@push.rocks/smartlinuxrepo 1.0.0 → 1.1.0

package/dist_ts/signing/openpgpframing.js

@@ -1,3 +1,4 @@
+import { decodeLatin1, decodeStrictUtf8 } from '../readers/text.js';
 import { LinuxRepoError } from '../shared/errors.js';
 import { assertAsyncIterable, assertBytes, assertString, assertTimestamp } from '../shared/validation.js';
 import { singleChunk } from './signers.js';
@@ -5,6 +6,10 @@ import { singleChunk } from './signers.js';
  * The OpenPGP framing the codec owns: only the bytes of the signature packet
  * may vary; framing and armor are deterministic.
  * Armor has no headers, 64-column base64 and a CRC-24 line.
+ *
+ * The readers below are the strict inverses the verifier uses; openpgp.js's
+ * own dearmoring is never used (it skips text around the block, ignores the
+ * CRC-24 and strips trailing whitespace inside cleartext).
  */
 const BASE64_LINE = 64;
 /**
@@ -32,7 +37,7 @@ export async function createDetachedArmoredSignature(inputArg) {
  * Cleartext-signs `text` (`InRelease`). The text must be canonical: no CR and
  * no trailing spaces or tabs on any line. The signed text is `text` without
  * its final line break; the output always ends the text with one line break
- * before the signature block, as GnuPG and Go do. Lines starting with `-` are
+ * before the signature block, as GnuPG does. Lines starting with `-` are
  * dash-escaped. The header is always `Hash: SHA256`.
  */
 export async function createCleartextSignedMessage(inputArg) {
@@ -75,6 +80,272 @@ function assertSignatureBytes(packetArg) {
         throw new LinuxRepoError('signing-failed', 'the signer returned no signature bytes', { field: 'signer' });
     }
 }
+/** A well-formed armor header line (`Key: Value`), as openpgp.js 6.3.2 checks it (`verifyHeaders$1`). */
+const ARMOR_HEADER_PATTERN = /^([^\s:]|[^\s:][^:]*[^\s:]): .+$/;
+const BASE64_LINE_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/;
+const BASE64_PATTERN = /^[A-Za-z0-9+/]*={0,2}$/;
+const CRC_LINE_PATTERN = /^=[A-Za-z0-9+/]{4}$/;
+const CLEARTEXT_BEGIN = '-----BEGIN PGP SIGNED MESSAGE-----';
+const SIGNATURE_BEGIN = '-----BEGIN PGP SIGNATURE-----';
+/** RFC 9580 table 23 hash text names (the `Hash:` header) and their algorithm IDs. */
+const HASH_TEXT_NAMES = new Map([
+    ['MD5', 1],
+    ['SHA1', 2],
+    ['RIPEMD160', 3],
+    ['SHA256', 8],
+    ['SHA384', 9],
+    ['SHA512', 10],
+    ['SHA224', 11],
+    ['SHA3-256', 12],
+    ['SHA3-512', 14],
+]);
+function framingError(failureArg, messageArg) {
+    return new LinuxRepoError(failureArg.code, messageArg, { field: failureArg.field });
+}
+/** Bytes that must be ASCII armor, as text; any byte above 0x7F is refused. */
+export function decodeArmorBytes(bytesArg, failureArg) {
+    for (let i = 0; i < bytesArg.length; i++) {
+        if (bytesArg[i] > 0x7f) {
+            throw framingError(failureArg, 'ASCII armor must be ASCII');
+        }
+    }
+    return decodeLatin1(bytesArg);
+}
+/**
+ * Reads exactly one ASCII armor block labelled `labelArg` (RFC 9580 section
+ * 6.2) and returns its bytes; the inverse of `armorSignature`. Lines may end
+ * in LF or CRLF and carry trailing spaces or tabs, and blank lines may
+ * surround the block. Well-formed `Key: Value` headers are ignored; the
+ * CRC-24 line is optional and must match when present. Refused with
+ * `failureArg`: non-ASCII text, another label, a second block or any other
+ * text outside the block, a malformed header line, no blank line before the
+ * data, base64 that is not canonical, no data, and a CRC-24 that does not
+ * match.
