@push.rocks/smartlinuxrepo 0.0.0-stage → 1.0.0

package/.smartconfig.json

@@ -0,0 +1,65 @@
+{
+  "@git.zone/cli": {
+    "schemaVersion": 2,
+    "projectType": "npm",
+    "module": {
+      "githost": "code.foss.global",
+      "gitscope": "push.rocks",
+      "gitrepo": "smartlinuxrepo",
+      "description": "A pure codec for Linux package repositories (Alpine apk, Debian apt, RPM dnf, Arch pacman): read packages into records, build index file sets and sign them.",
+      "npmPackagename": "@push.rocks/smartlinuxrepo",
+      "license": "MIT",
+      "projectDomain": "push.rocks",
+      "keywords": [
+        "linux",
+        "package repository",
+        "alpine",
+        "apk",
+        "debian",
+        "apt",
+        "rpm",
+        "dnf",
+        "arch",
+        "pacman",
+        "openpgp",
+        "codec"
+      ]
+    },
+    "release": {
+      "confirmation": "prompt",
+      "versionFloor": "1.0.0",
+      "preflight": {
+        "requireCleanTree": true,
+        "test": false,
+        "build": true
+      },
+      "targets": {
+        "git": {
+          "enabled": true,
+          "remote": "origin",
+          "pushBranch": true,
+          "pushTags": true
+        },
+        "npm": {
+          "enabled": true,
+          "registries": [
+            "https://verdaccio.lossless.digital",
+            "https://registry.npmjs.org"
+          ],
+          "accessLevel": "public",
+          "alreadyPublished": "success"
+        },
+        "docker": {
+          "enabled": false,
+          "engine": "tsdocker",
+          "patterns": []
+        }
+      }
+    }
+  },
+  "@git.zone/tsrepo": {
+    "docs": {
+      "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license.md) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+    }
+  }
+}

package/dist_ts/00_commitinfo_data.d.ts

@@ -0,0 +1,8 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export declare const commitinfo: {
+    name: string;
+    version: string;
+    description: string;
+};

package/dist_ts/00_commitinfo_data.js

@@ -0,0 +1,9 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export const commitinfo = {
+    name: '@push.rocks/smartlinuxrepo',
+    version: '1.0.0',
+    description: 'A pure codec for Linux package repositories (Alpine apk, Debian apt, RPM dnf, Arch pacman): read packages into records, build index file sets and sign them.'
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw0QkFBNEI7SUFDbEMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDhKQUE4SjtDQUM1SyxDQUFBIn0=

package/dist_ts/alpine/apkindex.d.ts

@@ -0,0 +1,39 @@
+import type { IAlpinePackageRecord, ILinuxIndexFile } from '../shared/types.js';
+import type { IAlpineSigner } from '../signing/signers.js';
+/**
+ * Builds the `APKINDEX.tar.gz` set of one Alpine repository (one branch and
+ * repository) as Gitea 28.2.0 does (`services/packages/alpine/repository.go:150-351`):
+ * one index per architecture the entries name, at
+ * `{branch}/{repository}/{architecture}/APKINDEX.tar.gz`. Every index other
+ * than `noarch` also lists the `noarch` packages, and every block's `A:` is the
+ * index's architecture.
+ *
+ * Each archive is a signature gzip member (a tar entry
+ * `.SIGN.RSA.<signer.keyName>` holding RSA PKCS#1 v1.5 over SHA-1 of the
+ * unsigned stream, without an end-of-archive marker) followed by the unsigned
+ * gzip member (a tar entry `APKINDEX`, mode 0600, with the marker). Tar headers
+ * are byte-for-byte what Go `archive/tar` writes for Gitea (`writeGoTar`); the
+ * signature entry is padded to its 512-byte block (a difference from Gitea),
+ * which Gitea's 4096-bit signatures already fill exactly. Entries are sorted by name, version, architecture and file
+ * name (bytewise), so the bytes depend on the entry set, not its order.
+ *
+ * Pure: the signer is the only call out. `timestamp` is validated but not
+ * written; the format carries no build time. An empty entry set returns `[]`.
+ * Bad input is `invalid-input` and names the entry; an error from the signer
+ * propagates unchanged; a signer result that is not non-empty bytes is
+ * `signing-failed`.
+ */
+export declare function buildAlpineIndex(inputArg: {
+    branch: string;
+    repository: string;
+    entries: IAlpinePackageRecord[];
+    signer: IAlpineSigner;
+    timestamp: Date;
+}): Promise<ILinuxIndexFile[]>;
+/**
+ * One APKINDEX block for `recordArg` in the index of `architectureArg`, as
+ * Gitea writes it (`services/packages/alpine/repository.go:215-252`),
+ * including the blank line that ends it. Internal: 1.0.0 exports no
+ * per-entry renderers. The record must have passed `checkRecord`.
+ */
+export declare function renderAlpineIndexEntry(recordArg: IAlpinePackageRecord, architectureArg: string): string;

