp);
+    const signedText = inputArg.text.endsWith('\n') ? inputArg.text.slice(0, -1) : inputArg.text;
+    const packet = await inputArg.signer.signText(signedText, inputArg.timestamp);
+    assertSignatureBytes(packet);
+    const body = `${signedText}\n`.replace(/^-/gm, '- -');
+    return `-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n${body}${armorSignature(packet)}`;
+}
+/** ASCII armor for one signature packet list. */
+export function armorSignature(packetArg) {
+    const base64 = Buffer.from(packetArg.buffer, packetArg.byteOffset, packetArg.byteLength).toString('base64');
+    const lines = [];
+    for (let offset = 0; offset < base64.length; offset += BASE64_LINE) {
+        lines.push(base64.slice(offset, offset + BASE64_LINE));
+    }
+    return [
+        '-----BEGIN PGP SIGNATURE-----',
+        '',
+        ...lines,
+        `=${crc24Base64(packetArg)}`,
+        '-----END PGP SIGNATURE-----',
+        '',
+    ].join('\n');
+}
+/** Refuses text that is not canonical cleartext input. */
+export function assertCanonicalText(textArg) {
+    assertString(textArg, 'text');
+    if (textArg.includes('\r')) {
+        throw new LinuxRepoError('invalid-input', 'cleartext must use LF line endings', { field: 'text' });
+    }
+    if (/[ \t]$/m.test(textArg)) {
+        throw new LinuxRepoError('invalid-input', 'cleartext lines must not end with spaces or tabs', { field: 'text' });
+    }
+}
+function assertSignatureBytes(packetArg) {
+    if (!(packetArg instanceof Uint8Array) || packetArg.length === 0) {
+        throw new LinuxRepoError('signing-failed', 'the signer returned no signature bytes', { field: 'signer' });
+    }
+}
+/** RFC 4880 section 6.1 CRC-24, base64-encoded. */
+function crc24Base64(bytesArg) {
+    let crc = 0xb704ce;
+    for (let i = 0; i < bytesArg.length; i++) {
+        crc ^= bytesArg[i] << 16;
+        for (let bit = 0; bit < 8; bit++) {
+            crc <<= 1;
+            if (crc & 0x1000000) {
+                crc ^= 0x1864cfb;
+            }
+        }
+    }
+    crc &= 0xffffff;
+    return Buffer.from([(crc >> 16) & 0xff, (crc >> 8) & 0xff, crc & 0xff]).toString('base64');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3BlbnBncGZyYW1pbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9zaWduaW5nL29wZW5wZ3BmcmFtaW5nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNyRCxPQUFPLEVBQUUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxlQUFlLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUMxRyxPQUFPLEVBQUUsV0FBVyxFQUF1QixNQUFNLGNBQWMsQ0FBQztBQUVoRTs7OztHQUlHO0FBRUgsTUFBTSxXQUFXLEdBQUcsRUFBRSxDQUFDO0FBRXZCOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLDZCQUE2QixDQUFDLFFBSW5EO0lBQ0MsbUJBQW1CLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMzQyxlQUFlLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDbkYsb0JBQW9CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDN0IsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELGdHQUFnRztBQUNoRyxNQUFNLENBQUMsS0FBSyxVQUFVLDhCQUE4QixDQUFDLFFBSXBEO0lBQ0MsV0FBVyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDbkMsT0FBTyxjQUFjLENBQ25CLE1BQU0sNkJBQTZCLENBQUM7UUFDbEMsSUFBSSxFQUFFLFdBQVcsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO1FBQ2hDLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTTtRQUN2QixTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVM7S0FDOUIsQ0FBQyxDQUNILENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSw0QkFBNEIsQ0FBQyxRQUlsRDtJQUNDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNuQyxlQUFlLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sVUFBVSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztJQUM3RixNQUFNLE1BQU0sR0FBRyxNQUFNLFFBQVEsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUUsb0JBQW9CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDN0IsTUFBTSxJQUFJLEdBQUcsR0FBRyxVQUFVLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3RELE9BQU8sdURBQXVELElBQUksR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztBQUNoRyxDQUFDO0FBRUQsaURBQWlEO0FBQ2pELE1BQU0sVUFBVSxjQUFjLENBQUMsU0FBcUI7SUFDbEQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLFNBQVMsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUM1RyxNQUFNLEtBQUssR0FBYSxFQUFFLENBQUM7SUFDM0IsS0FBSyxJQUFJLE1BQU0sR0FBRyxDQUFDLEVBQUUsTