@push.rocks/smartlinuxrepo 0.0.0-stage → 1.0.0

package/dist_ts/arch/reader.js

@@ -0,0 +1,271 @@
+import { LinuxRepoError, limitExceeded } from '../shared/errors.js';
+import { goPathBase, goPathClean } from '../shared/gopath.js';
+import { resolveLinuxPackageLimits } from '../shared/limits.js';
+import { isValidUrl } from '../shared/url.js';
+import { readUpTo, skipToEnd } from '../readers/bytes.js';
+import { PackageByteSource } from '../readers/bytesource.js';
+import { withDecompressingReader } from '../readers/decompress.js';
+import { readTarEntryData, TarReader } from '../readers/tar.js';
+import { decodeGoUtf8 } from '../readers/text.js';
+import { goParseInt64, goTrimSpace } from '../shared/gostrings.js';
+/** Gitea `namePattern` (`modules/packages/arch/metadata.go:47`). */
+export const ARCH_NAME_PATTERN = /^[a-zA-Z0-9@._+-]+$/;
+/** Gitea `versionPattern` (`metadata.go:49`); Go's `\d` and `\w` are ASCII, as in a JS RegExp without `u`. */
+export const ARCH_VERSION_PATTERN = /^(?:\d:)?[\w.+~]+(?:-[-\w.+~]+)?$/;
+const MAGIC_BYTES = 10;
+const GO_C_ISDIR = 0o40000;
+/**
+ * Reads an Arch package (`.pkg.tar.zst`, `.xz` or `.gz`, chosen by magic as
+ * Gitea 28.2.0 does) into a record: `.PKGINFO` metadata and the file list,
+ * derived exactly as Gitea's `arch.ParsePackage`, plus the size and digests of
+ * the whole file. The whole payload is decompressed (bounded by
+ * `maxPayloadBytes`) because the file list needs every tar entry, and to the
+ * end of the compressed stream, so a cut or corrupt container is refused
+ * even where it lies past the tar end marker (Go stops reading there).
+ */
+export async function readArchPackage(sourceArg, limitsArg) {
+    const limits = resolveLinuxPackageLimits(limitsArg);
+    const source = new PackageByteSource(sourceArg, limits.maxPackageBytes);
+    const magic = await readUpTo(source, MAGIC_BYTES);
+    source.unread(magic);
+    const container = detectContainer(magic);
+    if (container === null) {
+        throw new LinuxRepoError('unsupported-compression', 'not a zst, xz or gz compressed Arch package', {
+            field: 'compression',
+        });
+    }
+    const walked = await withDecompressingReader(source, container.decoder, { maxOutputBytes: limits.maxPayloadBytes, outputLimit: 'maxPayloadBytes' }, async (payloadArg) => {
+        const result = await walkPayload(new TarReader(payloadArg, { maxEntries: limits.maxEntries, maxHeaderBytes: limits.maxHeaderBytes }), limits);
+        // Go stops at the tar end marker; the codec decodes the rest of the
+        // stream as well, so a package cut or corrupted after the marker fails
+        // loudly instead of being stored and signed
+        await skipToEnd(payloadArg);
+        return result;
+    });
+    if (walked.info === null) {
+        throw new LinuxRepoError('missing-field', '.PKGINFO file is missing', { field: '.PKGINFO' });
+    }
+    await source.drain();
+    const info = walked.info;
+    return {
+        format: 'arch',
+        name: info.name,
+        version: info.version,
+        architecture: info.architecture,
+        fileName: `${info.name}-${info.version}-${info.architecture}.pkg.tar.${container.extension}`,
+        digests: source.digests(),
+        metadata: {
+            compression: container.extension,
+            ...info.metadata,
+            files: walked.files,
+        },
+    };
+}
+function detectContainer(magicArg) {
+    const startsWith = (bytesArg) => bytesArg.every((byte, index) => magicArg[index] === byte);
+    if (startsWith([0x28, 0xb5, 0x2f, 0xfd])) {
+        return { extension: 'zst', decoder: 'zstd' };
+    }
+    if (startsWith([0xfd, 0x37, 0x7a, 0x58, 0x5a])) {
+        return { extension: 'xz', decoder: 'xz' };
+    }
+    if (startsWith([0x1f, 0x8b])) {
+        return { extension: 'gz', decoder: 'gzip' };
+    }
+    return null;
+}
+/**
+ * Gitea's tar walk (`metadata.go:135-163`): regular entries only; a regular
+ * entry whose base name is `.PKGINFO` is parsed (a later one replaces an
+ * earlier one); every other regular entry whose base name does not start with
+ * `.` and whose name holds no CR or LF joins the file list, in archive order.
+ */
+async function walkPayload(tarArg, limitsArg) {
+    let info = null;
+    const files = [];
+    let fileBytes = 0;
+    for (;;) {
+        const entry = await tarArg.next();
+        if (entry === null) {
+            break;
+        }
+        if (entry.typeflag !== '0') {
+            continue;
+        }
+        const base = fileInfoName(entry);
+        if (base === '.PKGINFO') {
+            const data = await readTarEntryData(entry, limitsArg.maxDecompressedMetadataBytes, 'maxDecompressedMetadataBytes');
+            info = parsePackageInfo(data, limitsArg);
+        }
+        else if (!base.startsWith('.')) {
+            if (/[\n\r]/.test(entry.name)) {
+                continue;
+            }
+            // Gitea's BoundedFileList: entry count and total name bytes
+            const nameBytes = Buffer.byteLength(entry.name, 'utf8');
+            if (files.length >= limitsArg.maxEntries) {
+                throw limitExceeded('maxEntries', limitsArg.maxEntries, 'Arch file list');
+            }
+            if (fileBytes + nameBytes > limitsArg.maxFileListBytes) {
+                throw limitExceeded('maxFileListBytes', limitsArg.maxFileListBytes, 'Arch file list');
+            }
+            fileBytes += nameBytes;
+            files.push(entry.name);
+        }
+    }
+    return { info, files };
+}
+/** Go `tar.Header.FileInfo().Name()` for a regular entry: `path.Base`, after `path.Clean` when the mode marks a directory. */
+function fileInfoName(entryArg) {
+    const typeBits = (Number(BigInt.asUintN(32, entryArg.mode)) & ~0o7777) >>> 0;
+    if (typeBits === GO_C_ISDIR) {
+        return goPathBase(goPathClean(entryArg.name));
+    }
+    return goPathBase(entryArg.name);
+}
+const MULTI_VALUE_KEYS = {
+    license: 'licenses',
+    provides: 'provides',
+    depend: 'depends',
+    replaces: 'replaces',
+    optdepend: 'optDepends',
+    makedepend: 'makeDepends',
+    checkdepend: 'checkDepends',
+    conflict: 'conflicts',
+    backup: 'backup',
+    group: 'groups',
+    xdata: 'xdata',
+};
+/**
+ * Gitea's `ParsePackageInfo` (`metadata.go:178-267`): lines as Go's
+ * `bufio.ScanLines` splits them (a trailing CR dropped), `#` lines and lines
+ * without `=` skipped, key and value `strings.TrimSpace`d, single values last
+ * one wins, `builddate` and `size` parsed as int64 (an unparsable value
+ * refuses the package), then the name, version and architecture checks and
+ * the URL check. Lines are bounded by `maxHeaderBytes` (Gitea: 64 KiB) and
+ * each multi-valued key by `maxEntries`.
