@push.rocks/smartlinuxrepo 0.0.0-stage → 0.1.0

package/ts/rpm/header.ts

@@ -0,0 +1,628 @@
+import * as plugins from '../plugins.js';
+import { readExact, readUpTo, type IByteReader } from '../readers/bytes.js';
+import { LinuxRepoError, limitExceeded, truncated } from '../shared/errors.js';
+import type { ILinuxPackageLimits } from '../shared/limits.js';
+
+/**
+ * RPM lead and header structures, read the way go-rpmutils v0.4.0 (Gitea
+ * 28.2.0's pin, `go.mod:85`) reads them (`header.go:75-146`,
+ * `rpmutils.go:97-136`), so that a package Gitea accepts is accepted and one
+ * Gitea refuses (or panics on) is refused:
+ * - an index entry of a fixed-size type covers `offset .. offset + size*count`;
+ *   any other type is a run of `count` NUL-terminated strings; an entry that
+ *   does not fit the data is `malformed-header`;
+ * - a later entry with the same tag replaces an earlier one;
+ * - the main header's SHA-256 (signature tag 273), else SHA-1 (269), is
+ *   checked as lowercase hex (`digest-mismatch`).
+ */
+
+export const RPM_LEAD_BYTES = 96;
+const LEAD_MAGIC = [0xed, 0xab, 0xee, 0xdb];
+const HEADER_MAGIC = 0x8eade801;
+const HEADER_INTRO_BYTES = 16;
+const INDEX_ENTRY_BYTES = 16;
+
+/** Header data types. */
+export const RPM_TYPE = {
+  null: 0,
+  char: 1,
+  int8: 2,
+  int16: 3,
+  int32: 4,
+  int64: 5,
+  string: 6,
+  bin: 7,
+  stringArray: 8,
+  i18nString: 9,
+} as const;
+
+/** Element sizes of the fixed-size types (go-rpmutils `typeSizes`); every other type is string-like. */
+const TYPE_SIZES = new Map<number, number>([
+  [RPM_TYPE.null, 0],
+  [RPM_TYPE.char, 1],
+  [RPM_TYPE.int8, 1],
+  [RPM_TYPE.int16, 2],
+  [RPM_TYPE.int32, 4],
+  [RPM_TYPE.int64, 8],
+  [RPM_TYPE.bin, 1],
+]);
+
+/** Data alignment go-rpmutils applies when it writes a header (`typeAlign`). */
+const TYPE_ALIGNMENT = new Map<number, number>([
+  [RPM_TYPE.int16, 2],
+  [RPM_TYPE.int32, 4],
+  [RPM_TYPE.int64, 8],
+]);
+
+/** Signature header tags. */
+export const RPM_SIGNATURE_TAG = {
+  headerSignatures: 62,
+  dsa: 267,
+  rsa: 268,
+  sha1: 269,
+  longArchiveSize: 271,
+  sha256: 273,
+  size: 1000,
+  pgp: 1002,
+  md5: 1004,
+  gpg: 1005,
+  payloadSize: 1007,
+  reservedSpace: 1008,
+} as const;
+
+/** Region tags below this value are dropped when a header is rewritten. */
+const RPM_TAG_HEADER_REGIONS = 64;
+
+/** One index entry with the byte range of its contents in the header data. */
+export interface IRpmHeaderEntry {
+  tag: number;
+  type: number;
+  count: number;
+  start: number;
+  end: number;
+}
+
+/** The value of an integer tag as go-rpmutils `getInts` reads it. */
+export interface IRpmIntegers {
+  /** Element width in bytes: 1, 2, 4 or 8. */
+  width: 1 | 2 | 4 | 8;
+  values: bigint[];
+}
+
+/**
+ * A parsed header: its exact bytes, as read, and its index entries. The index
+ * stays in the header bytes; only the end of each entry's contents is kept
+ * beside it (4 bytes per entry), and finding the end of a string entry may
+ * build a NUL directory of about 3% of the data (`NulIndex`), so a header
+ * costs little more than its own bytes: reading a 64 MiB header peaks at
+ * about 1.33x its bytes with 4.19M entries and 1.12x with data of all NULs
+ * (Node 24.20.0). `IRpmHeaderEntry` objects are made only for the entries
+ * asked for.