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLEVBQUUsTUFBTSxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ25FLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE9BQU87UUFDTCwrQkFBK0I7UUFDL0IsRUFBRTtRQUNGLEdBQUcsS0FBSztRQUNSLElBQUksV0FBVyxDQUFDLFNBQVMsQ0FBQyxFQUFFO1FBQzVCLDZCQUE2QjtRQUM3QixFQUFFO0tBQ0gsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDZixDQUFDO0FBRUQsMERBQTBEO0FBQzFELE1BQU0sVUFBVSxtQkFBbUIsQ0FBQyxPQUFnQjtJQUNsRCxZQUFZLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzlCLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLG9DQUFvQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQzVCLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLGtEQUFrRCxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDbkgsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLG9CQUFvQixDQUFDLFNBQWtCO0lBQzlDLElBQUksQ0FBQyxDQUFDLFNBQVMsWUFBWSxVQUFVLENBQUMsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sSUFBSSxjQUFjLENBQUMsZ0JBQWdCLEVBQUUsd0NBQXdDLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM1RyxDQUFDO0FBQ0gsQ0FBQztBQUVELG1EQUFtRDtBQUNuRCxTQUFTLFdBQVcsQ0FBQyxRQUFvQjtJQUN2QyxJQUFJLEdBQUcsR0FBRyxRQUFRLENBQUM7SUFDbkIsS0FBSyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUN6QyxHQUFHLElBQUksUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN6QixLQUFLLElBQUksR0FBRyxHQUFHLENBQUMsRUFBRSxHQUFHLEdBQUcsQ0FBQyxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDakMsR0FBRyxLQUFLLENBQUMsQ0FBQztZQUNWLElBQUksR0FBRyxHQUFHLFNBQVMsRUFBRSxDQUFDO2dCQUNwQixHQUFHLElBQUksU0FBUyxDQUFDO1lBQ25CLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUNELEdBQUcsSUFBSSxRQUFRLENBQUM7SUFDaEIsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLElBQUksRUFBRSxDQUFDLEdBQUcsSUFBSSxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxHQUFHLElBQUksRUFBRSxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDN0YsQ0FBQyJ9

package/dist_ts/signing/signers.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Signs Alpine indexes. Consumers may implement it; adding a required member
+ * later needs a major release.
+ */
+export interface IAlpineSigner {
+    /**
+     * The key name apk looks up in `/etc/apk/keys`; the index signature entry is
+     * `.SIGN.RSA.<keyName>`. Gitea's form is `<owner>@<sha256 hex of the SPKI
+     * DER public key>.rsa.pub` (see `giteaAlpineKeyName`).
+     */
+    readonly keyName: string;
+    /** RSASSA-PKCS1-v1_5 over SHA-1 of `data`; returns the raw signature bytes. */
+    sign(data: Uint8Array): Promise<Uint8Array>;
+}
+/**
+ * Signs Debian, RPM and Arch documents. Consumers may implement it; adding a
+ * required member later needs a major release.
+ *
+ * Contract: each call returns exactly one binary OpenPGP v4 signature packet
+ * (packet header included, no armor), hashed with SHA-256, whose creation time
+ * is `timestamp` (whole seconds). The codec does all framing (armor, cleartext
+ * dash-escaping, the `Hash: SHA256` header) and treats the packet as opaque.
+ */
+export interface IOpenPgpSigner {
+    /**
+     * A signature of type 0x00 (binary document) over the concatenation of the
+     * chunks of `data`. The signer reads `data` to its end exactly once.
+     */
+    signBinary(data: AsyncIterable<Uint8Array>, timestamp: Date): Promise<Uint8Array>;
+    /**
+     * A signature of type 0x01 (canonical text document) over `text`. The codec
+     * passes canonical text only: LF line endings and no trailing spaces or tabs
+     * on any line; the signature hashes it with CRLF line endings.
+     */
+    signText(text: string, timestamp: Date): Promise<Uint8Array>;
+}
+/**
+ * Builds an Alpine signer from an unencrypted RSA private key in PEM form:
+ * PKCS#1 (`RSA PRIVATE KEY`, Gitea's stored form) or PKCS#8 (`PRIVATE KEY`).
+ * Anything else is `invalid-key`. Signatures are deterministic.
+ */
+export declare function createAlpineSigner(inputArg: {
+    privateKeyPem: string;
+    keyName: string;
+}): IAlpineSigner;
+/**
+ * Builds an OpenPGP signer from an armored private key: exactly one key,
+ * OpenPGP v4, not encrypted, able to sign. Anything else is `invalid-key`.
+ * Signatures are SHA-256 and keep openpgp.js's salt notation, so their bytes
+ * vary per call; the produced packet is checked against the signer contract.