package/dist_ts/alpine/apkindex.js

@@ -0,0 +1,211 @@
+import * as plugins from '../plugins.js';
+import { isIndexableArchitecture } from '../shared/architecture.js';
+import { LinuxRepoError } from '../shared/errors.js';
+import { assertSegmentName, assertString, assertTimestamp } from '../shared/validation.js';
+import { concatBytes } from '../readers/bytes.js';
+import { writeGoTar } from '../writers/gotar.js';
+/** Gitea's `alpine_module.NoArch`: these packages are listed in every architecture's index too. */
+const NOARCH = 'noarch';
+const INDEX_FILE_NAME = 'APKINDEX';
+const INDEX_ARCHIVE_NAME = 'APKINDEX.tar.gz';
+const INDEX_MODE = 0o600;
+const encoder = new TextEncoder();
+/**
+ * Builds the `APKINDEX.tar.gz` set of one Alpine repository (one branch and
+ * repository) as Gitea 28.2.0 does (`services/packages/alpine/repository.go:150-351`):
+ * one index per architecture the entries name, at
+ * `{branch}/{repository}/{architecture}/APKINDEX.tar.gz`. Every index other
+ * than `noarch` also lists the `noarch` packages, and every block's `A:` is the
+ * index's architecture.
+ *
+ * Each archive is a signature gzip member (a tar entry
+ * `.SIGN.RSA.<signer.keyName>` holding RSA PKCS#1 v1.5 over SHA-1 of the
+ * unsigned stream, without an end-of-archive marker) followed by the unsigned
+ * gzip member (a tar entry `APKINDEX`, mode 0600, with the marker). Tar headers
+ * are byte-for-byte what Go `archive/tar` writes for Gitea (`writeGoTar`); the
+ * signature entry is padded to its 512-byte block (a difference from Gitea),
+ * which Gitea's 4096-bit signatures already fill exactly. Entries are sorted by name, version, architecture and file
+ * name (bytewise), so the bytes depend on the entry set, not its order.
+ *
+ * Pure: the signer is the only call out. `timestamp` is validated but not
+ * written; the format carries no build time. An empty entry set returns `[]`.
+ * Bad input is `invalid-input` and names the entry; an error from the signer
+ * propagates unchanged; a signer result that is not non-empty bytes is
+ * `signing-failed`.
+ */
+export async function buildAlpineIndex(inputArg) {
+    if (inputArg === null || typeof inputArg !== 'object') {
+        throw new LinuxRepoError('invalid-input', 'input must be an object', { field: 'input' });
+    }
+    assertLayoutSegment(inputArg.branch, 'branch');
+    assertLayoutSegment(inputArg.repository, 'repository');
+    assertTimestamp(inputArg.timestamp);
+    const signer = inputArg.signer;
+    if (signer === null || typeof signer !== 'object' || typeof signer.sign !== 'function') {
+        throw new LinuxRepoError('invalid-input', 'signer must be an IAlpineSigner', { field: 'signer' });
+    }
+    assertSegmentName(signer.keyName, 'signer.keyName');
+    if (!Array.isArray(inputArg.entries)) {
+        throw new LinuxRepoError('invalid-input', 'entries must be an array', { field: 'entries' });
+    }
+    const entries = inputArg.entries.map((record, index) => checkRecord(record, `entries[${index}]`));
+    const seen = new Set();
+    for (const record of entries) {
+        const key = `${record.architecture}/${record.fileName}`;
+        if (seen.has(key)) {
+            throw new LinuxRepoError('invalid-input', `duplicate package file ${key}`, { field: 'entries', value: key });
+        }
+        seen.add(key);
+    }
+    entries.sort(compareRecords);
+    const architectures = [...new Set(entries.map((record) => record.architecture))].sort(compareBytes);
+    const files = [];
+    for (const architecture of architectures) {
+        const listed = entries.filter((record) => record.architecture === architecture || (architecture !== NOARCH && record.architecture === NOARCH));
+        const text = listed.map((record) => renderAlpineIndexEntry(record, architecture)).join('');
+        const unsigned = await gzip(writeGoTar([{ name: INDEX_FILE_NAME, mode: INDEX_MODE, data: encoder.encode(text) }], { endOfArchive: true }));
+        const signature = await signer.sign(unsigned);
+        if (!(signature instanceof Uint8Array) || signature.length === 0) {
+            throw new LinuxRepoError('signing-failed', 'the Alpine signer did not return signature bytes', {
+                field: 'signer',
+            });
+        }
+        const signatureMember = await gzip(writeGoTar([{ name: `.SIGN.RSA.${signer.keyName}`, mode: INDEX_MODE, data: signature }], { endOfArchive: false }));
+        const bytes = concatBytes([signatureMember, unsigned]);
+        files.push({
+            path: `${inputArg.branch}/${inputArg.repository}/${architecture}/${INDEX_ARCHIVE_NAME}`,
+            bytes,
+            sha256: plugins.crypto.createHash('sha256').update(bytes).digest('hex'),
+            mediaType: 'application/gzip',
+            stage: 'pointer',
+            aliases: [],
+        });
+    }
+    return files;
+}
+/**
+ * One APKINDEX block for `recordArg` in the index of `architectureArg`, as
+ * Gitea writes it (`services/packages/alpine/repository.go:215-252`),
+ * including the blank line that ends it. Internal: 1.0.0 exports no
+ * per-entry renderers. The record must have passed `checkRecord`.
+ */
+export function renderAlpineIndexEntry(recordArg, architectureArg) {
+    const metadata = recordArg.metadata;
+    const lines = [
+        `C:Q1${Buffer.from(recordArg.digests.controlSha1, 'hex').toString('base64')}`,
+        `P:${recordArg.name}`,
+        `V:${recordArg.version}`,
+        `A:${architectureArg}`,
+    ];
+    if (metadata.description !== '') {
+        lines.push(`T:${metadata.description}`);
+    }
+    if (metadata.projectUrl !== '') {
+        lines.push(`U:${metadata.projectUrl}`);
+    }
+    if (metadata.license !== '') {
+        lines.push(`L:${metadata.license}`);
+    }
+    lines.push(`S:${recordArg.digests.size}`, `I:${metadata.installedSize}`, `o:${metadata.origin}`, `m:${metadata.maintainer}`, `t:${metadata.buildDate}`);
+    if (metadata.commit !== '') {
+        lines.push(`c:${metadata.commit}`);
+    }
+    if (metadata.dependencies.length > 0) {
+        lines.push(`D:${metadata.dependencies.join(' ')}`);
+    }
+    if (metadata.provides.length > 0) {
+        lines.push(`p:${metadata.provides.join(' ')}`);
+    }
+    if (metadata.installIf !== '') {
+        lines.push(`i:${metadata.installIf}`);
+    }
+    if (metadata.providerPriority > 0) {
+        lines.push(`k:${metadata.providerPriority}`);
+    }
+    return `${lines.join('\n')}\n\n`;
+}
+/**
+ * Checks what the index writes. A value with a line break would forge APKINDEX
+ * fields; Gitea's line-based `.PKGINFO` parser never produces one, so refusing
+ * it refuses no package Gitea stored.
+ */
+function checkRecord(recordArg, fieldArg) {
+    const fail = (whatArg) => {
+        throw new LinuxRepoError('invalid-input', `${fieldArg}: ${whatArg}`, { field: fieldArg });
+    };
+    if (recordArg === null || typeof recordArg !== 'object') {
+        return fail('must be an Alpine package record');
+    }
+    const record = recordArg;