+ */
+function parsePackageInfo(dataArg, limitsArg) {
+    const info = {
+        name: '',
+        version: '',
+        architecture: '',
+        metadata: {
+            base: '',
+            description: '',
+            projectUrl: '',
+            licenses: [],
+            installedSize: 0,
+            buildDate: 0,
+            packager: '',
+            groups: [],
+            provides: [],
+            replaces: [],
+            depends: [],
+            optDepends: [],
+            makeDepends: [],
+            checkDepends: [],
+            conflicts: [],
+            xdata: [],
+            backup: [],
+        },
+    };
+    for (const rawLine of splitLines(dataArg, limitsArg.maxHeaderBytes)) {
+        const line = decodeGoUtf8(rawLine);
+        if (line.startsWith('#')) {
+            continue;
+        }
+        const equals = line.indexOf('=');
+        if (equals < 0) {
+            continue;
+        }
+        const key = goTrimSpace(line.slice(0, equals));
+        const value = goTrimSpace(line.slice(equals + 1));
+        switch (key) {
+            case 'pkgname':
+                info.name = value;
+                break;
+            case 'pkgbase':
+                info.metadata.base = value;
+                break;
+            case 'pkgver':
+                info.version = value;
+                break;
+            case 'pkgdesc':
+                info.metadata.description = value;
+                break;
+            case 'url':
+                info.metadata.projectUrl = value;
+                break;
+            case 'packager':
+                info.metadata.packager = value;
+                break;
+            case 'arch':
+                info.architecture = value;
+                break;
+            case 'builddate':
+                info.metadata.buildDate = parseInteger(value, 'builddate');
+                break;
+            case 'size':
+                info.metadata.installedSize = parseInteger(value, 'size');
+                break;
+            default:
+                if (Object.hasOwn(MULTI_VALUE_KEYS, key)) {
+                    const list = info.metadata[MULTI_VALUE_KEYS[key]];
+                    if (list.length >= limitsArg.maxEntries) {
+                        throw limitExceeded('maxEntries', limitsArg.maxEntries, `.PKGINFO ${key} values`);
+                    }
+                    list.push(value);
+                }
+        }
+    }
+    if (!ARCH_NAME_PATTERN.test(info.name)) {
+        throw new LinuxRepoError('invalid-field', 'package name is invalid', { field: 'pkgname' });
+    }
+    if (!ARCH_VERSION_PATTERN.test(info.version)) {
+        throw new LinuxRepoError('invalid-field', 'package version is invalid', { field: 'pkgver' });
+    }
+    if (info.architecture === '') {
+        throw new LinuxRepoError('invalid-field', 'package architecture is invalid', { field: 'arch' });
+    }
+    if (!isValidUrl(info.metadata.projectUrl)) {
+        info.metadata.projectUrl = '';
+    }
+    return info;
+}
+/** int64 as Go parses it; values outside the safe integer range cannot live in a JSON record. */
+function parseInteger(valueArg, fieldArg) {
+    const value = goParseInt64(valueArg);
+    if (value === null) {
+        throw new LinuxRepoError('invalid-field', `.PKGINFO ${fieldArg} is not an integer`, { field: fieldArg });
+    }
+    if (value > BigInt(Number.MAX_SAFE_INTEGER) || value < BigInt(Number.MIN_SAFE_INTEGER)) {
+        throw new LinuxRepoError('invalid-field', `.PKGINFO ${fieldArg} is outside the safe integer range`, {
+            field: fieldArg,
+        });
+    }
+    return Number(value);
+}
+/** Go `bufio.ScanLines`: split at LF, drop one trailing CR, keep a final unterminated line when non-empty. */
+function splitLines(dataArg, maxLineBytesArg) {
+    const lines = [];
+    let start = 0;
+    while (start < dataArg.length) {
+        let end = dataArg.indexOf(0x0a, start);
+        const terminated = end >= 0;
+        if (!terminated) {
+            end = dataArg.length;
+        }
+        if (end - start > maxLineBytesArg) {
+            throw limitExceeded('maxHeaderBytes', maxLineBytesArg, '.PKGINFO line');
+        }
+        let line = dataArg.subarray(start, end);
+        if (line.length > 0 && line[line.length - 1] === 0x0d) {
+            line = line.subarray(0, line.length - 1);
+        }
+        lines.push(line);
+        start = terminated ? end + 1 : end;
+    }
+    return lines;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVhZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvYXJjaC9yZWFkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGNBQWMsRUFBRSxhQUFhLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNwRSxPQUFPLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQzlELE9BQU8sRUFBRSx5QkFBeUIsRUFBNEIsTUFBTSxxQkFBcUIsQ0FBQztBQUUxRixPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDOUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUMxRCxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQUM3RCxPQUFPLEVBQUUsdUJBQXVCLEVBQTBCLE1BQU0sMEJBQTBCLENBQUM7QUFDM0YsT0FBTyxFQUFFLGdCQUFnQixFQUFFLFNBQVMsRUFBa0IsTUFBTSxtQkFBbUIsQ0FBQztBQUNoRixPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDbEQsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUVuRSxvRUFBb0U7QUFDcEUsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQUcscUJBQXFCLENBQUM7QUFDdkQsOEdBQThHO0FBQzlHLE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLG1DQUFtQyxDQUFDO0FBRXhFLE1BQU0sV0FBVyxHQUFHLEVBQUUsQ0FBQztBQUN2QixNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUM7QUFTM0I7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGVBQWUsQ0FDbkMsU0FBb0MsRUFDcEMsU0FBd0M7SUFFeEMsTUFBTSxNQUFNLEdBQUcseUJBQXlCLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDcEQsTUFBTSxNQUFNLEdBQUcsSUFBSSxpQkFBaUIsQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLGVBQWUsQ0FBQyxDQUFDO0lBRXhFLE1BQU0sS0FBSyxHQUFHLE1BQU0sUUFBUSxDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUMsQ0FBQztJQUNsRCxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3JCLE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN6QyxJQUFJLFNBQVMsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksY0FBYyxDQUFDLHlCQUF5QixFQUFFLDZDQUE2QyxFQUFFO1lBQ2pHLEtBQUssRUFBRSxhQUFhO1NBQ3JCLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxNQUFNLHVCQUF1QixDQUMxQyxNQUFNLEVBQ04sU0FBUyxDQUFDLE9BQU8sRUFDakIsRUFBRSxjQUFjLEVBQUUsTUFBTSxDQUFDLGVBQWUsRUFBRSxXQUFXLEVBQUUsaUJBQWlCLEVBQUUsRUFDMUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxFQUFFO1FBQ25CLE1BQU0sTUFBTSxHQUFHLE1BQU0sV0FBVyxDQUM5QixJQUFJLFNBQVMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRSxjQUFjLEVBQUUsTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDLEVBQ25HLE1BQU0sQ0FDUCxDQUFDO1FBQ0Ysb0VBQW9FO1FBQ3BFLHVFQUF1RTtRQUN2RSw0Q0FBNEM7UUFDNUMsTUFBTSxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDNUIsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQyxDQUNGLENBQUM7SUFDRixJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDekIsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsMEJBQTBCLEVBQUUsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsTUFBTSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDckIsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztJQUN6QixPQUFPO1FBQ0wsTUFBTSxFQUFFLE1BQU07UUFDZCxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7UUFDZixPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU87UUFDckIsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1FBQy9CLFFBQVEsRUFBRSxHQUFHLElBQUksQ0FBQyxJQUFJLElBQUksSUFBSSxDQUFDLE9BQU8sSUFBSSxJQUFJLENBQUMsWUFBWSxZQUFZLFNBQVMsQ0FBQyxTQUFTLEVBQUU7UUFDNUYsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLEVBQUU7UUFDekIsUUFBUSxFQUFFO1lBQ1IsV0FBVyxFQUFFLFNBQVMsQ0FBQyxTQUFTO1lBQ2hDLEdBQUcsSUFBSSxDQUFDLFFBQVE7WUFDaEIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLO1NBQ3BCO0tBQ0YsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLGVBQWUsQ0FDdEIsUUFBb0I7SUFFcEIsTUFBTSxVQUFVLEdBQUcsQ0FBQyxRQUFrQixFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQ3JHLElBQUksVUFBVSxDQUFDLENBQUMsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3pDLE9BQU8sRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsQ0FBQztJQUMvQyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQy9DLE9BQU8sRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUM1QyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzdCLE9BQU8sRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsQ0FBQztJQUM5QyxDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxLQUFLLFVBQVUsV0FBVyxDQUN4QixNQUFpQixFQUNqQixTQUF3QztJQUV4QyxJQUFJLElBQUksR0FBd0IsSUFBSSxDQUFDO0lBQ3JDLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUMzQixJQUFJLFNBQVMsR0FBRyxDQUFDLENBQUM7SUFDbEIsU0FBUyxDQUFDO1FBQ1IsTUFBTSxLQUFLLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbEMsSUFBSSxLQUFLLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDbkIsTUFBTTtRQUNSLENBQUM7UUFDRCxJQUFJLEtBQUssQ0FBQyxRQUFRLEtBQUssR0FBRyxFQUFFLENBQUM7WUFDM0IsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDakMsSUFBSSxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDeEIsTUFBTSxJQUFJLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLDRCQUE0QixFQUFFLDhCQUE4QixDQUFDLENBQUM7WUFDbkgsSUFBSSxHQUFHLGdCQUFnQixDQUFDLElBQUksRUFBRSxTQUFTLENBQUMsQ0FBQztRQUMzQyxDQUFDO2FBQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNqQyxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7Z0JBQzlCLFNBQVM7WUFDWCxDQUFDO1lBQ0QsNERBQTREO1lBQzVELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztZQUN4RCxJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksU0FBUyxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUN6QyxNQUFNLGFBQWEsQ0FBQyxZQUFZLEVBQUUsU0FBUyxDQUFDLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1lBQzVFLENBQUM7WUFDRCxJQUFJLFNBQVMsR0FBRyxTQUFTLEdBQUcsU0FBUyxDQUFDLGdCQUFnQixFQUFFLENBQUM7Z0JBQ3ZELE1BQU0sYUFBYSxDQUFDLGtCQUFrQixFQUFFLFNBQVMsQ0FBQyxnQkFBZ0IsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1lBQ3hGLENBQUM7WUFDRCxTQUFTLElBQUksU0FBUyxDQUFDO1lBQ3ZCLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3pCLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQztBQUN6QixDQUFDO0FBRUQsOEhBQThIO0FBQzlILFNBQVMsWUFBWSxDQUFDLFFBQW1CO0lBQ3ZDLE1BQU0sUUFBUSxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxFQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzdFLElBQUksUUFBUSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQzVCLE9BQU8sVUFBVSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUNoRCxDQUFDO0lBQ0QsT0FBTyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ25DLENBQUM7QUFFRCxNQUFNLGdCQUFnQixHQUFHO0lBQ3ZCLE9BQU8sRUFBRSxVQUFVO0lBQ25CLFFBQVEsRUFBRSxVQUFVO0lBQ3BCLE1BQU0sRUFBRSxTQUFTO0lBQ2pCLFFBQVEsRUFBRSxVQUFVO0lBQ3BCLFNBQVMsRUFBRSxZQUFZO0lBQ3ZCLFVBQVUsRUFBRSxhQUFhO0lBQ3pCLFdBQVcsRUFBRSxjQUFjO0lBQzNCLFFBQVEsRUFBRSxXQUFXO0lBQ3JCLE1BQU0sRUFBRSxRQUFRO0lBQ2hCLEtBQUssRUFBRSxRQUFRO0lBQ2YsS0FBSyxFQUFFLE9BQU87Q0FDTixDQUFDO0FBSVg7Ozs7Ozs7O0dBUUc7QUFDSCxTQUFTLGdCQUFnQixDQUFDLE9BQW1CLEVBQUUsU0FBd0M7SUFDckYsTUFBTSxJQUFJLEdBQWlCO1FBQ3pCLElBQUksRUFBRSxFQUFFO1FBQ1IsT0FBTyxFQUFFLEVBQUU7UUFDWCxZQUFZLEVBQUUsRUFBRTtRQUNoQixRQUFRLEVBQUU7WUFDUixJQUFJLEVBQUUsRUFBRTtZQUNSLFdBQVcsRUFBRSxFQUFFO1lBQ2YsVUFBVSxFQUFFLEVBQUU7WUFDZCxRQUFRLEVBQUUsRUFBRTtZQUNaLGFBQWEsRUFBRSxDQUFDO1lBQ2hCLFNBQVMsRUFBRSxDQUFDO1lBQ1osUUFBUSxFQUFFLEVBQUU7WUFDWixNQUFNLEVBQUUsRUFBRTtZQUNWLFFBQVEsRUFBRSxFQUFFO1lBQ1osUUFBUSxFQUFFLEVBQUU7WUFDWixPQUFPLEVBQUUsRUFBRTtZQUNYLFVBQVUsRUFBRSxFQUFFO1lBQ2QsV0FBVyxFQUFFLEVBQUU7WUFDZixZQUFZLEVBQUUsRUFBRTtZQUNoQixTQUFTLEVBQUUsRUFBRTtZQUNiLEtBQUssRUFBRSxFQUFFO1lBQ1QsTUFBTSxFQUFFLEVBQUU7U0FDWDtLQUNGLENBQUM7SUFDRixLQUFLLE1BQU0sT0FBTyxJQUFJLFVBQVUsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxJQUFJLEdBQUcsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ25DLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3pCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNqQyxJQUFJLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNmLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxHQUFHLEdBQUcsV0FBVyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDL0MsTUFBTSxLQUFLLEdBQUcsV0FBVyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbEQsUUFBUSxHQUFHLEVBQUUsQ0FBQztZQUNaLEtBQUssU0FBUztnQkFDWixJQUFJLENBQUMsSUFBSSxHQUFHLEtBQUssQ0FBQztnQkFDbEIsTUFBTTtZQUNSLEtBQUssU0FBUztnQkFDWixJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksR0FBRyxLQUFLLENBQUM7Z0JBQzNCLE1BQU07WUFDUixLQUFLLFFBQVE7Z0JBQ1gsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7Z0JBQ3JCLE1BQU07WUFDUixLQUFLLFNBQVM7Z0JBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLEdBQUcsS0FBSyxDQUFDO2dCQUNsQyxNQUFNO1lBQ1IsS0FBSyxLQUFLO2dCQUNSLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxHQUFHLEtBQUssQ0FBQztnQkFDakMsTUFBTTtZQUNSLEtBQUssVUFBVTtnQkFDYixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUM7Z0JBQy9CLE1BQU07WUFDUixLQUFLLE1BQU07Z0JBQ1QsSUFBSSxDQUFDLFlBQVksR0FBRyxLQUFLLENBQUM7Z0JBQzFCLE1BQU07WUFDUixLQUFLLFdBQVc7Z0JBQ2QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEdBQUcsWUFBWSxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsQ0FBQztnQkFDM0QsTUFBTTtZQUNSLEtBQUssTUFBTTtnQkFDVCxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsR0FBRyxZQUFZLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO2dCQUMxRCxNQUFNO1lBQ1I7Z0JBQ0UsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLGdCQUFnQixFQUFFLEdBQUcsQ0FBQyxFQUFFLENBQUM7b0JBQ3pDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLENBQUMsR0FBcUIsQ0FBQyxDQUFDLENBQUM7b0JBQ3BFLElBQUksSUFBSSxDQUFDLE1BQU0sSUFBSSxTQUFTLENBQUMsVUFBVSxFQUFFLENBQUM7d0JBQ3hDLE1BQU0sYUFBYSxDQUFDLFlBQVksRUFBRSxTQUFTLENBQUMsVUFBVSxFQUFFLFlBQVksR0FBRyxTQUFTLENBQUMsQ0FBQztvQkFDcEYsQ0FBQztvQkFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNuQixDQUFDO1FBQ0wsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLHlCQUF5QixFQUFFLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDN0MsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsNEJBQTRCLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsWUFBWSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzdCLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLGlDQUFpQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzFDLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxHQUFHLEVBQUUsQ0FBQztJQUNoQyxDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDO0FBRUQsaUdBQWlHO0FBQ2pHLFNBQVMsWUFBWSxDQUFDLFFBQWdCLEVBQUUsUUFBZ0I7SUFDdEQsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3JDLElBQUksS0FBSyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ25CLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLFlBQVksUUFBUSxvQkFBb0IsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQzNHLENBQUM7SUFDRCxJQUFJLEtBQUssR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO1FBQ3ZGLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLFlBQVksUUFBUSxvQ0FBb0MsRUFBRTtZQUNsRyxLQUFLLEVBQUUsUUFBUTtTQUNoQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDdkIsQ0FBQztBQUVELDhHQUE4RztBQUM5RyxTQUFTLFVBQVUsQ0FBQyxPQUFtQixFQUFFLGVBQXVCO0lBQzlELE1BQU0sS0FBSyxHQUFpQixFQUFFLENBQUM7SUFDL0IsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsT0FBTyxLQUFLLEdBQUcsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzlCLElBQUksR0FBRyxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3ZDLE1BQU0sVUFBVSxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUM7UUFDNUIsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ2hCLEdBQUcsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQ3ZCLENBQUM7UUFDRCxJQUFJLEdBQUcsR0FBRyxLQUFLLEdBQUcsZUFBZSxFQUFFLENBQUM7WUFDbEMsTUFBTSxhQUFhLENBQUMsZ0JBQWdCLEVBQUUsZUFBZSxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLElBQUksR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsQ0FBQztRQUN4QyxJQUFJLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3RELElBQUksR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQzNDLENBQUM7UUFDRCxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2pCLEtBQUssR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztJQUNyQyxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDIn0=

package/dist_ts/arch/signer.d.ts

@@ -0,0 +1,21 @@
+import { type ILinuxPackageLimits } from '../shared/limits.js';
+import type { IOpenPgpSigner } from '../signing/signers.js';
+/**
+ * Signs an Arch package at upload time, as Gitea 28.2.0 signs every upload
+ * (`routers/api/packages/arch/arch.go:83`, `openpgp.DetachSign`): returns the
+ * `.sig` file, one binary detached signature packet over the package bytes.