+ */
+export class RpmHeader {
+  /** The header bytes as read: intro, index and data (with the padding of a signature header). */
+  public readonly bytes: Uint8Array;
+  public readonly data: Uint8Array;
+  /** Number of index entries. */
+  public readonly entryCount: number;
+  private readonly view: DataView;
+  private readonly ends: Uint32Array;
+  private readonly lookup = new Map<number, IRpmHeaderEntry | null>();
+  private readonly maxEntries: number;
+
+  constructor(bytesArg: Uint8Array, endsArg: Uint32Array, dataStartArg: number, maxEntriesArg: number) {
+    this.bytes = bytesArg;
+    this.data = bytesArg.subarray(dataStartArg);
+    this.entryCount = endsArg.length;
+    this.view = new DataView(bytesArg.buffer, bytesArg.byteOffset, bytesArg.byteLength);
+    this.ends = endsArg;
+    this.maxEntries = maxEntriesArg;
+  }
+
+  /** The tag of index entry `indexArg`. */
+  public tagAt(indexArg: number): number {
+    return this.view.getInt32(HEADER_INTRO_BYTES + indexArg * INDEX_ENTRY_BYTES);
+  }
+
+  /** Index entry `indexArg`. */
+  public entryAt(indexArg: number): IRpmHeaderEntry {
+    const at = HEADER_INTRO_BYTES + indexArg * INDEX_ENTRY_BYTES;
+    return {
+      tag: this.view.getInt32(at),
+      type: this.view.getInt32(at + 4),
+      count: this.view.getInt32(at + 12),
+      start: this.view.getInt32(at + 8),
+      end: this.ends[indexArg],
+    };
+  }
+
+  /** The effective entry for a tag (the last one in the index), or `null`. */
+  public entry(tagArg: number): IRpmHeaderEntry | null {
+    let found = this.lookup.get(tagArg);
+    if (found === undefined) {
+      found = null;
+      for (let i = this.entryCount - 1; i >= 0; i--) {
+        if (this.tagAt(i) === tagArg) {
+          found = this.entryAt(i);
+          break;
+        }
+      }
+      this.lookup.set(tagArg, found);
+    }
+    return found;
+  }
+
+  /** The index positions of every effective entry (the last one per tag), in ascending tag order. */
+  public effectiveIndexes(): Uint32Array {
+    const order = new Uint32Array(this.entryCount);
+    for (let i = 0; i < order.length; i++) {
+      order[i] = i;
+    }
+    order.sort((a, b) => this.tagAt(a) - this.tagAt(b) || a - b);
+    // within one tag the positions ascend: keep the last of each run
+    let kept = 0;
+    for (let i = 0; i < order.length; i++) {
+      if (i + 1 === order.length || this.tagAt(order[i + 1]) !== this.tagAt(order[i])) {
+        order[kept++] = order[i];
+      }
+    }
+    return order.subarray(0, kept);
+  }
+
+  public contents(entryArg: IRpmHeaderEntry): Uint8Array {
+    return this.data.subarray(entryArg.start, entryArg.end);
+  }
+
+  /**
+   * go-rpmutils `GetStrings` on the raw bytes: `null` when the tag is absent
+   * or not a string type. A negative count (a Go slice panic) is
+   * `malformed-header`; more values than `maxEntries` is `limit-exceeded`.