+    if (record.format !== 'alpine' || record.metadata === null || typeof record.metadata !== 'object') {
+        return fail('must be an Alpine package record');
+    }
+    if (record.digests === null || typeof record.digests !== 'object') {
+        return fail('digests must be an object');
+    }
+    const text = (valueArg, nameArg, nonEmptyArg = false) => {
+        if (typeof valueArg !== 'string' || /[\n]/.test(valueArg) || (nonEmptyArg && valueArg === '')) {
+            fail(`${nameArg} must be a${nonEmptyArg ? ' non-empty' : ''} string without line breaks`);
+        }
+    };
+    const integer = (valueArg, nameArg, minimumArg = -Number.MAX_SAFE_INTEGER) => {
+        if (typeof valueArg !== 'number' || !Number.isSafeInteger(valueArg) || valueArg < minimumArg) {
+            fail(`${nameArg} must be a safe integer${minimumArg === 0 ? ' >= 0' : ''}`);
+        }
+    };
+    const list = (valueArg, nameArg) => {
+        if (!Array.isArray(valueArg)) {
+            fail(`${nameArg} must be an array`);
+        }
+        valueArg.forEach((item, index) => text(item, `${nameArg}[${index}]`));
+    };
+    text(record.name, 'name', true);
+    text(record.version, 'version', true);
+    assertString(record.fileName, `${fieldArg}.fileName`);
+    if (!isIndexableArchitecture(record.architecture)) {
+        fail(`architecture ${JSON.stringify(record.architecture)} of ${record.fileName} cannot name an index`);
+    }
+    if (typeof record.digests.controlSha1 !== 'string' || !/^[0-9a-f]{40}$/.test(record.digests.controlSha1)) {
+        fail('digests.controlSha1 must be 40 lowercase hex digits');
+    }
+    integer(record.digests.size, 'digests.size', 0);
+    const metadata = record.metadata;
+    for (const key of ['description', 'license', 'projectUrl', 'maintainer', 'origin', 'commit', 'installIf']) {
+        text(metadata[key], `metadata.${key}`);
+    }
+    integer(metadata.installedSize, 'metadata.installedSize');
+    integer(metadata.buildDate, 'metadata.buildDate');
+    integer(metadata.providerPriority, 'metadata.providerPriority');
+    list(metadata.dependencies, 'metadata.dependencies');
+    list(metadata.provides, 'metadata.provides');
+    return record;
+}
+function assertLayoutSegment(valueArg, fieldArg) {
+    assertSegmentName(valueArg, fieldArg);
+    if (valueArg === '.' || valueArg === '..') {
+        throw new LinuxRepoError('invalid-input', `${fieldArg} must not be "." or ".."`, { field: fieldArg });
+    }
+}
+function compareRecords(aArg, bArg) {
+    return (compareBytes(aArg.name, bArg.name) ||
+        compareBytes(aArg.version, bArg.version) ||
+        compareBytes(aArg.architecture, bArg.architecture) ||
+        compareBytes(aArg.fileName, bArg.fileName));
+}
+/** Orders strings by their UTF-8 bytes. */
+function compareBytes(aArg, bArg) {
+    return Buffer.compare(Buffer.from(aArg, 'utf8'), Buffer.from(bArg, 'utf8'));
+}
+function gzip(bytesArg) {
+    return new Promise((resolve, reject) => {
+        plugins.zlib.gzip(bytesArg, (error, result) => {
+            if (error) {
+                reject(error);
+            }
+            else {
+                resolve(new Uint8Array(result.buffer, result.byteOffset, result.byteLength));
+            }
+        });
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBraW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9hbHBpbmUvYXBraW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFDekMsT0FBTyxFQUFFLHVCQUF1QixFQUFFLE1BQU0sMkJBQTJCLENBQUM7QUFDcEUsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBRXJELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxZQUFZLEVBQUUsZUFBZSxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFFM0YsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUVqRCxtR0FBbUc7QUFDbkcsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDO0FBQ3hCLE1BQU0sZUFBZSxHQUFHLFVBQVUsQ0FBQztBQUNuQyxNQUFNLGtCQUFrQixHQUFHLGlCQUFpQixDQUFDO0FBQzdDLE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQztBQUN6QixNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDO0FBRWxDOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBc0JHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxRQU10QztJQUNDLElBQUksUUFBUSxLQUFLLElBQUksSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN0RCxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSx5QkFBeUIsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzNGLENBQUM7SUFDRCxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQy9DLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxVQUFVLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDdkQsZUFBZSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNwQyxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDO0lBQy9CLElBQUksTUFBTSxLQUFLLElBQUksSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksT0FBTyxNQUFNLENBQUMsSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3ZGLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLGlDQUFpQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDcEcsQ0FBQztJQUNELGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztJQUNwRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNyQyxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSwwQkFBMEIsRUFBRSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsV0FBVyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDbEcsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUMvQixLQUFLLE1BQU0sTUFBTSxJQUFJLE9BQU8sRUFBRSxDQUFDO1FBQzdCLE1BQU0sR0FBRyxHQUFHLEdBQUcsTUFBTSxDQUFDLFlBQVksSUFBSSxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDeEQsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbEIsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsMEJBQTBCLEdBQUcsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUMvRyxDQUFDO1FBQ0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNoQixDQUFDO0lBQ0QsT0FBTyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUU3QixNQUFNLGFBQWEsR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDcEcsTUFBTSxLQUFLLEdBQXNCLEVBQUUsQ0FBQztJQUNwQyxLQUFLLE1BQU0sWUFBWSxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQzNCLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsWUFBWSxLQUFLLFlBQVksSUFBSSxDQUFDLFlBQVksS0FBSyxNQUFNLElBQUksTUFBTSxDQUFDLFlBQVksS0FBSyxNQUFNLENBQUMsQ0FDaEgsQ0FBQztRQUNGLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLE1BQU0sRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUMzRixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FDekIsVUFBVSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsWUFBWSxFQUFFLElBQUksRUFBRSxDQUFDLENBQzlHLENBQUM7UUFDRixNQUFNLFNBQVMsR0FBWSxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDdkQsSUFBSSxDQUFDLENBQUMsU0FBUyxZQUFZLFVBQVUsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDakUsTUFBTSxJQUFJLGNBQWMsQ0FBQyxnQkFBZ0IsRUFBRSxrREFBa0QsRUFBRTtnQkFDN0YsS0FBSyxFQUFFLFFBQVE7YUFDaEIsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELE1BQU0sZUFBZSxHQUFHLE1BQU0sSUFBSSxDQUNoQyxVQUFVLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxhQUFhLE1BQU0sQ0FBQyxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsQ0FBQyxFQUFFLEVBQUUsWUFBWSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQ2xILENBQUM7UUFDRixNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsQ0FBQyxlQUFlLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUN2RCxLQUFLLENBQUMsSUFBSSxDQUFDO1lBQ1QsSUFBSSxFQUFFLEdBQUcsUUFBUSxDQUFDLE1BQU0sSUFBSSxRQUFRLENBQUMsVUFBVSxJQUFJLFlBQVksSUFBSSxrQkFBa0IsRUFBRTtZQUN2RixLQUFLO1lBQ0wsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO1lBQ3ZFLFNBQVMsRUFBRSxrQkFBa0I7WUFDN0IsS0FBSyxFQUFFLFNBQVM7WUFDaEIsT0FBTyxFQUFFLEVBQUU7U0FDWixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUsc0JBQXNCLENBQUMsU0FBK0IsRUFBRSxlQUF1QjtJQUM3RixNQUFNLFFBQVEsR0FBRyxTQUFTLENBQUMsUUFBUSxDQUFDO0lBQ3BDLE1BQU0sS0FBSyxHQUFHO1FBQ1osT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLEtBQUssQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRTtRQUM3RSxLQUFLLFNBQVMsQ0FBQyxJQUFJLEVBQUU7UUFDckIsS0FBSyxTQUFTLENBQUMsT0FBTyxFQUFFO1FBQ3hCLEtBQUssZUFBZSxFQUFFO0tBQ3ZCLENBQUM7SUFDRixJQUFJLFFBQVEsQ0FBQyxXQUFXLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDaEMsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLFFBQVEsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDL0IsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDNUIsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLFFBQVEsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3RDLENBQUM7SUFDRCxLQUFLLENBQUMsSUFBSSxDQUNSLEtBQUssU0FBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFDN0IsS0FBSyxRQUFRLENBQUMsYUFBYSxFQUFFLEVBQzdCLEtBQUssUUFBUSxDQUFDLE1BQU0sRUFBRSxFQUN0QixLQUFLLFFBQVEsQ0FBQyxVQUFVLEVBQUUsRUFDMUIsS0FBSyxRQUFRLENBQUMsU0FBUyxFQUFFLENBQzFCLENBQUM7SUFDRixJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDM0IsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3JDLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxZQUFZLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3JDLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxRQUFRLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDakMsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsU0FBUyxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzlCLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsZ0JBQWdCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbEMsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLFFBQVEsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUNELE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7QUFDbkMsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxTQUFTLFdBQVcsQ0FBQyxTQUFrQixFQUFFLFFBQWdCO0lBQ3ZELE1BQU0sSUFBSSxHQUFHLENBQUMsT0FBZSxFQUFTLEVBQUU7UUFDdEMsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsR0FBRyxRQUFRLEtBQUssT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM1RixDQUFDLENBQUM7SUFDRixJQUFJLFNBQVMsS0FBSyxJQUFJLElBQUksT0FBTyxTQUFTLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDeEQsT0FBTyxJQUFJLENBQUMsa0NBQWtDLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsU0FBaUMsQ0FBQztJQUNqRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNsRyxPQUFPLElBQUksQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxPQUFPLEtBQUssSUFBSSxJQUFJLE9BQU8sTUFBTSxDQUFDLE9BQU8sS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNsRSxPQUFPLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO0lBQzNDLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFFLFdBQVcsR0FBRyxLQUFLLEVBQVEsRUFBRTtRQUM3RSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsV0FBVyxJQUFJLFFBQVEsS0FBSyxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQzlGLElBQUksQ0FBQyxHQUFHLE9BQU8sYUFBYSxXQUFXLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsRUFBRSw2QkFBNkIsQ0FBQyxDQUFDO1FBQzVGLENBQUM7SUFDSCxDQUFDLENBQUM7SUFDRixNQUFNLE9BQU8sR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFFLFVBQVUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsRUFBUSxFQUFFO1FBQ2xHLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLEdBQUcsVUFBVSxFQUFFLENBQUM7WUFDN0YsSUFBSSxDQUFDLEdBQUcsT0FBTywwQkFBMEIsVUFBVSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzlFLENBQUM7SUFDSCxDQUFDLENBQUM7SUFDRixNQUFNLElBQUksR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFRLEVBQUU7UUFDeEQsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUM3QixJQUFJLENBQUMsR0FBRyxPQUFPLG1CQUFtQixDQUFDLENBQUM7UUFDdEMsQ0FBQztRQUNBLFFBQXNCLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxHQUFHLE9BQU8sSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDdkYsQ0FBQyxDQUFDO0lBQ0YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ2hDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN0QyxZQUFZLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxHQUFHLFFBQVEsV0FBVyxDQUFDLENBQUM7SUFDdEQsSUFBSSxDQUFDLHVCQUF1QixDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQ2xELElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLE9BQU8sTUFBTSxDQUFDLFFBQVEsdUJBQXVCLENBQUMsQ0FBQztJQUN6RyxDQUFDO0lBQ0QsSUFBSSxPQUFPLE1BQU0sQ0FBQyxPQUFPLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDekcsSUFBSSxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELE9BQU8sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDaEQsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQztJQUNqQyxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsYUFBYSxFQUFFLFNBQVMsRUFBRSxZQUFZLEVBQUUsWUFBWSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsV0FBVyxDQUFVLEVBQUUsQ0FBQztRQUNuSCxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLFlBQVksR0FBRyxFQUFFLENBQUMsQ0FBQztJQUN6QyxDQUFDO0lBQ0QsT0FBTyxDQUFDLFFBQVEsQ0FBQyxhQUFhLEVBQUUsd0JBQXdCLENBQUMsQ0FBQztJQUMxRCxPQUFPLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxvQkFBb0IsQ0FBQyxDQUFDO0lBQ2xELE9BQU8sQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLEVBQUUsMkJBQTJCLENBQUMsQ0FBQztJQUNoRSxJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO0lBQ3JELElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLG1CQUFtQixDQUFDLENBQUM7SUFDN0MsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELFNBQVMsbUJBQW1CLENBQUMsUUFBaUIsRUFBRSxRQUFnQjtJQUM5RCxpQkFBaUIsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDdEMsSUFBSSxRQUFRLEtBQUssR0FBRyxJQUFJLFFBQVEsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUMxQyxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxHQUFHLFFBQVEsMEJBQTBCLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUN4RyxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsY0FBYyxDQUFDLElBQTBCLEVBQUUsSUFBMEI7SUFDNUUsT0FBTyxDQUNMLFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUM7UUFDbEMsWUFBWSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUN4QyxZQUFZLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDO1FBQ2xELFlBQVksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDM0MsQ0FBQztBQUNKLENBQUM7QUFFRCwyQ0FBMkM7QUFDM0MsU0FBUyxZQUFZLENBQUMsSUFBWSxFQUFFLElBQVk7SUFDOUMsT0FBTyxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7QUFDOUUsQ0FBQztBQUVELFNBQVMsSUFBSSxDQUFDLFFBQW9CO0lBQ2hDLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7UUFDckMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQzVDLElBQUksS0FBSyxFQUFFLENBQUM7Z0JBQ1YsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ2hCLENBQUM7aUJBQU0sQ0FBQztnQkFDTixPQUFPLENBQUMsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1lBQy9FLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUMsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyJ9