+ * The package streams to the signer once, counted against `maxPackageBytes`
+ * of `limits` (pass the limits the package was read with); the codec keeps no
+ * copy, but the built-in OpenPGP signer still holds it in memory: openpgp.js
+ * buffers the whole document when detach-signing a stream.
+ * A failure of the package stream (the limit, or the caller's source error
+ * unchanged) wins over whatever the signer made of it. Pass the result as the index
+ * entry's `packageSignature`. Imported packages keep their stored signature
+ * and are never re-signed.
+ */
+export declare function signArchPackage(inputArg: {
+    source: AsyncIterable<Uint8Array>;
+    signer: IOpenPgpSigner;
+    timestamp: Date;
+    limits?: Partial<ILinuxPackageLimits>;
+}): Promise<Uint8Array>;

package/dist_ts/arch/signer.js

@@ -0,0 +1,66 @@
+import { LinuxRepoError } from '../shared/errors.js';
+import { resolveLinuxPackageLimits } from '../shared/limits.js';
+import { assertTimestamp } from '../shared/validation.js';
+import { READ_CHUNK_BYTES } from '../readers/bytes.js';
+import { PackageByteSource } from '../readers/bytesource.js';
+import { createDetachedBinarySignature } from '../signing/openpgpframing.js';
+/**
+ * Signs an Arch package at upload time, as Gitea 28.2.0 signs every upload
+ * (`routers/api/packages/arch/arch.go:83`, `openpgp.DetachSign`): returns the
+ * `.sig` file, one binary detached signature packet over the package bytes.
+ * The package streams to the signer once, counted against `maxPackageBytes`
+ * of `limits` (pass the limits the package was read with); the codec keeps no
+ * copy, but the built-in OpenPGP signer still holds it in memory: openpgp.js
+ * buffers the whole document when detach-signing a stream.
+ * A failure of the package stream (the limit, or the caller's source error
+ * unchanged) wins over whatever the signer made of it. Pass the result as the index
+ * entry's `packageSignature`. Imported packages keep their stored signature
+ * and are never re-signed.
+ */
+export async function signArchPackage(inputArg) {
+    if (inputArg === null || typeof inputArg !== 'object') {
+        throw new LinuxRepoError('invalid-input', 'input must be an object', { field: 'input' });
+    }
+    assertTimestamp(inputArg.timestamp);
+    if (inputArg.signer === null || typeof inputArg.signer !== 'object' || typeof inputArg.signer.signBinary !== 'function') {
+        throw new LinuxRepoError('invalid-input', 'signer must be an IOpenPgpSigner', { field: 'signer' });
+    }
+    const limits = resolveLinuxPackageLimits(inputArg.limits);
+    const source = new PackageByteSource(inputArg.source, limits.maxPackageBytes);
+    let ended = false;
+    let failure;
+    const chunks = async function* () {
+        for (;;) {
+            let chunk;
+            try {
+                chunk = await source.read(READ_CHUNK_BYTES);
+            }
+            catch (error) {
+                failure = { error };
+                throw error;
+            }
+            if (chunk === null) {
+                ended = true;
+                return;
+            }
+            yield chunk;
+        }
+    };
+    let packet;
+    try {
+        packet = await createDetachedBinarySignature({ data: chunks(), signer: inputArg.signer, timestamp: inputArg.timestamp });
+    }
+    catch (error) {
+        throw failure !== undefined ? failure.error : error;
+    }
+    if (failure !== undefined) {
+        throw failure.error;
+    }
+    if (!ended) {
+        throw new LinuxRepoError('signing-failed', 'the signer returned before reading the whole package', {
+            field: 'signer',
+        });
+    }
+    return packet;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvYXJjaC9zaWduZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ3JELE9BQU8sRUFBRSx5QkFBeUIsRUFBNEIsTUFBTSxxQkFBcUIsQ0FBQztBQUMxRixPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDMUQsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDdkQsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDN0QsT0FBTyxFQUFFLDZCQUE2QixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFHN0U7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxlQUFlLENBQUMsUUFLckM7SUFDQyxJQUFJLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDdEQsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUseUJBQXlCLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUMzRixDQUFDO0lBQ0QsZUFBZSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNwQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssSUFBSSxJQUFJLE9BQU8sUUFBUSxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksT0FBTyxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUN4SCxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxrQ0FBa0MsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3JHLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyx5QkFBeUIsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDMUQsTUFBTSxNQUFNLEdBQUcsSUFBSSxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxlQUFlLENBQUMsQ0FBQztJQUM5RSxJQUFJLEtBQUssR0FBRyxLQUFLLENBQUM7SUFDbEIsSUFBSSxPQUF1QyxDQUFDO0lBQzVDLE1BQU0sTUFBTSxHQUFHLEtBQUssU0FBUyxDQUFDO1FBQzVCLFNBQVMsQ0FBQztZQUNSLElBQUksS0FBd0IsQ0FBQztZQUM3QixJQUFJLENBQUM7Z0JBQ0gsS0FBSyxHQUFHLE1BQU0sTUFBTSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1lBQzlDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLE9BQU8sR0FBRyxFQUFFLEtBQUssRUFBRSxDQUFDO2dCQUNwQixNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7WUFDRCxJQUFJLEtBQUssS0FBSyxJQUFJLEVBQUUsQ0FBQztnQkFDbkIsS0FBSyxHQUFHLElBQUksQ0FBQztnQkFDYixPQUFPO1lBQ1QsQ0FBQztZQUNELE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztJQUNILENBQUMsQ0FBQztJQUNGLElBQUksTUFBa0IsQ0FBQztJQUN2QixJQUFJLENBQUM7UUFDSCxNQUFNLEdBQUcsTUFBTSw2QkFBNkIsQ0FBQyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDM0gsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQztJQUN0RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDMUIsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDO0lBQ3RCLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksY0FBYyxDQUFDLGdCQUFnQixFQUFFLHNEQUFzRCxFQUFFO1lBQ2pHLEtBQUssRUFBRSxRQUFRO1NBQ2hCLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDIn0=

package/dist_ts/arch/vercmp.d.ts

@@ -0,0 +1,12 @@
+/**
+ * pacman's version comparison: libalpm `alpm_pkg_vercmp` with `parseEVR` and
+ * `rpmvercmp` (`lib/libalpm/version.c`, read from pacman 6.0.2 and checked
+ * against pacman's `vercmp` tool in the Docker gate). Gitea 28.2.0 uses a
+ * simplified comparator (`services/packages/arch/vercmp.go`) that splits on
+ * `.` only and can pick what pacman sees as a downgrade; the codec follows
+ * alpm. Characters are classified as in the C locale.