+   */
+  public strings(tagArg: number): Uint8Array[] | null {
+    const entry = this.entry(tagArg);
+    if (
+      entry === null ||
+      (entry.type !== RPM_TYPE.string && entry.type !== RPM_TYPE.stringArray && entry.type !== RPM_TYPE.i18nString)
+    ) {
+      return null;
+    }
+    if (entry.count < 0) {
+      throw new LinuxRepoError('malformed-header', `RPM tag ${tagArg} has a negative count`, { field: `tag ${tagArg}` });
+    }
+    this.assertCount(entry);
+    const values: Uint8Array[] = [];
+    const contents = this.contents(entry);
+    let offset = 0;
+    for (let i = 0; i < entry.count; i++) {
+      const nul = contents.indexOf(0, offset);
+      values.push(contents.subarray(offset, nul));
+      offset = nul + 1;
+    }
+    return values;
+  }
+
+  /** go-rpmutils `getInts`: `null` when the tag is absent or not an integer type. */
+  public integers(tagArg: number): IRpmIntegers | null {
+    const entry = this.entry(tagArg);
+    if (entry === null) {
+      return null;
+    }
+    let width: 1 | 2 | 4 | 8;
+    switch (entry.type) {
+      case RPM_TYPE.char:
+      case RPM_TYPE.int8:
+        width = 1;
+        break;
+      case RPM_TYPE.int16:
+        width = 2;
+        break;
+      case RPM_TYPE.int32:
+        width = 4;
+        break;
+      case RPM_TYPE.int64:
+        width = 8;
+        break;
+      default:
+        return null;
+    }
+    this.assertCount(entry);
+    const contents = this.contents(entry);
+    const view = new DataView(contents.buffer, contents.byteOffset, contents.byteLength);
+    const values: bigint[] = [];
+    for (let offset = 0; offset + width <= contents.length; offset += width) {
+      values.push(
+        width === 1
+          ? BigInt(view.getUint8(offset))
+          : width === 2
+            ? BigInt(view.getUint16(offset))
+            : width === 4
+              ? BigInt(view.getUint32(offset))
+              : view.getBigUint64(offset),
+      );
+    }
+    return { width, values };
+  }
+
+  /** go-rpmutils `GetUint32s`: `null` when absent, not an integer type, or 64-bit. */
+  public uint32s(tagArg: number): number[] | null {
+    const integers = this.integers(tagArg);
+    if (integers === null || integers.width === 8) {
+      return null;
+    }
+    return integers.values.map(Number);
+  }
+
+  /** go-rpmutils `GetUint64s`: `null` when absent or not an integer type. */
+  public uint64s(tagArg: number): bigint[] | null {
+    return this.integers(tagArg)?.values ?? null;
+  }
+
+  /** go-rpmutils `GetBytes`: `null` when absent or not binary. */
+  public binary(tagArg: number): Uint8Array | null {
+    const entry = this.entry(tagArg);
+    return entry === null || entry.type !== RPM_TYPE.bin ? null : this.contents(entry);
+  }
+
+  private assertCount(entryArg: IRpmHeaderEntry): void {
+    if (entryArg.count > this.maxEntries) {
+      throw limitExceeded('maxEntries', this.maxEntries, `RPM tag ${entryArg.tag}`);
+    }
+  }
+}
+
+/** The lead, both headers and their offsets, as read from the start of a package. */
+export interface IRpmPackageHeaders {
+  lead: Uint8Array;
+  /** Lead bytes 6-7 equal 1 (go-rpmutils `rpmutils.go:131`). */
+  isSource: boolean;
+  signature: RpmHeader;
+  main: RpmHeader;
+  /** Offset of the main header: 96 plus the signature header with its padding. */
+  mainStart: number;
+}
+
+/**
+ * Reads the lead, the signature header and the main header from `readerArg`
+ * and checks the main header digest. The signature header plus the main
+ * header count against `maxMetadataBytes`. The reader is left at the payload.