package/dist_ts/alpine/pkginfo.d.ts

@@ -0,0 +1,45 @@
+import type { ILinuxPackageLimits } from '../shared/limits.js';
+/** What Gitea 28.2.0 derives from an apk `.PKGINFO` (`modules/packages/alpine/metadata.go:137-227`). */
+export interface IAlpinePackageInfo {
+    name: string;
+    version: string;
+    architecture: string;
+    description: string;
+    license: string;
+    projectUrl: string;
+    maintainer: string;
+    packager: string;
+    buildDate: number;
+    installedSize: number;
+    origin: string;
+    commit: string;
+    installIf: string;
+    provides: string[];
+    dependencies: string[];
+    providerPriority: number;
+}
+/**
+ * Parses `.PKGINFO` as Gitea's `ParsePackageInfo` does:
+ * - lines split as `bufio.ScanLines` (LF, one trailing CR dropped, a final
+ *   line without LF counts);
+ * - `#` lines and lines without `=` are skipped; key and value are
+ *   `strings.TrimSpace`d around the first `=`; the last value wins, except
+ *   `provides` and `depend`, which collect every non-empty value;
+ * - `builddate`, `size` and `provider_priority` are `strconv.ParseInt(v, 10,
+ *   64)`; a value Go cannot parse (including one outside int64) is ignored,
+ *   so the field keeps its previous value, 0 when there is none
+ *   (`metadata.go:165-174`, `:203-207`);
+ * - an empty `pkgname` or `pkgver` is refused; a `url` Gitea's URL validation
+ *   refuses becomes `''`.
+ *
+ * Bytes are decoded with `decodeGoUtf8`. Where the codec differs from Gitea
+ * (test/test.alpine.reader.node.ts pins each case against Gitea's own code):
+ * - a line is bounded by `maxHeaderBytes` instead of Go's 64 KiB scanner buffer;
+ * - `provides` plus `depend` values are bounded by `maxEntries` instead of 1024;
+ * - invalid UTF-8 becomes U+FFFD per byte, where Gitea 28.2.0 refuses the
+ *   upload because its `encoding/json/v2` cannot store the metadata;
+ * - a number Go parses but JSON cannot hold exactly (beyond
+ *   `Number.MAX_SAFE_INTEGER` in magnitude) is refused as `invalid-field`,
+ *   never rounded.
+ */
+export declare function parseAlpinePackageInfo(bytesArg: Uint8Array, limitsArg: Readonly<ILinuxPackageLimits>): IAlpinePackageInfo;