+ *
+ * The factory makes one trial `signBinary` and refuses the key with
+ * `invalid-key` when it fails, so a key that cannot meet the contract at all
+ * (one whose curve makes openpgp.js choose a stronger hash than SHA-256) is
+ * refused here. The trial signs at the latest creation time of the key, its
+ * subkeys and their self-signatures; a failure that depends on the signing
+ * time stays `signing-failed` at signing time.
+ */
+export declare function createOpenPgpSigner(inputArg: {
+    privateKeyArmored: string;
+}): Promise<IOpenPgpSigner>;
+/** `bytesArg` as a one-chunk source, for callers that hold the whole document. */
+export declare function singleChunk(bytesArg: Uint8Array): AsyncGenerator<Uint8Array>;

package/dist_ts/signing/signers.js

@@ -0,0 +1,248 @@
+import * as plugins from '../plugins.js';
+import { concatBytes } from '../readers/bytes.js';
+import { LinuxRepoError } from '../shared/errors.js';
+import { assertAsyncIterable, assertBytes, assertSegmentName, assertString, assertTimestamp, } from '../shared/validation.js';
+const ALPINE_PRIVATE_KEY_LABELS = ['RSA PRIVATE KEY', 'PRIVATE KEY'];
+/**
+ * Builds an Alpine signer from an unencrypted RSA private key in PEM form:
+ * PKCS#1 (`RSA PRIVATE KEY`, Gitea's stored form) or PKCS#8 (`PRIVATE KEY`).
+ * Anything else is `invalid-key`. Signatures are deterministic.
+ */
+export function createAlpineSigner(inputArg) {
+    if (inputArg === null || typeof inputArg !== 'object') {
+        throw new LinuxRepoError('invalid-input', 'input must be an object', { field: 'input' });
+    }
+    assertString(inputArg.privateKeyPem, 'privateKeyPem');
+    assertSegmentName(inputArg.keyName, 'keyName');
+    const label = /-----BEGIN ([A-Z0-9 ]+)-----/.exec(inputArg.privateKeyPem)?.[1];
+    if (label === undefined || !ALPINE_PRIVATE_KEY_LABELS.includes(label)) {
+        throw new LinuxRepoError('invalid-key', 'the Alpine key must be an unencrypted PKCS#1 or PKCS#8 RSA private key PEM', {
+            field: 'privateKeyPem',
+        });
+    }
+    let key;
+    try {
+        key = plugins.crypto.createPrivateKey({ key: inputArg.privateKeyPem, format: 'pem' });
+    }
+    catch (error) {
+        throw new LinuxRepoError('invalid-key', 'the Alpine private key cannot be read', { field: 'privateKeyPem' }, {
+            cause: error,
+        });
+    }
+    if (key.asymmetricKeyType !== 'rsa') {
+        throw new LinuxRepoError('invalid-key', 'the Alpine key must be an RSA key', { field: 'privateKeyPem' });
+    }
+    const keyName = inputArg.keyName;
+    return {
+        keyName,
+        sign: async (data) => {
+            assertBytes(data, 'data');
+            try {
+                const signature = plugins.crypto.sign('sha1', data, {
+                    key,
+                    padding: plugins.crypto.constants.RSA_PKCS1_PADDING,
+                });
+                return new Uint8Array(signature.buffer, signature.byteOffset, signature.byteLength);
+            }
+            catch (error) {
+                throw new LinuxRepoError('signing-failed', 'RSA PKCS#1 v1.5 SHA-1 signing failed', { field: 'keyName' }, {
+                    cause: error,
+                });
+            }
+        },
+    };
+}
+/**
+ * Builds an OpenPGP signer from an armored private key: exactly one key,
+ * OpenPGP v4, not encrypted, able to sign. Anything else is `invalid-key`.
+ * Signatures are SHA-256 and keep openpgp.js's salt notation, so their bytes
+ * vary per call; the produced packet is checked against the signer contract.
+ *
+ * The factory makes one trial `signBinary` and refuses the key with
+ * `invalid-key` when it fails, so a key that cannot meet the contract at all
+ * (one whose curve makes openpgp.js choose a stronger hash than SHA-256) is
+ * refused here. The trial signs at the latest creation time of the key, its
+ * subkeys and their self-signatures; a failure that depends on the signing
+ * time stays `signing-failed` at signing time.