+ */
+export async function readRpmHeaders(
+  readerArg: IByteReader,
+  limitsArg: Readonly<ILinuxPackageLimits>,
+): Promise<IRpmPackageHeaders> {
+  const lead = await readUpTo(readerArg, RPM_LEAD_BYTES);
+  const magicLength = Math.min(lead.length, LEAD_MAGIC.length);
+  for (let i = 0; i < magicLength; i++) {
+    if (lead[i] !== LEAD_MAGIC[i]) {
+      throw new LinuxRepoError('unsupported-package-format', 'the input is not an RPM package (bad lead magic)', {
+        field: 'lead',
+      });
+    }
+  }
+  if (lead.length < RPM_LEAD_BYTES) {
+    throw truncated('RPM lead');
+  }
+  const isSource = ((lead[6] << 8) | lead[7]) === 1;
+  const signature = await readHeader(readerArg, limitsArg, 0, true, 'RPM signature header');
+  const main = await readHeader(readerArg, limitsArg, signature.bytes.length, false, 'RPM main header');
+  checkMainHeaderDigest(signature, main);
+  const mainStart = RPM_LEAD_BYTES + signature.bytes.length;
+  return { lead, isSource, signature, main, mainStart };
+}
+
+async function readHeader(
+  readerArg: IByteReader,
+  limitsArg: Readonly<ILinuxPackageLimits>,
+  alreadyReadArg: number,
+  isSignatureArg: boolean,
+  whatArg: string,
+): Promise<RpmHeader> {
+  const intro = await readExact(readerArg, HEADER_INTRO_BYTES, whatArg);
+  const introView = new DataView(intro.buffer, intro.byteOffset, intro.byteLength);
+  if (introView.getUint32(0) !== HEADER_MAGIC) {
+    throw new LinuxRepoError('malformed-header', `bad magic for the ${whatArg}`, { field: whatArg });
+  }
+  const indexCount = introView.getUint32(8);
+  const dataLength = introView.getUint32(12);
+  // go-rpmutils computes both in uint32: a wrapped index size cannot hold
+  // `indexCount` entries, and a wrapped padded size reads that many bytes
+  if (indexCount * INDEX_ENTRY_BYTES > 0xffffffff) {
+    throw new LinuxRepoError('malformed-header', `the ${whatArg} index is too large`, { field: whatArg });
+  }
+  const readLength = isSignatureArg ? ((dataLength + 7) & 0xfffffff8) >>> 0 : dataLength;
+  const total = HEADER_INTRO_BYTES + indexCount * INDEX_ENTRY_BYTES + readLength;
+  if (alreadyReadArg + total > limitsArg.maxMetadataBytes) {
+    throw limitExceeded('maxMetadataBytes', limitsArg.maxMetadataBytes, 'the RPM signature and main headers');
+  }
+  // one buffer for the whole header, filled in place
+  const bytes = new Uint8Array(total);
+  bytes.set(intro, 0);
+  for (let filled = HEADER_INTRO_BYTES; filled < total; ) {
+    const chunk = await readerArg.read(total - filled);
+    if (chunk === null) {
+      throw truncated(whatArg);
+    }
+    bytes.set(chunk, filled);
+    filled += chunk.length;
+  }
+  const dataStart = HEADER_INTRO_BYTES + indexCount * INDEX_ENTRY_BYTES;
+  return new RpmHeader(bytes, parseIndex(bytes, indexCount, dataStart, whatArg), dataStart, limitsArg.maxEntries);
+}
+
+/** Checks every index entry against the data and returns the end of each entry's contents. */
+function parseIndex(bytesArg: Uint8Array, indexCountArg: number, dataStartArg: number, whatArg: string): Uint32Array {
+  const view = new DataView(bytesArg.buffer, bytesArg.byteOffset, bytesArg.byteLength);
+  const data = bytesArg.subarray(dataStartArg);
+  const nuls = new NulIndex(data);
+  // an end lies inside the data, whose length is a uint32
+  const ends = new Uint32Array(indexCountArg);
+  for (let i = 0; i < indexCountArg; i++) {
+    const at = HEADER_INTRO_BYTES + i * INDEX_ENTRY_BYTES;
+    const tag = view.getInt32(at);
+    const type = view.getInt32(at + 4);
+    const offset = view.getInt32(at + 8);
+    const count = view.getInt32(at + 12);
+    const size = TYPE_SIZES.get(type);
+    let end: number;