+ */
+export function dearmor(textArg, labelArg, failureArg) {
+    const lines = textArg.split('\n').map(trimLineEnd);
+    let first = 0;
+    while (first < lines.length && lines[first] === '') {
+        first += 1;
+    }
+    let last = lines.length - 1;
+    while (last >= first && lines[last] === '') {
+        last -= 1;
+    }
+    return readArmorBlock(lines.slice(first, last + 1), labelArg, failureArg);
+}
+/** The line without trailing spaces, tabs and CRs; a loop, as a `+$` regex is quadratic on a long run of them. */
+function trimLineEnd(lineArg) {
+    let end = lineArg.length;
+    while (end > 0 && (lineArg[end - 1] === ' ' || lineArg[end - 1] === '\t' || lineArg[end - 1] === '\r')) {
+        end -= 1;
+    }
+    return lineArg.slice(0, end);
+}
+/** One armor block, from its BEGIN line to its END line, as exactly these lines; ASCII only. */
+function readArmorBlock(linesArg, labelArg, failureArg) {
+    if (linesArg.some((line) => !/^[\x00-\x7f]*$/.test(line))) {
+        throw framingError(failureArg, 'ASCII armor must be ASCII');
+    }
+    const begin = `-----BEGIN PGP ${labelArg}-----`;
+    const end = `-----END PGP ${labelArg}-----`;
+    if (linesArg[0] !== begin) {
+        throw framingError(failureArg, `expected exactly one ${begin} block and nothing else`);
+    }
+    const endIndex = linesArg.indexOf(end);
+    if (endIndex < 0 || endIndex !== linesArg.length - 1) {
+        throw framingError(failureArg, `expected exactly one ${begin} block ending in ${end} and nothing else`);
+    }
+    let index = 1;
+    for (; index < endIndex && linesArg[index] !== ''; index++) {
+        if (!ARMOR_HEADER_PATTERN.test(linesArg[index])) {
+            throw framingError(failureArg, 'malformed armor header line');
+        }
+    }
+    if (index >= endIndex) {
+        throw framingError(failureArg, 'the armor has no blank line before its data');
+    }
+    index += 1;
+    const dataLines = [];
+    let crcLine = null;
+    for (; index < endIndex; index++) {
+        const line = linesArg[index];
+        if (index === endIndex - 1 && line.startsWith('=')) {
+            crcLine = line;
+            break;
+        }
+        if (!BASE64_LINE_PATTERN.test(line)) {
+            throw framingError(failureArg, 'the armor data is not base64');
+        }
+        dataLines.push(line);
+    }
+    const base64 = dataLines.join('');
+    if (base64.length === 0 || base64.length % 4 !== 0 || !BASE64_PATTERN.test(base64)) {
+        throw framingError(failureArg, 'the armor data is not one base64 string');
+    }
+    const decoded = Buffer.from(base64, 'base64');
+    if (decoded.toString('base64') !== base64) {
+        throw framingError(failureArg, 'the armor data is not canonical base64');
+    }
+    const bytes = new Uint8Array(decoded.buffer, decoded.byteOffset, decoded.byteLength);
+    if (crcLine !== null && (!CRC_LINE_PATTERN.test(crcLine) || crcLine.slice(1) !== crc24Base64(bytes))) {
+        throw framingError(failureArg, 'the armor CRC-24 does not match its data');
+    }
+    return bytes;
+}
+/**
+ * The packet tags of a binary OpenPGP packet sequence, read from the packet
+ * headers alone (RFC 9580 section 4.2); no body is parsed. openpgp.js skips
+ * marker, trust and padding packets and unknown non-critical packet types
+ * without a trace (`PacketList.read`, `dist/node/openpgp.mjs:12320-12385`),
+ * so the verifier counts packets here. Refused with `failureArg`: a header
+ * without its high bit, a partial body length (no key or signature packet
+ * may use one), and input that ends inside a header or a body.