+ */
+export async function createOpenPgpSigner(inputArg) {
+    if (inputArg === null || typeof inputArg !== 'object') {
+        throw new LinuxRepoError('invalid-input', 'input must be an object', { field: 'input' });
+    }
+    assertString(inputArg.privateKeyArmored, 'privateKeyArmored');
+    // openpgp.js reads the first armor block and ignores anything after it
+    const armorBlocks = inputArg.privateKeyArmored.match(/^-----BEGIN PGP [A-Z ,/0-9]+-----\s*$/gm) ?? [];
+    if (armorBlocks.length > 1) {
+        throw new LinuxRepoError('invalid-key', `expected one armored OpenPGP private key block, got ${armorBlocks.length}`, {
+            field: 'privateKeyArmored',
+        });
+    }
+    let keys;
+    try {
+        keys = await plugins.openpgp.readPrivateKeys({ armoredKeys: inputArg.privateKeyArmored });
+    }
+    catch (error) {
+        throw new LinuxRepoError('invalid-key', 'the OpenPGP private key cannot be read', { field: 'privateKeyArmored' }, {
+            cause: error,
+        });
+    }
+    if (keys.length !== 1) {
+        throw new LinuxRepoError('invalid-key', `expected exactly one OpenPGP private key, got ${keys.length}`, {
+            field: 'privateKeyArmored',
+        });
+    }
+    const key = keys[0];
+    if (key.keyPacket.version !== 4) {
+        throw new LinuxRepoError('invalid-key', `only OpenPGP v4 keys are accepted, got v${key.keyPacket.version}`, {
+            field: 'privateKeyArmored',
+        });
+    }
+    if (!key.isDecrypted()) {
+        throw new LinuxRepoError('invalid-key', 'encrypted OpenPGP keys are not accepted', { field: 'privateKeyArmored' });
+    }
+    const sign = async (produceArg, timestampArg, signatureTypeArg, inputFailureArg = () => undefined) => {
+        let packet;
+        try {
+            packet = await produceArg();
+        }
+        catch (error) {
+            // an invalid chunk or the caller's own source error, not a signing failure
+            const inputFailure = inputFailureArg();
+            if (inputFailure !== undefined) {
+                throw inputFailure.error;
+            }
+            throw new LinuxRepoError('signing-failed', 'OpenPGP signing failed', { field: 'signingKey' }, { cause: error });
+        }
+        await assertSignaturePacket(packet, timestampArg, signatureTypeArg);
+        return packet;
+    };
+    const config = { preferredHashAlgorithm: plugins.openpgp.enums.hash.sha256 };
+    const signer = {
+        signBinary: async (data, timestamp) => {
+            assertAsyncIterable(data, 'data');
+            assertTimestamp(timestamp);
+            const source = new CheckedChunkSource(data);
+            return sign(async () => {
+                const signature = await plugins.openpgp.sign({
+                    message: await plugins.openpgp.createMessage({ binary: source.toReadableStream() }),
+                    signingKeys: key,
+                    detached: true,
+                    format: 'binary',
+                    date: timestamp,
+                    config,
+                });
+                const packet = await readAll(signature);
+                if (!source.ended) {
+                    throw new Error('openpgp.js returned a signature before reading the data to its end');
+                }
+                return packet;
+            }, timestamp, plugins.openpgp.enums.signature.binary, () => source.failure);
+        },
+        signText: async (text, timestamp) => {
+            assertString(text, 'text');
+            assertTimestamp(timestamp);
+            return sign(async () => plugins.openpgp.sign({
+                message: await plugins.openpgp.createMessage({ text }),
+                signingKeys: key,
+                detached: true,
+                format: 'binary',
+                date: timestamp,
+                config,
+            }), timestamp, plugins.openpgp.enums.signature.text);
+        },
+    };
+    try {
+        await signer.signBinary(singleChunk(new Uint8Array(0)), latestKeyTime(key));
+    }
+    catch (error) {
+        throw new LinuxRepoError('invalid-key', 'the OpenPGP key cannot sign a v4 SHA-256 signature', { field: 'privateKeyArmored' }, {
+            cause: error,
+        });
+    }
+    return signer;
+}
+/** `bytesArg` as a one-chunk source, for callers that hold the whole document. */
+export async function* singleChunk(bytesArg) {
+    yield bytesArg;
+}
+/**
+ * Pulls the caller's source with `next()` only (never `return()` or
+ * `throw()`, so a cancelled stream never cancels the source), refuses a chunk
+ * that is not a `Uint8Array` with `invalid-input`, and records the first
+ * error it raised or met so the signer can rethrow it unchanged.