+ *
+ * Returns 1 when `a` is newer, -1 when `b` is newer, 0 when pacman treats
+ * them as the same version.
+ */
+export declare function compareArchVersions(aArg: string, bArg: string): -1 | 0 | 1;

package/dist_ts/arch/vercmp.js

@@ -0,0 +1,170 @@
+/**
+ * pacman's version comparison: libalpm `alpm_pkg_vercmp` with `parseEVR` and
+ * `rpmvercmp` (`lib/libalpm/version.c`, read from pacman 6.0.2 and checked
+ * against pacman's `vercmp` tool in the Docker gate). Gitea 28.2.0 uses a
+ * simplified comparator (`services/packages/arch/vercmp.go`) that splits on
+ * `.` only and can pick what pacman sees as a downgrade; the codec follows
+ * alpm. Characters are classified as in the C locale.
+ *
+ * Returns 1 when `a` is newer, -1 when `b` is newer, 0 when pacman treats
+ * them as the same version.
+ */
+export function compareArchVersions(aArg, bArg) {
+    if (aArg === bArg) {
+        return 0;
+    }
+    const a = parseEvr(toBytes(aArg));
+    const b = parseEvr(toBytes(bArg));
+    let result = rpmvercmp(a.epoch, b.epoch);
+    if (result === 0) {
+        result = rpmvercmp(a.version, b.version);
+        if (result === 0 && a.release !== null && b.release !== null) {
+            result = rpmvercmp(a.release, b.release);
+        }
+    }
+    return result;
+}
+const ZERO = Uint8Array.of(0x30);
+function toBytes(valueArg) {
+    const bytes = new TextEncoder().encode(valueArg);
+    // a C string ends at the first NUL
+    const nul = bytes.indexOf(0);
+    return nul < 0 ? bytes : bytes.subarray(0, nul);
+}
+/** `parseEVR`: `[epoch:]version[-release]`; the release starts after the last `-`. */
+function parseEvr(evrArg) {
+    let s = 0;
+    while (s < evrArg.length && isDigit(evrArg[s])) {
+        s++;
+    }
+    // strrchr(s, '-') searches from the epoch terminator on
+    let dash = -1;
+    for (let i = evrArg.length - 1; i >= s; i--) {
+        if (evrArg[i] === 0x2d) {
+            dash = i;
+            break;
+        }
+    }
+    let epoch;
+    let versionStart;
+    if (s < evrArg.length && evrArg[s] === 0x3a) {
+        epoch = s === 0 ? ZERO : evrArg.subarray(0, s);
+        versionStart = s + 1;
+    }
+    else {
+        epoch = ZERO;
+        versionStart = 0;
+    }
+    if (dash >= 0) {
+        return { epoch, version: evrArg.subarray(versionStart, dash), release: evrArg.subarray(dash + 1) };
+    }
+    return { epoch, version: evrArg.subarray(versionStart), release: null };
+}
+/** `rpmvercmp` over two C strings. */
+function rpmvercmp(aArg, bArg) {
+    if (compareBytes(aArg, 0, aArg.length, bArg, 0, bArg.length) === 0) {
+        return 0;
+    }
+    const at = (bytesArg, indexArg) => (indexArg < bytesArg.length ? bytesArg[indexArg] : 0);
+    let one = 0;
+    let two = 0;
+    let ptr1 = 0;
+    let ptr2 = 0;
+    while (at(aArg, one) !== 0 && at(bArg, two) !== 0) {
+        while (at(aArg, one) !== 0 && !isAlnum(at(aArg, one))) {
+            one++;
+        }
+        while (at(bArg, two) !== 0 && !isAlnum(at(bArg, two))) {
+            two++;
+        }
+        if (!(at(aArg, one) !== 0 && at(bArg, two) !== 0)) {
+            break;
+        }
+        // separator runs of different length decide
+        if (one - ptr1 !== two - ptr2) {
+            return one - ptr1 < two - ptr2 ? -1 : 1;
+        }
+        ptr1 = one;
+        ptr2 = two;
+        let isNum;
+        if (isDigit(at(aArg, ptr1))) {
+            while (at(aArg, ptr1) !== 0 && isDigit(at(aArg, ptr1))) {
+                ptr1++;
+            }
+            while (at(bArg, ptr2) !== 0 && isDigit(at(bArg, ptr2))) {
+                ptr2++;
+            }
+            isNum = true;
+        }
+        else {
+            while (at(aArg, ptr1) !== 0 && isAlpha(at(aArg, ptr1))) {
+                ptr1++;
+            }
+            while (at(bArg, ptr2) !== 0 && isAlpha(at(bArg, ptr2))) {
+                ptr2++;
+            }
+            isNum = false;
+        }
+        if (one === ptr1) {
+            return -1;
+        }
+        // numeric segments are newer than alpha segments
+        if (two === ptr2) {
+            return isNum ? 1 : -1;
+        }
+        let segment1 = one;
+        let segment2 = two;
+        if (isNum) {
+            while (at(aArg, segment1) === 0x30 && segment1 < ptr1) {
+                segment1++;
+            }
+            while (at(bArg, segment2) === 0x30 && segment2 < ptr2) {
+                segment2++;
+            }
+            if (ptr1 - segment1 > ptr2 - segment2) {
+                return 1;
+            }
+            if (ptr2 - segment2 > ptr1 - segment1) {
+                return -1;
+            }
+        }
+        const rc = compareBytes(aArg, segment1, ptr1, bArg, segment2, ptr2);
+        if (rc !== 0) {
+            return rc;