+    if (size !== undefined) {
+      end = offset + size * count;
+    } else if (count > 0) {
+      // the `count` strings must each end in a NUL inside the data
+      end = offset < 0 || offset > data.length ? -1 : nuls.endOfStrings(offset, count);
+      if (end < 0) {
+        throw new LinuxRepoError('malformed-header', `${whatArg} tag ${tag} is truncated`, { field: `tag ${tag}` });
+      }
+    } else {
+      end = offset;
+    }
+    if (offset < 0 || end < offset || end > data.length) {
+      throw new LinuxRepoError('malformed-header', `${whatArg} tag ${tag} lies outside the header data`, {
+        field: `tag ${tag}`,
+      });
+    }
+    ends[i] = end;
+  }
+  return ends;
+}
+
+const NUL_BLOCK_BYTES = 4096;
+const NUL_SUBBLOCK_BYTES = 64;
+const SUBBLOCKS_PER_BLOCK = NUL_BLOCK_BYTES / NUL_SUBBLOCK_BYTES;
+
+interface INulDirectory {
+  /** The NULs before each block. */
+  blocks: Uint32Array;
+  /** The NULs before each sub-block, counted from the start of its block. */
+  subblocks: Uint16Array;
+  /** The NULs in the data. */
+  total: number;
+}
+
+/**
+ * A rank directory over the NUL bytes of a header's data, built on first use,
+ * so that finding the end of `count` strings costs two binary searches and
+ * two scans of at most 64 bytes instead of a scan per entry (a crafted index
+ * can point many entries at one long run). It holds the NULs before every
+ * 4 KiB block (4 bytes each) and, relative to its block, before every 64-byte
+ * sub-block (2 bytes each): about 3% of the data, however many NULs it holds.
+ */
+class NulIndex {
+  private directory: INulDirectory | null = null;
+
+  constructor(private readonly data: Uint8Array) {}
+
+  /** The offset just past the `countArg`-th NUL at or after `offsetArg` (`0 <= offsetArg <= data.length`), or -1. */
+  public endOfStrings(offsetArg: number, countArg: number): number {
+    if (offsetArg >= this.data.length) {
+      return -1;
+    }
+    if (countArg === 1) {
+      // a short string ends within one block; a longer one goes through the
+      // directory, so entries pointing into one long run never rescan it
+      const window = this.data.subarray(offsetArg, offsetArg + NUL_BLOCK_BYTES + 1);
+      const nul = window.indexOf(0);
+      if (nul >= 0) {
+        return offsetArg + nul + 1;
+      }
+      if (offsetArg + window.length === this.data.length) {
+        return -1;
+      }
+    }
+    const directory = this.build();
+    // the NUL wanted is the one with `rank` NULs before it
+    const rank = this.rank(directory, offsetArg) + countArg - 1;
+    return rank < directory.total ? this.select(directory, rank) + 1 : -1;
+  }
+
+  /** The number of NULs before `offsetArg` (`offsetArg < data.length`). */
+  private rank(directoryArg: INulDirectory, offsetArg: number): number {
+    const subblock = Math.floor(offsetArg / NUL_SUBBLOCK_BYTES);
+    let rank = directoryArg.blocks[Math.floor(offsetArg / NUL_BLOCK_BYTES)] + directoryArg.subblocks[subblock];
+    for (let i = subblock * NUL_SUBBLOCK_BYTES; i < offsetArg; i++) {
+      if (this.data[i] === 0) {
+        rank++;
+      }
+    }
+    return rank;
+  }
+
+  /** The position of the NUL with `rankArg` NULs before it (`rankArg` below the total). */
+  private select(directoryArg: INulDirectory, rankArg: number): number {
+    const { blocks, subblocks } = directoryArg;
+    // the last block with at most `rankArg` NULs before it
+    let low = 0;
+    let high = blocks.length - 1;
+    while (low < high) {
+      const middle = (low + high + 1) >>> 1;
+      if (blocks[middle] <= rankArg) {
+        low = middle;
+      } else {
+        high = middle - 1;
+      }
+    }