+ */
+class CheckedChunkSource {
+    ended = false;
+    failure = undefined;
+    source;
+    constructor(sourceArg) {
+        this.source = sourceArg;
+    }
+    toReadableStream() {
+        const iterator = this.source[Symbol.asyncIterator]();
+        const next = async () => {
+            let result;
+            try {
+                result = await iterator.next();
+            }
+            catch (error) {
+                this.failure ??= { error };
+                throw error;
+            }
+            if (result.done === true) {
+                this.ended = true;
+                return { done: true, value: undefined };
+            }
+            if (!(result.value instanceof Uint8Array)) {
+                const error = new LinuxRepoError('invalid-input', 'every chunk of data must be a Uint8Array', { field: 'data' });
+                this.failure ??= { error };
+                throw error;
+            }
+            return { done: false, value: result.value };
+        };
+        return plugins.streamWeb.ReadableStream.from({ [Symbol.asyncIterator]: () => ({ next }) });
+    }
+}
+/** Reads openpgp.js's streamed output to its end. */
+async function readAll(streamArg) {
+    const reader = streamArg.getReader();
+    const chunks = [];
+    let total = 0;
+    for (let result = await reader.read(); !result.done; result = await reader.read()) {
+        chunks.push(result.value);
+        total += result.value.length;
+    }
+    return concatBytes(chunks, total);
+}
+/** The latest creation time of the key, its subkeys and their self-signatures: the key's current state applies. */
+function latestKeyTime(keyArg) {
+    const times = [keyArg.getCreationTime().getTime()];
+    for (const user of keyArg.users) {
+        for (const signature of user.selfCertifications) {
+            times.push(signature.created?.getTime() ?? 0);
+        }
+    }
+    for (const subkey of keyArg.subkeys) {
+        times.push(subkey.getCreationTime().getTime());
+        for (const signature of subkey.bindingSignatures) {
+            times.push(signature.created?.getTime() ?? 0);
+        }
+    }
+    return new Date(Math.max(...times));
+}
+/** Checks that openpgp.js produced exactly the packet the signer contract promises. */
+async function assertSignaturePacket(packetArg, timestampArg, signatureTypeArg) {
+    const signature = await plugins.openpgp.readSignature({ binarySignature: packetArg });
+    const packets = signature.packets;
+    const expectedSeconds = Math.floor(timestampArg.getTime() / 1000);
+    const ok = packets.length === 1 &&
+        packets[0].version === 4 &&
+        packets[0].signatureType === signatureTypeArg &&
+        packets[0].hashAlgorithm === plugins.openpgp.enums.hash.sha256 &&
+        packets[0].created !== null &&
+        Math.floor(packets[0].created.getTime() / 1000) === expectedSeconds;
+    if (!ok) {
+        throw new LinuxRepoError('signing-failed', 'the signing key cannot produce one v4 SHA-256 signature packet at the requested time', { field: 'signingKey' });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbmVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3NpZ25pbmcvc2lnbmVycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUN6QyxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDbEQsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ3JELE9BQU8sRUFDTCxtQkFBbUIsRUFDbkIsV0FBVyxFQUNYLGlCQUFpQixFQUNqQixZQUFZLEVBQ1osZUFBZSxHQUNoQixNQUFNLHlCQUF5QixDQUFDO0FBd0NqQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsaUJBQWlCLEVBQUUsYUFBYSxDQUFDLENBQUM7QUFFckU7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxrQkFBa0IsQ0FBQyxRQUFvRDtJQUNyRixJQUFJLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDdEQsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUseUJBQXlCLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUMzRixDQUFDO0lBQ0QsWUFBWSxDQUFDLFFBQVEsQ0FBQyxhQUFhLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDdEQsaUJBQWlCLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsQ0FBQztJQUMvQyxNQUFNLEtBQUssR0FBRyw4QkFBOEIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDL0UsSUFBSSxLQUFLLEtBQUssU0FBUyxJQUFJLENBQUMseUJBQXlCLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDdEUsTUFBTSxJQUFJLGNBQWMsQ0