package/dist_ts/alpine/pkginfo.js

@@ -0,0 +1,159 @@
+import { LinuxRepoError, limitExceeded } from '../shared/errors.js';
+import { goParseInt64, goTrimSpace } from '../shared/gostrings.js';
+import { isValidUrl } from '../shared/url.js';
+import { decodeGoUtf8 } from '../readers/text.js';
+const MAX_SAFE = BigInt(Number.MAX_SAFE_INTEGER);
+/**
+ * Parses `.PKGINFO` as Gitea's `ParsePackageInfo` does:
+ * - lines split as `bufio.ScanLines` (LF, one trailing CR dropped, a final
+ *   line without LF counts);
+ * - `#` lines and lines without `=` are skipped; key and value are
+ *   `strings.TrimSpace`d around the first `=`; the last value wins, except
+ *   `provides` and `depend`, which collect every non-empty value;
+ * - `builddate`, `size` and `provider_priority` are `strconv.ParseInt(v, 10,
+ *   64)`; a value Go cannot parse (including one outside int64) is ignored,
+ *   so the field keeps its previous value, 0 when there is none
+ *   (`metadata.go:165-174`, `:203-207`);
+ * - an empty `pkgname` or `pkgver` is refused; a `url` Gitea's URL validation
+ *   refuses becomes `''`.
+ *
+ * Bytes are decoded with `decodeGoUtf8`. Where the codec differs from Gitea
+ * (test/test.alpine.reader.node.ts pins each case against Gitea's own code):
+ * - a line is bounded by `maxHeaderBytes` instead of Go's 64 KiB scanner buffer;
+ * - `provides` plus `depend` values are bounded by `maxEntries` instead of 1024;
+ * - invalid UTF-8 becomes U+FFFD per byte, where Gitea 28.2.0 refuses the
+ *   upload because its `encoding/json/v2` cannot store the metadata;
+ * - a number Go parses but JSON cannot hold exactly (beyond
+ *   `Number.MAX_SAFE_INTEGER` in magnitude) is refused as `invalid-field`,
+ *   never rounded.
+ */
+export function parseAlpinePackageInfo(bytesArg, limitsArg) {
+    const info = {
+        name: '',
+        version: '',
+        architecture: '',
+        description: '',
+        license: '',
+        projectUrl: '',
+        maintainer: '',
+        packager: '',
+        buildDate: 0,
+        installedSize: 0,
+        origin: '',
+        commit: '',
+        installIf: '',
+        provides: [],
+        dependencies: [],
+        providerPriority: 0,
+    };
+    for (const line of scanLines(bytesArg, limitsArg.maxHeaderBytes)) {
+        if (line.startsWith('#')) {
+            continue;
+        }
+        const equals = line.indexOf('=');
+        if (equals < 0) {
+            continue;
+        }
+        const key = goTrimSpace(line.slice(0, equals));
+        const value = goTrimSpace(line.slice(equals + 1));
+        switch (key) {
+            case 'pkgname':
+                info.name = value;
+                break;
+            case 'pkgver':
+                info.version = value;
+                break;
+            case 'pkgdesc':
+                info.description = value;
+                break;
+            case 'url':
+                info.projectUrl = value;
+                break;
+            case 'builddate':
+                info.buildDate = goParseInt(value, key) ?? info.buildDate;
+                break;
+            case 'size':
+                info.installedSize = goParseInt(value, key) ?? info.installedSize;
+                break;
+            case 'arch':
+                info.architecture = value;
+                break;
+            case 'origin':
+                info.origin = value;
+                break;
+            case 'commit':
+                info.commit = value;
+                break;
+            case 'maintainer':
+                info.maintainer = value;
+                break;
+            case 'packager':
+                info.packager = value;
+                break;
+            case 'license':
+                info.license = value;
+                break;
+            case 'install_if':
+                info.installIf = value;
+                break;
+            case 'provides':
+            case 'depend':
+                if (value !== '') {
+                    if (info.provides.length + info.dependencies.length >= limitsArg.maxEntries) {
+                        throw limitExceeded('maxEntries', limitsArg.maxEntries, '.PKGINFO provides and depend values');
+                    }
+                    (key === 'provides' ? info.provides : info.dependencies).push(value);
+                }
+                break;
+            case 'provider_priority':
+                info.providerPriority = goParseInt(value, key) ?? info.providerPriority;
+                break;
+        }
+    }
+    if (info.name === '') {
+        throw new LinuxRepoError('missing-field', '.PKGINFO has no pkgname', { field: 'pkgname' });
+    }
+    if (info.version === '') {
+        throw new LinuxRepoError('missing-field', '.PKGINFO has no pkgver', { field: 'pkgver' });
+    }
+    if (!isValidUrl(info.projectUrl)) {
+        info.projectUrl = '';
+    }
+    return info;
+}
+/** `bufio.ScanLines` over the bytes, each line decoded as Gitea stores it. */
+function* scanLines(bytesArg, maxLineBytesArg) {
+    let start = 0;
+    while (start < bytesArg.length) {
+        const newline = bytesArg.indexOf(0x0a, start);
+        const end = newline < 0 ? bytesArg.length : newline;
+        let lineEnd = end;
+        if (lineEnd > start && bytesArg[lineEnd - 1] === 0x0d) {
+            lineEnd -= 1;
+        }
+        if (lineEnd - start > maxLineBytesArg) {
+            throw limitExceeded('maxHeaderBytes', maxLineBytesArg, '.PKGINFO line');
+        }
+        yield decodeGoUtf8(bytesArg.subarray(start, lineEnd));
+        start = newline < 0 ? bytesArg.length : newline + 1;
+    }
+}
+/**
+ * Go `strconv.ParseInt(value, 10, 64)`: `null` where Go returns an error (Gitea
+ * then keeps the previous value); `invalid-field` for an int64 beyond the safe
+ * JSON integer range.
+ */