+    let remaining = rankArg - blocks[low];
+    // the last sub-block of that block with at most `remaining` NULs before it in the block
+    high = Math.min(subblocks.length, (low + 1) * SUBBLOCKS_PER_BLOCK) - 1;
+    low *= SUBBLOCKS_PER_BLOCK;
+    while (low < high) {
+      const middle = (low + high + 1) >>> 1;
+      if (subblocks[middle] <= remaining) {
+        low = middle;
+      } else {
+        high = middle - 1;
+      }
+    }
+    remaining -= subblocks[low];
+    for (let i = low * NUL_SUBBLOCK_BYTES, end = Math.min(this.data.length, i + NUL_SUBBLOCK_BYTES); i < end; i++) {
+      if (this.data[i] === 0 && remaining-- === 0) {
+        return i;
+      }
+    }
+    // unreachable while the directory matches the data: a codec fault, not a verdict on the package
+    throw new Error('the RPM header NUL directory does not match the header data');
+  }
+
+  private build(): INulDirectory {
+    if (this.directory === null) {
+      const data = this.data;
+      const blocks = new Uint32Array(Math.ceil(data.length / NUL_BLOCK_BYTES));
+      const subblocks = new Uint16Array(Math.ceil(data.length / NUL_SUBBLOCK_BYTES));
+      let total = 0;
+      let inBlock = 0;
+      for (let i = 0; i < data.length; i++) {
+        if (i % NUL_SUBBLOCK_BYTES === 0) {
+          if (i % NUL_BLOCK_BYTES === 0) {
+            blocks[i / NUL_BLOCK_BYTES] = total;
+            inBlock = 0;
+          }
+          subblocks[i / NUL_SUBBLOCK_BYTES] = inBlock;
+        }
+        if (data[i] === 0) {
+          total++;
+          inBlock++;
+        }
+      }
+      this.directory = { blocks, subblocks, total };
+    }
+    return this.directory;
+  }
+}
+
+/**
+ * go-rpmutils `getHashAndType` + the check in `readHeader`: the SHA-256 tag
+ * when it is a non-empty string, else the SHA-1 tag; a value of one character
+ * or less disables the check.
+ */
+function checkMainHeaderDigest(signatureArg: RpmHeader, mainArg: RpmHeader): void {
+  let expected = firstString(signatureArg, RPM_SIGNATURE_TAG.sha256);
+  let algorithm = 'sha256';
+  if (expected === null || expected.length === 0) {
+    expected = firstString(signatureArg, RPM_SIGNATURE_TAG.sha1);
+    algorithm = 'sha1';
+  }
+  if (expected === null || expected.length <= 1) {
+    return;
+  }
+  const actual = new TextEncoder().encode(plugins.crypto.createHash(algorithm).update(mainArg.bytes).digest('hex'));
+  if (actual.length !== expected.length || actual.some((byte, i) => byte !== expected[i])) {
+    throw new LinuxRepoError('digest-mismatch', `the RPM main header does not match its ${algorithm.toUpperCase()} digest`, {
+      field: algorithm === 'sha256' ? 'tag 273' : 'tag 269',
+    });
+  }
+}
+
+/** go-rpmutils `getSha256`/`getSha1`: `vals[0]` panics on an empty array. */
+function firstString(headerArg: RpmHeader, tagArg: number): Uint8Array | null {
+  const values = headerArg.strings(tagArg);
+  if (values === null) {
+    return null;
+  }
+  if (values.length === 0) {
+    throw new LinuxRepoError('malformed-header', `RPM signature tag ${tagArg} holds no value`, { field: `tag ${tagArg}` });
+  }
+  return values[0];
+}
+
+/** An entry written by `writeSignatureHeader` that does not come from the source header. */
+export interface IRpmNewEntry {
+  tag: number;
+  type: number;
+  count: number;
+  contents: Uint8Array;
+}
+
+/**
+ * Serializes a signature header as go-rpmutils `WriteTo(…, 62)` does
+ * (`writeheader.go:66-123`): entries below tag 64 are dropped, the rest are
+ * written in ascending tag order with INT16/32/64 data aligned, the region
+ * tag 62 comes first in the index with its 16-byte trailer as the last data
+ * item, and the whole header is padded to 8 bytes.