FBQyxhQUFhLEVBQUUsNEVBQTRFLEVBQUU7WUFDcEgsS0FBSyxFQUFFLGVBQWU7U0FDdkIsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELElBQUksR0FBNkIsQ0FBQztJQUNsQyxJQUFJLENBQUM7UUFDSCxHQUFHLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLEdBQUcsRUFBRSxRQUFRLENBQUMsYUFBYSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLGNBQWMsQ0FBQyxhQUFhLEVBQUUsdUNBQXVDLEVBQUUsRUFBRSxLQUFLLEVBQUUsZUFBZSxFQUFFLEVBQUU7WUFDM0csS0FBSyxFQUFFLEtBQUs7U0FDYixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsSUFBSSxHQUFHLENBQUMsaUJBQWlCLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDcEMsTUFBTSxJQUFJLGNBQWMsQ0FBQyxhQUFhLEVBQUUsbUNBQW1DLEVBQUUsRUFBRSxLQUFLLEVBQUUsZUFBZSxFQUFFLENBQUMsQ0FBQztJQUMzRyxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQztJQUNqQyxPQUFPO1FBQ0wsT0FBTztRQUNQLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBZ0IsRUFBdUIsRUFBRTtZQUNwRCxXQUFXLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQzFCLElBQUksQ0FBQztnQkFDSCxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFO29CQUNsRCxHQUFHO29CQUNILE9BQU8sRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxpQkFBaUI7aUJBQ3BELENBQUMsQ0FBQztnQkFDSCxPQUFPLElBQUksVUFBVSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLFVBQVUsRUFBRSxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDdEYsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsTUFBTSxJQUFJLGNBQWMsQ0FBQyxnQkFBZ0IsRUFBRSxzQ0FBc0MsRUFBRSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRTtvQkFDdkcsS0FBSyxFQUFFLEtBQUs7aUJBQ2IsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztRQUNILENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7R0FZRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsbUJBQW1CLENBQUMsUUFBdUM7SUFDL0UsSUFBSSxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3RELE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLHlCQUF5QixFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDM0YsQ0FBQztJQUNELFlBQVksQ0FBQyxRQUFRLENBQUMsaUJBQWlCLEVBQUUsbUJBQW1CLENBQUMsQ0FBQztJQUM5RCx1RUFBdUU7SUFDdkUsTUFBTSxXQUFXLEdBQUcsUUFBUSxDQUFDLGlCQUFpQixDQUFDLEtBQUssQ0FBQyx5Q0FBeUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN0RyxJQUFJLFdBQVcsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDM0IsTUFBTSxJQUFJLGNBQWMsQ0FBQyxhQUFhLEVBQUUsdURBQXVELFdBQVcsQ0FBQyxNQUFNLEVBQUUsRUFBRTtZQUNuSCxLQUFLLEVBQUUsbUJBQW1CO1NBQzNCLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDRCxJQUFJLElBQWtDLENBQUM7SUFDdkMsSUFBSSxDQUFDO1FBQ0gsSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQUMsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLGlCQUFpQixFQUFFLENBQUMsQ0FBQztJQUM1RixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE1BQU0sSUFBSSxjQUFjLENBQUMsYUFBYSxFQUFFLHdDQUF3QyxFQUFFLEVBQUUsS0FBSyxFQUFFLG1CQUFtQixFQUFFLEVBQUU7WUFDaEgsS0FBSyxFQUFFLEtBQUs7U0FDYixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3RCLE1BQU0sSUFBSSxjQUFjLENBQUMsYUFBYSxFQUFFLGlEQUFpRCxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUU7WUFDdEcsS0FBSyxFQUFFLG1CQUFtQjtTQUMzQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BCLElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxPQUFPLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDaEMsTUFBTSxJQUFJLGNBQWMsQ0FBQyxhQUFhLEVBQUUsMkNBQTJDLEdBQUcsQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLEVBQUU7WUFDMUcsS0FBSyxFQUFFLG1CQUFtQjtTQUMzQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sSUFBSSxjQUFjLENBQUMsYUFBYSxFQUFFLHlDQUF5QyxFQUFFLEVBQUUsS0FBSyxFQUFFLG1CQUFtQixFQUFFLENBQUMsQ0FBQztJQUNySCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsS0FBSyxFQUNoQixVQUFxQyxFQUNyQyxZQUFrQixFQUNsQixnQkFBd0IsRUFDeEIsZUFBZSxHQUF5QyxHQUFHLEVBQUUsQ0FBQyxTQUFTLEVBQ2xELEVBQUU7UUFDdkIsSUFBSSxNQUFrQixDQUFDO1FBQ3ZCLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxNQUFNLFVBQVUsRUFBRSxDQUFDO1FBQzlCLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsMkVBQTJFO1lBQzNFLE1BQU0sWUFBWSxHQUFHLGVBQWUsRUFBRSxDQUFDO1lBQ3ZDLElBQUksWUFBWSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUMvQixNQUFNLFlBQVksQ0FBQyxLQUFLLENBQUM7WUFDM0IsQ0FBQztZQUNELE1BQU0sSUFBSSxjQUFjLENBQUMsZ0JBQWdCLEVBQUUsd0JBQXdCLEVBQUUsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNsSCxDQUFDO1FBQ0QsTUFBTSxxQkFBcUIsQ0FBQyxNQUFNLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixDQUFDLENBQUM7UUFDcEUsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxNQUFNLEdBQUcsRUFBRSxzQkFBc0IsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDN0UsTUFBTSxNQUFNLEdBQW1CO1FBQzdCLFVBQVUsRUFBRSxLQUFLLEVBQUUsSUFBK0IsRUFBRSxTQUFlLEVBQXVCLEVBQUU7WUFDMUYsbUJBQW1CLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2xDLGVBQWUsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUMzQixNQUFNLE1BQU0sR0FBRyxJQUFJLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVDLE9BQU8sSUFBSSxDQUNULEtBQUssSUFBSSxFQUFFO2dCQUNULE1BQU0sU0FBUyxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7b0JBQzNDLE9BQU8sRUFBRSxNQUFNLE9BQU8sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxnQkFBZ0IsRUFBRSxFQUFFLENBQUM7b0JBQ25GLFdBQVcsRUFBRSxHQUFHO29CQUNoQixRQUFRLEVBQUUsSUFBSTtvQkFDZCxNQUFNLEVBQUUsUUFBUTtvQkFDaEIsSUFBSSxFQUFFLFNBQVM7b0JBQ2YsTUFBTTtpQkFDUCxDQUFDLENBQUM7Z0JBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQ3hDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7b0JBQ2xCLE1BQU0sSUFBSSxLQUFLLENBQUMsb0VBQW9FLENBQUMsQ0FBQztnQkFDeEYsQ0FBQztnQkFDRCxPQUFPLE1BQU0sQ0FBQztZQUNoQixDQUFDLEVBQ0QsU0FBUyxFQUNULE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQ3RDLEdBQUcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQ3JCLENBQUM7UUFDSixDQUFDO1FBQ0QsUUFBUSxFQUFFLEtBQUssRUFBRSxJQUFZLEVBQUUsU0FBZSxFQUF1QixFQUFFO1lBQ3JFLFlBQVksQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDM0IsZUFBZSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQzNCLE9BQU8sSUFBSSxDQUNULEtBQUssSUFBSSxFQUFFLENBQ1QsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7Z0JBQ25CLE9BQU8sRUFBRSxNQUFNLE9BQU8sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUM7Z0JBQ3RELFdBQVcsRUFBRSxHQUFHO2dCQUNoQixRQUFRLEVBQUUsSUFBSTtnQkFDZCxNQUFNLEVBQUUsUUFBUTtnQkFDaEIsSUFBSSxFQUFFLFNBQVM7Z0JBQ2YsTUFBTTthQUNQLENBQUMsRUFDSixTQUFTLEVBQ1QsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FDckMsQ0FBQztRQUNKLENBQUM7S0FDRixDQUFDO0lBQ0YsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLGNBQWMsQ0FBQyxhQUFhLEVBQUUsb0RBQW9ELEVBQUUsRUFBRSxLQUFLLEVBQUUsbUJBQW1CLEVBQUUsRUFBRTtZQUM1SCxLQUFLLEVBQUUsS0FBSztTQUNiLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDO0FBRUQsa0ZBQWtGO0FBQ2xGLE1BQU0sQ0FBQyxLQUFLLFNBQVMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxRQUFvQjtJQUNyRCxNQUFNLFFBQVEsQ0FBQztBQUNqQixDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLGtCQUFrQjtJQUNmLEtBQUssR0FBRyxLQUFLLENBQUM7SUFDZCxPQUFPLEdBQW1DLFNBQVMsQ0FBQztJQUMxQyxNQUFNLENBQXlCO0lBRWhELFlBQVksU0FBaUM7UUFDM0MsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUM7SUFDMUIsQ0FBQztJQUVNLGdCQUFnQjtRQUNyQixNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1FBQ3JELE1BQU0sSUFBSSxHQUFHLEtBQUssSUFBeUMsRUFBRTtZQUMzRCxJQUFJLE1BQStCLENBQUM7WUFDcEMsSUFBSSxDQUFDO2dCQUNILE1BQU0sR0FBRyxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNqQyxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixJQUFJLENBQUMsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUM7Z0JBQzNCLE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztZQUNELElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQztnQkFDekIsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUM7Z0JBQ2xCLE9BQU8sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsQ0FBQztZQUMxQyxDQUFDO1lBQ0QsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssWUFBWSxVQUFVLENBQUMsRUFBRSxDQUFDO2dCQUMxQyxNQUFNLEtBQUssR0FBRyxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsMENBQTBDLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztnQkFDakgsSUFBSSxDQUFDLE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBRSxDQUFDO2dCQUMzQixNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7WUFDRCxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQzlDLENBQUMsQ0FBQztRQUNGLE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFhLEVBQUUsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLENBQUM7Q0FDRjtBQUVELHFEQUFxRDtBQUNyRCxLQUFLLFVBQVUsT0FBTyxDQUFDLFNBQXVEO0lBQzVFLE1BQU0sTUFBTSxHQUFHLFNBQVMsQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUNyQyxNQUFNLE1BQU0sR0FBaUIsRUFBRSxDQUFDO0lBQ2hDLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLEtBQUssSUFBSSxNQUFNLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLE1BQU0sR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1FBQ2xGLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzFCLEtBQUssSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztJQUMvQixDQUFDO0lBQ0QsT0FBTyxXQUFXLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxDQUFDO0FBQ3BDLENBQUM7QUFFRCxtSEFBbUg7QUFDbkgsU0FBUyxhQUFhLENBQUMsTUFBa0M7SUFDdkQsTUFBTSxLQUFLLEdBQUcsQ0FBQyxNQUFNLENBQUMsZUFBZSxFQUFFLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUNuRCxLQUFLLE1BQU0sSUFBSSxJQUFJLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNoQyxLQUFLLE1BQU0sU0FBUyxJQUFJLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1lBQ2hELEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUNoRCxDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxNQUFNLElBQUksTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3BDLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLGVBQWUsRUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDL0MsS0FBSyxNQUFNLFNBQVMsSUFBSSxNQUFNLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUNqRCxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDaEQsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBQ3RDLENBQUM7QUFFRCx1RkFBdUY7QUFDdkYsS0FBSyxVQUFVLHFCQUFxQixDQUFDLFNBQXFCLEVBQUUsWUFBa0IsRUFBRSxnQkFBd0I7SUFDdEcsTUFBTSxTQUFTLEdBQUcsTUFBTSxPQUFPLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ3RGLE1BQU0sT0FBTyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUM7SUFDbEMsTUFBTSxlQUFlLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDbEUsTUFBTSxFQUFFLEdBQ04sT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQ3BCLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLEtBQUssQ0FBQztRQUN4QixPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsYUFBYSxLQUFLLGdCQUFnQjtRQUM3QyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsYUFBYSxLQUFLLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNO1FBQzlELE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLEtBQUssSUFBSTtRQUMzQixJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssZUFBZSxDQUFDO0lBQ3RFLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNSLE1BQU0sSUFBSSxjQUFjLENBQ3RCLGdCQUFnQixFQUNoQixzRkFBc0YsRUFDdEYsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLENBQ3hCLENBQUM7SUFDSixDQUFDO0FBQ0gsQ0FBQyJ9

package/dist_ts/writers/gotar.d.ts

@@ -0,0 +1,43 @@
+export interface IGoTarFile {
+    name: string;
+    mode: number;
+    data: Uint8Array;
+}
+export interface IGoTarWriteOptions {
+    /**
+     * The two zero blocks Go `Writer.Close` writes. `false` for Gitea's Alpine
+     * signature member (`writeGzipStream` with `addTarEnd=false`). Gitea never
+     * calls `Close` there, so Go also leaves the last entry unpadded; the codec
+     * pads every entry to the block regardless (a difference from Gitea).
+     */
+    endOfArchive: boolean;
+}
+/**
+ * The subset of Go 1.27 `archive/tar` `Writer` that Gitea 28.2.0 uses for its
+ * index archives (Arch `services/packages/arch/repository.go:381-399`, Alpine
+ * `services/packages/alpine/repository.go:331-351`): regular files from
+ * `tar.Header{Name, Mode, Size}` with every other field zero, so the zero
+ * `ModTime` is written as 0, uid and gid are 0 and user and group names are
+ * empty.
+ *
+ * Format choice follows Go's `allowedFormats` and `WriteHeader`: USTAR when the
+ * name is ASCII and at most 100 bytes, USTAR with a prefix split when the name
+ * splits, else PAX with one `path` record (refused when the records exceed
+ * Go's 1 MiB `maxSpecialFileSize`, as Go returns `ErrFieldTooLong`).
+ *
+ * Refused with `invalid-input` where Go would not write a regular file in USTAR
+ * or PAX-`path` form:
+ * - a name with NUL (Go fails with an invalid PAX record) or ending with `/`
+ *   (Go refuses it for a regular file; Gitea's untyped header would become a
+ *   directory entry instead);
+ * - a mode outside 7 octal digits (Go falls back to the GNU format);
+ * - a size of 8 GiB or more (Go adds a PAX `size` record; the codec does not);
+ * - a string that is not well-formed UTF-16 (Go strings never carry one).
+ */
+export declare function writeGoTar(filesArg: readonly IGoTarFile[], optionsArg?: IGoTarWriteOptions): Uint8Array;
+/**
+ * The bytes Go `Writer.WriteHeader` writes for a regular file: the main
+ * header block, preceded by a PAX `x` header and its padded records when the
+ * name needs one.
+ */
+export declare function goTarHeader(nameArg: string, modeArg: number, sizeArg: number): Uint8Array;