+function goParseInt(valueArg, fieldArg) {
+    const value = goParseInt64(valueArg);
+    if (value === null) {
+        return null;
+    }
+    if (value > MAX_SAFE || value < -MAX_SAFE) {
+        throw new LinuxRepoError('invalid-field', `.PKGINFO ${fieldArg} is beyond the safe integer range`, {
+            field: fieldArg,
+            value: valueArg,
+        });
+    }
+    return Number(value) + 0;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGtnaW5mby5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2FscGluZS9wa2dpbmZvLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFcEUsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUNuRSxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDOUMsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBc0JsRCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLENBQUM7QUFFakQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBdUJHO0FBQ0gsTUFBTSxVQUFVLHNCQUFzQixDQUFDLFFBQW9CLEVBQUUsU0FBd0M7SUFDbkcsTUFBTSxJQUFJLEdBQXVCO1FBQy9CLElBQUksRUFBRSxFQUFFO1FBQ1IsT0FBTyxFQUFFLEVBQUU7UUFDWCxZQUFZLEVBQUUsRUFBRTtRQUNoQixXQUFXLEVBQUUsRUFBRTtRQUNmLE9BQU8sRUFBRSxFQUFFO1FBQ1gsVUFBVSxFQUFFLEVBQUU7UUFDZCxVQUFVLEVBQUUsRUFBRTtRQUNkLFFBQVEsRUFBRSxFQUFFO1FBQ1osU0FBUyxFQUFFLENBQUM7UUFDWixhQUFhLEVBQUUsQ0FBQztRQUNoQixNQUFNLEVBQUUsRUFBRTtRQUNWLE1BQU0sRUFBRSxFQUFFO1FBQ1YsU0FBUyxFQUFFLEVBQUU7UUFDYixRQUFRLEVBQUUsRUFBRTtRQUNaLFlBQVksRUFBRSxFQUFFO1FBQ2hCLGdCQUFnQixFQUFFLENBQUM7S0FDcEIsQ0FBQztJQUNGLEtBQUssTUFBTSxJQUFJLElBQUksU0FBUyxDQUFDLFFBQVEsRUFBRSxTQUFTLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUNqRSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN6QixTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDakMsSUFBSSxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDZixTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sR0FBRyxHQUFHLFdBQVcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9DLE1BQU0sS0FBSyxHQUFHLFdBQVcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xELFFBQVEsR0FBRyxFQUFFLENBQUM7WUFDWixLQUFLLFNBQVM7Z0JBQ1osSUFBSSxDQUFDLElBQUksR0FBRyxLQUFLLENBQUM7Z0JBQ2xCLE1BQU07WUFDUixLQUFLLFFBQVE7Z0JBQ1gsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7Z0JBQ3JCLE1BQU07WUFDUixLQUFLLFNBQVM7Z0JBQ1osSUFBSSxDQUFDLFdBQVcsR0FBRyxLQUFLLENBQUM7Z0JBQ3pCLE1BQU07WUFDUixLQUFLLEtBQUs7Z0JBQ1IsSUFBSSxDQUFDLFVBQVUsR0FBRyxLQUFLLENBQUM7Z0JBQ3hCLE1BQU07WUFDUixLQUFLLFdBQVc7Z0JBQ2QsSUFBSSxDQUFDLFNBQVMsR0FBRyxVQUFVLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUM7Z0JBQzFELE1BQU07WUFDUixLQUFLLE1BQU07Z0JBQ1QsSUFBSSxDQUFDLGFBQWEsR0FBRyxVQUFVLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxhQUFhLENBQUM7Z0JBQ2xFLE1BQU07WUFDUixLQUFLLE1BQU07Z0JBQ1QsSUFBSSxDQUFDLFlBQVksR0FBRyxLQUFLLENBQUM7Z0JBQzFCLE1BQU07WUFDUixLQUFLLFFBQVE7Z0JBQ1gsSUFBSSxDQUFDLE1BQU0sR0FBRyxLQUFLLENBQUM7Z0JBQ3BCLE1BQU07WUFDUixLQUFLLFFBQVE7Z0JBQ1gsSUFBSSxDQUFDLE1BQU0sR0FBRyxLQUFLLENBQUM7Z0JBQ3BCLE1BQU07WUFDUixLQUFLLFlBQVk7Z0JBQ2YsSUFBSSxDQUFDLFVBQVUsR0FBRyxLQUFLLENBQUM7Z0JBQ3hCLE1BQU07WUFDUixLQUFLLFVBQVU7Z0JBQ2IsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUM7Z0JBQ3RCLE1BQU07WUFDUixLQUFLLFNBQVM7Z0JBQ1osSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7Z0JBQ3JCLE1BQU07WUFDUixLQUFLLFlBQVk7Z0JBQ2YsSUFBSSxDQUFDLFNBQVMsR0FBRyxLQUFLLENBQUM7Z0JBQ3ZCLE1BQU07WUFDUixLQUFLLFVBQVUsQ0FBQztZQUNoQixLQUFLLFFBQVE7Z0JBQ1gsSUFBSSxLQUFLLEtBQUssRUFBRSxFQUFFLENBQUM7b0JBQ2pCLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLElBQUksU0FBUyxDQUFDLFVBQVUsRUFBRSxDQUFDO3dCQUM1RSxNQUFNLGFBQWEsQ0FBQyxZQUFZLEVBQUUsU0FBUyxDQUFDLFVBQVUsRUFBRSxxQ0FBcUMsQ0FBQyxDQUFDO29CQUNqRyxDQUFDO29CQUNELENBQUMsR0FBRyxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDdkUsQ0FBQztnQkFDRCxNQUFNO1lBQ1IsS0FBSyxtQkFBbUI7Z0JBQ3RCLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxVQUFVLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztnQkFDeEUsTUFBTTtRQUNWLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsSUFBSSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLHlCQUF5QixFQUFFLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUN4QixNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSx3QkFBd0IsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQzNGLENBQUM7SUFDRCxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ2pDLElBQUksQ0FBQyxVQUFVLEdBQUcsRUFBRSxDQUFDO0lBQ3ZCLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUM7QUFFRCw4RUFBOEU7QUFDOUUsUUFBUSxDQUFDLENBQUMsU0FBUyxDQUFDLFFBQW9CLEVBQUUsZUFBdUI7SUFDL0QsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsT0FBTyxLQUFLLEdBQUcsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQy9CLE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzlDLE1BQU0sR0FBRyxHQUFHLE9BQU8sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztRQUNwRCxJQUFJLE9BQU8sR0FBRyxHQUFHLENBQUM7UUFDbEIsSUFBSSxPQUFPLEdBQUcsS0FBSyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEdBQUcsQ0FBQyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdEQsT0FBTyxJQUFJLENBQUMsQ0FBQztRQUNmLENBQUM7UUFDRCxJQUFJLE9BQU8sR0FBRyxLQUFLLEdBQUcsZUFBZSxFQUFFLENBQUM7WUFDdEMsTUFBTSxhQUFhLENBQUMsZ0JBQWdCLEVBQUUsZUFBZSxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxNQUFNLFlBQVksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQ3RELEtBQUssR0FBRyxPQUFPLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxPQUFPLEdBQUcsQ0FBQyxDQUFDO0lBQ3RELENBQUM7QUFDSCxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILFNBQVMsVUFBVSxDQUFDLFFBQWdCLEVBQUUsUUFBZ0I7SUFDcEQsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3JDLElBQUksS0FBSyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ25CLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELElBQUksS0FBSyxHQUFHLFFBQVEsSUFBSSxLQUFLLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUMxQyxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxZQUFZLFFBQVEsbUNBQW1DLEVBQUU7WUFDakcsS0FBSyxFQUFFLFFBQVE7WUFDZixLQUFLLEVBQUUsUUFBUTtTQUNoQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQzNCLENBQUMifQ==

package/dist_ts/alpine/reader.d.ts

@@ -0,0 +1,20 @@
+import { type ILinuxPackageLimits } from '../shared/limits.js';
+import type { IAlpinePackageRecord } from '../shared/types.js';
+/**
+ * Reads an apk v2 package (concatenated gzip members: usually the signature,
+ * the control segment holding `.PKGINFO`, and the data) into a record, as
+ * Gitea 28.2.0's `ParsePackage` does (`modules/packages/alpine/metadata.go:77-134`):
+ * - gzip members are read one at a time; the first member whose tar holds an
+ *   entry named exactly `.PKGINFO` is the control segment. Unsigned packages
+ *   (no signature member) are accepted;
+ * - `digests.controlSha1` is the SHA-1 of exactly that member's bytes (the
+ *   APKINDEX `C:` value is `Q1` plus its base64);
+ * - the rest of the input is hashed, never decompressed;
+ * - the record's `fileName` is Gitea's `{name}-{version}.apk`.
+ *
+ * Each member read before the control segment is buffered and bounded by
+ * `maxMetadataBytes` (member bytes) and `maxDecompressedMetadataBytes` (its
+ * tar). An apk v3 (ADB) package is `unsupported-package-format`, as Gitea
+ * refuses it too. On failure the reader stops pulling and returns no record.
+ */
+export declare function readAlpinePackage(sourceArg: AsyncIterable<Uint8Array>, limitsArg?: Partial<ILinuxPackageLimits>): Promise<IAlpinePackageRecord>;