+ *
+ * The entries are the effective entries of `sourceArg` whose tags are not in
+ * `removedArg`, copied without an object per entry, and `addedArg`, whose
+ * tags must be in `removedArg`.
+ */
+export function writeSignatureHeader(sourceArg: RpmHeader, removedArg: ReadonlySet<number>, addedArg: IRpmNewEntry[]): Uint8Array {
+  const kept = sourceArg.effectiveIndexes();
+  let keptCount = 0;
+  for (const indexValue of kept) {
+    const tag = sourceArg.tagAt(indexValue);
+    if (tag >= RPM_TAG_HEADER_REGIONS && !removedArg.has(tag)) {
+      kept[keptCount++] = indexValue;
+    }
+  }
+  const added = addedArg.filter((entry) => entry.tag >= RPM_TAG_HEADER_REGIONS).sort((a, b) => a.tag - b.tag);
+  /** Calls `visitArg` for every entry in ascending tag order, with the offset of its data. */
+  const layout = (visitArg: (entryArg: IRpmHeaderEntry, contentsArg: Uint8Array | null, offsetArg: number) => void): number => {
+    let dataLength = 0;
+    for (let k = 0, a = 0; k < keptCount || a < added.length; ) {
+      let entry: IRpmHeaderEntry;
+      let contents: Uint8Array | null = null;
+      if (a < added.length && (k === keptCount || added[a].tag < sourceArg.tagAt(kept[k]))) {
+        const item = added[a++];
+        entry = { tag: item.tag, type: item.type, count: item.count, start: 0, end: item.contents.length };
+        contents = item.contents;
+      } else {
+        entry = sourceArg.entryAt(kept[k++]);
+      }
+      const alignment = TYPE_ALIGNMENT.get(entry.type);
+      if (alignment !== undefined && dataLength % alignment !== 0) {
+        dataLength += alignment - (dataLength % alignment);
+      }
+      visitArg(entry, contents, dataLength);
+      dataLength += entry.end - entry.start;
+    }
+    return dataLength;
+  };
+  const trailerOffset = layout(() => undefined);
+  const dataLength = trailerOffset + INDEX_ENTRY_BYTES;
+  const indexCount = keptCount + added.length + 1;
+  const unpadded = HEADER_INTRO_BYTES + indexCount * INDEX_ENTRY_BYTES + dataLength;
+  const bytes = new Uint8Array(unpadded + ((8 - (dataLength % 8)) % 8));
+  const view = new DataView(bytes.buffer);
+  view.setUint32(0, HEADER_MAGIC);
+  view.setUint32(8, indexCount);
+  view.setUint32(12, dataLength);
+  const dataStart = HEADER_INTRO_BYTES + indexCount * INDEX_ENTRY_BYTES;
+  const writeIndex = (indexArg: number, tagArg: number, typeArg: number, offsetArg: number, countArg: number) => {
+    const at = HEADER_INTRO_BYTES + indexArg * INDEX_ENTRY_BYTES;
+    view.setInt32(at, tagArg);
+    view.setInt32(at + 4, typeArg);
+    view.setInt32(at + 8, offsetArg);
+    view.setInt32(at + 12, countArg);
+  };
+  writeIndex(0, RPM_SIGNATURE_TAG.headerSignatures, RPM_TYPE.bin, trailerOffset, INDEX_ENTRY_BYTES);
+  let written = 1;
+  layout((entryArg, contentsArg, offsetArg) => {
+    writeIndex(written++, entryArg.tag, entryArg.type, offsetArg, entryArg.count);
+    if (entryArg.end > entryArg.start) {
+      bytes.set(contentsArg ?? sourceArg.contents(entryArg), dataStart + offsetArg);
+    }
+  });
+  const trailer = dataStart + trailerOffset;
+  view.setInt32(trailer, RPM_SIGNATURE_TAG.headerSignatures);
+  view.setInt32(trailer + 4, RPM_TYPE.bin);
+  view.setInt32(trailer + 8, -INDEX_ENTRY_BYTES * indexCount);
+  view.setInt32(trailer + 12, INDEX_ENTRY_BYTES);
+  return bytes;
+}