+        }
+        one = ptr1;
+        two = ptr2;
+    }
+    if (at(aArg, one) === 0 && at(bArg, two) === 0) {
+        return 0;
+    }
+    // a remaining alpha string never beats an empty one
+    if ((at(aArg, one) === 0 && !isAlpha(at(bArg, two))) || isAlpha(at(aArg, one))) {
+        return -1;
+    }
+    return 1;
+}
+/** `strcmp` over two byte ranges. */
+function compareBytes(aArg, aStartArg, aEndArg, bArg, bStartArg, bEndArg) {
+    const length = Math.min(aEndArg - aStartArg, bEndArg - bStartArg);
+    for (let i = 0; i < length; i++) {
+        const x = aArg[aStartArg + i];
+        const y = bArg[bStartArg + i];
+        if (x !== y) {
+            return x < y ? -1 : 1;
+        }
+    }
+    const aLength = aEndArg - aStartArg;
+    const bLength = bEndArg - bStartArg;
+    return aLength === bLength ? 0 : aLength < bLength ? -1 : 1;
+}
+function isDigit(byteArg) {
+    return byteArg >= 0x30 && byteArg <= 0x39;
+}
+function isAlpha(byteArg) {
+    return (byteArg >= 0x41 && byteArg <= 0x5a) || (byteArg >= 0x61 && byteArg <= 0x7a);
+}
+function isAlnum(byteArg) {
+    return isDigit(byteArg) || isAlpha(byteArg);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyY21wLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvYXJjaC92ZXJjbXAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sVUFBVSxtQkFBbUIsQ0FBQyxJQUFZLEVBQUUsSUFBWTtJQUM1RCxJQUFJLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNsQixPQUFPLENBQUMsQ0FBQztJQUNYLENBQUM7SUFDRCxNQUFNLENBQUMsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDbEMsTUFBTSxDQUFDLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ2xDLElBQUksTUFBTSxHQUFHLFNBQVMsQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN6QyxJQUFJLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNqQixNQUFNLEdBQUcsU0FBUyxDQUFDLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3pDLElBQUksTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxDQUFDLENBQUMsT0FBTyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQzdELE1BQU0sR0FBRyxTQUFTLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDM0MsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDO0FBUUQsTUFBTSxJQUFJLEdBQUcsVUFBVSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUVqQyxTQUFTLE9BQU8sQ0FBQyxRQUFnQjtJQUMvQixNQUFNLEtBQUssR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNqRCxtQ0FBbUM7SUFDbkMsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM3QixPQUFPLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7QUFDbEQsQ0FBQztBQUVELHNGQUFzRjtBQUN0RixTQUFTLFFBQVEsQ0FBQyxNQUFrQjtJQUNsQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDVixPQUFPLENBQUMsR0FBRyxNQUFNLENBQUMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQy9DLENBQUMsRUFBRSxDQUFDO0lBQ04sQ0FBQztJQUNELHdEQUF3RDtJQUN4RCxJQUFJLElBQUksR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNkLEtBQUssSUFBSSxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQzVDLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3ZCLElBQUksR0FBRyxDQUFDLENBQUM7WUFDVCxNQUFNO1FBQ1IsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLEtBQWlCLENBQUM7SUFDdEIsSUFBSSxZQUFvQixDQUFDO0lBQ3pCLElBQUksQ0FBQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQzVDLEtBQUssR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQy9DLFlBQVksR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3ZCLENBQUM7U0FBTSxDQUFDO1FBQ04sS0FBSyxHQUFHLElBQUksQ0FBQztRQUNiLFlBQVksR0FBRyxDQUFDLENBQUM7SUFDbkIsQ0FBQztJQUNELElBQUksSUFBSSxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ2QsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDckcsQ0FBQztJQUNELE9BQU8sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0FBQzFFLENBQUM7QUFFRCxzQ0FBc0M7QUFDdEMsU0FBUyxTQUFTLENBQUMsSUFBZ0IsRUFBRSxJQUFnQjtJQUNuRCxJQUFJLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsTUFBTSxFQUFFLEdBQUcsQ0FBQyxRQUFvQixFQUFFLFFBQWdCLEVBQVUsRUFBRSxDQUFDLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDckgsSUFBSSxHQUFHLEdBQUcsQ0FBQyxDQUFDO0lBQ1osSUFBSSxHQUFHLEdBQUcsQ0FBQyxDQUFDO0lBQ1osSUFBSSxJQUFJLEdBQUcsQ0FBQyxDQUFDO0lBQ2IsSUFBSSxJQUFJLEdBQUcsQ0FBQyxDQUFDO0lBQ2IsT0FBTyxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xELE9BQU8sRUFBRSxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDdEQsR0FBRyxFQUFFLENBQUM7UUFDUixDQUFDO1FBQ0QsT0FBTyxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0RCxHQUFHLEVBQUUsQ0FBQztRQUNSLENBQUM7UUFDRCxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEQsTUFBTTtRQUNSLENBQUM7UUFDRCw0Q0FBNEM7UUFDNUMsSUFBSSxHQUFHLEdBQUcsSUFBSSxLQUFLLEdBQUcsR0FBRyxJQUFJLEVBQUUsQ0FBQztZQUM5QixPQUFPLEdBQUcsR0FBRyxJQUFJLEdBQUcsR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUMxQyxDQUFDO1FBQ0QsSUFBSSxHQUFHLEdBQUcsQ0FBQztRQUNYLElBQUksR0FBRyxHQUFHLENBQUM7UUFDWCxJQUFJLEtBQWMsQ0FBQztRQUNuQixJQUFJLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM1QixPQUFPLEVBQUUsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDdkQsSUFBSSxFQUFFLENBQUM7WUFDVCxDQUFDO1lBQ0QsT0FBTyxFQUFFLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxPQUFPLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZELElBQUksRUFBRSxDQUFDO1lBQ1QsQ0FBQztZQUNELEtBQUssR0FBRyxJQUFJLENBQUM7UUFDZixDQUFDO2FBQU0sQ0FBQztZQUNOLE9BQU8sRUFBRSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUN2RCxJQUFJLEVBQUUsQ0FBQztZQUNULENBQUM7WUFDRCxPQUFPLEVBQUUsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDdkQsSUFBSSxFQUFFLENBQUM7WUFDVCxDQUFDO1lBQ0QsS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNoQixDQUFDO1FBQ0QsSUFBSSxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDakIsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUNaLENBQUM7UUFDRCxpREFBaUQ7UUFDakQsSUFBSSxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDakIsT0FBTyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDeEIsQ0FBQztRQUNELElBQUksUUFBUSxHQUFHLEdBQUcsQ0FBQztRQUNuQixJQUFJLFFBQVEsR0FBRyxHQUFHLENBQUM7UUFDbkIsSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUNWLE9BQU8sRUFBRSxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsS0FBSyxJQUFJLElBQUksUUFBUSxHQUFHLElBQUksRUFBRSxDQUFDO2dCQUN0RCxRQUFRLEVBQUUsQ0FBQztZQUNiLENBQUM7WUFDRCxPQUFPLEVBQUUsQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLEtBQUssSUFBSSxJQUFJLFFBQVEsR0FBRyxJQUFJLEVBQUUsQ0FBQztnQkFDdEQsUUFBUSxFQUFFLENBQUM7WUFDYixDQUFDO1lBQ0QsSUFBSSxJQUFJLEdBQUcsUUFBUSxHQUFHLElBQUksR0FBRyxRQUFRLEVBQUUsQ0FBQztnQkFDdEMsT0FBTyxDQUFDLENBQUM7WUFDWCxDQUFDO1lBQ0QsSUFBSSxJQUFJLEdBQUcsUUFBUSxHQUFHLElBQUksR0FBRyxRQUFRLEVBQUUsQ0FBQztnQkFDdEMsT0FBTyxDQUFDLENBQUMsQ0FBQztZQUNaLENBQUM7UUFDSCxDQUFDO1FBQ0QsTUFBTSxFQUFFLEdBQUcsWUFBWSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDcEUsSUFBSSxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDYixPQUFPLEVBQUUsQ0FBQztRQUNaLENBQUM7UUFDRCxHQUFHLEdBQUcsSUFBSSxDQUFDO1FBQ1gsR0FBRyxHQUFHLElBQUksQ0FBQztJQUNiLENBQUM7SUFDRCxJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0MsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0Qsb0RBQW9EO0lBQ3BELElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxPQUFPLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNaLENBQUM7SUFDRCxPQUFPLENBQUMsQ0FBQztBQUNYLENBQUM7QUFFRCxxQ0FBcUM7QUFDckMsU0FBUyxZQUFZLENBQ25CLElBQWdCLEVBQ2hCLFNBQWlCLEVBQ2pCLE9BQWUsRUFDZixJQUFnQixFQUNoQixTQUFpQixFQUNqQixPQUFlO0lBRWYsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEdBQUcsU0FBUyxFQUFFLE9BQU8sR0FBRyxTQUFTLENBQUMsQ0FBQztJQUNsRSxLQUFLLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEdBQUcsTUFBTSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDaEMsTUFBTSxDQUFDLEdBQUcsSUFBSSxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUM5QixNQUFNLENBQUMsR0FBRyxJQUFJLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQzlCLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ1osT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3hCLENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsT0FBTyxHQUFHLFNBQVMsQ0FBQztJQUNwQyxNQUFNLE9BQU8sR0FBRyxPQUFPLEdBQUcsU0FBUyxDQUFDO0lBQ3BDLE9BQU8sT0FBTyxLQUFLLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzlELENBQUM7QUFFRCxTQUFTLE9BQU8sQ0FBQyxPQUFlO0lBQzlCLE9BQU8sT0FBTyxJQUFJLElBQUksSUFBSSxPQUFPLElBQUksSUFBSSxDQUFDO0FBQzVDLENBQUM7QUFFRCxTQUFTLE9BQU8sQ0FBQyxPQUFlO0lBQzlCLE9BQU8sQ0FBQyxPQUFPLElBQUksSUFBSSxJQUFJLE9BQU8sSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxJQUFJLElBQUksT0FBTyxJQUFJLElBQUksQ0FBQyxDQUFDO0FBQ3RGLENBQUM7QUFFRCxTQUFTLE9BQU8sQ0FBQyxPQUFlO0lBQzlCLE9BQU8sT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUM5QyxDQUFDIn0=

package/dist_ts/debian/control.d.ts

@@ -0,0 +1,22 @@
+import type { IDebianPackageMetadata } from '../shared/types.js';
+/** Gitea's distribution and component rule (`metadata.go:67`, applied at upload). */
+export declare const DEBIAN_SYMBOL_PATTERN: RegExp;
+export interface IDebianControl {
+    name: string;
+    version: string;
+    architecture: string;
+    metadata: IDebianPackageMetadata;
+}
+/**
+ * A port of Gitea 28.2.0 `ParseControlFile` (`metadata.go:165-265`) over the
+ * bytes of the `control` entry. Lines are split as `bufio.ScanLines` does
+ * (`\n`, one trailing `\r` dropped); the first blank line after content ends
+ * the stanza. Every derived value is Gitea's: the raw stanza trimmed, the
+ * Maintainer name through `net/mail`, the Homepage only when Gitea's URL
+ * check accepts it, the Description with its continuation lines appended
+ * verbatim, and the Depends text split on `,` (`['']` when there is none).
+ *
+ * Gitea's scanner refuses lines over 64 KiB; the codec accepts lines up to
+ * `maxLineBytes` (`maxHeaderBytes`), which is at least that.
+ */
+export declare function parseDebianControlFile(bytesArg: Uint8Array, maxLineBytesArg: number): IDebianControl;