+ */
+export function readPacketTags(bytesArg, failureArg) {
+    const tags = [];
+    let offset = 0;
+    while (offset < bytesArg.length) {
+        const ctb = bytesArg[offset];
+        if ((ctb & 0x80) === 0) {
+            throw framingError(failureArg, `no OpenPGP packet header at byte ${offset}`);
+        }
+        let tag;
+        let headerLength;
+        let bodyLength;
+        if ((ctb & 0x40) !== 0) {
+            tag = ctb & 0x3f;
+            const first = bytesArg[offset + 1];
+            if (first === undefined) {
+                throw framingError(failureArg, 'the input ends inside a packet header');
+            }
+            if (first < 192) {
+                headerLength = 2;
+                bodyLength = first;
+            }
+            else if (first < 224) {
+                if (offset + 3 > bytesArg.length) {
+                    throw framingError(failureArg, 'the input ends inside a packet header');
+                }
+                headerLength = 3;
+                bodyLength = (first - 192) * 256 + bytesArg[offset + 2] + 192;
+            }
+            else if (first === 255) {
+                if (offset + 6 > bytesArg.length) {
+                    throw framingError(failureArg, 'the input ends inside a packet header');
+                }
+                headerLength = 6;
+                bodyLength = readUint32(bytesArg, offset + 2);
+            }
+            else {
+                throw framingError(failureArg, 'a partial body length is not allowed here');
+            }
+        }
+        else {
+            tag = (ctb >> 2) & 0x0f;
+            const lengthType = ctb & 0x03;
+            if (lengthType === 3) {
+                // indeterminate length: the packet runs to the end of the input
+                headerLength = 1;
+                bodyLength = bytesArg.length - offset - 1;
+            }
+            else {
+                const lengthBytes = 1 << lengthType;
+                if (offset + 1 + lengthBytes > bytesArg.length) {
+                    throw framingError(failureArg, 'the input ends inside a packet header');
+                }
+                headerLength = 1 + lengthBytes;
+                bodyLength = 0;
+                for (let i = 0; i < lengthBytes; i++) {
+                    bodyLength = bodyLength * 256 + bytesArg[offset + 1 + i];
+                }
+            }
+        }
+        const packetEnd = offset + headerLength + bodyLength;
+        if (packetEnd > bytesArg.length) {
+            throw framingError(failureArg, 'the input ends inside a packet');
+        }
+        tags.push(tag);
+        offset = packetEnd;
+    }
+    return tags;
+}
+function readUint32(bytesArg, offsetArg) {
+    return ((bytesArg[offsetArg] * 256 + bytesArg[offsetArg + 1]) * 256 + bytesArg[offsetArg + 2]) * 256 + bytesArg[offsetArg + 3];
+}
+/**
+ * Splits a cleartext-signed message (`InRelease`, RFC 9580 section 7); the
+ * inverse of `createCleartextSignedMessage`, and as strict as apt's own split
+ * (apt-pkg `SplitClearSignedFile`). The message is strict UTF-8 with LF line
+ * endings: the first line is `-----BEGIN PGP SIGNED MESSAGE-----`, then
+ * optional `Hash:` headers (comma-separated RFC 9580 text names), a blank
+ * line, the dash-escaped text and exactly one signature armor block, which
+ * may be followed by one line break and nothing else. Refused with
+ * `failureArg`: invalid UTF-8, a CR, a line ending in a space or tab, text
+ * before the message block or after the signature block, any other header, an
+ * unknown hash name, a text line starting with `-` but not `- `, and an empty
+ * text section. Armor headers inside the signature block are ignored as in
+ * `dearmor`.
+ */
+export function splitCleartextSignedMessage(bytesArg, failureArg) {
+    const text = decodeStrictUtf8(bytesArg);
+    if (text === null) {
+        throw framingError(failureArg, 'the cleartext-signed message is not valid UTF-8');
+    }
+    if (text.includes('\r')) {
+        throw framingError(failureArg, 'the cleartext-signed message must use LF line endings');
+    }
+    const lines = text.split('\n');
+    if (lines[lines.length - 1] === '') {
+        lines.pop();
+    }
+    if (lines.some((line) => /[ \t]$/.test(line))) {
+        throw framingError(failureArg, 'a line of the cleartext-signed message ends with a space or tab');
+    }
+    if (lines[0] !== CLEARTEXT_BEGIN) {
+        throw framingError(failureArg, `the message does not start with ${CLEARTEXT_BEGIN}`);
+    }
+    let index = 1;
+    const headerHashAlgorithms = [];
+    for (; index < lines.length && lines[index] !== ''; index++) {
+        const header = /^Hash: (.+)$/.exec(lines[index]);
+        if (header === null) {
+            throw framingError(failureArg, 'only Hash: headers are allowed in a cleartext-signed message');
+        }
+        for (const name of header[1].split(',')) {
+            const algorithm = HASH_TEXT_NAMES.get(name.trim());
+            if (algorithm === undefined) {
+                throw framingError(failureArg, `unknown hash name in the Hash: header: ${name.trim()}`);
+            }
+            headerHashAlgorithms.push(algorithm);
+        }
+    }
+    index += 1;
+    const textLines = [];
+    for (; index < lines.length && lines[index] !== SIGNATURE_BEGIN; index++) {
+        const line = lines[index];
+        if (line.startsWith('-')) {
+            if (!line.startsWith('- ')) {
+                throw framingError(failureArg, 'a text line starts with "-" without the "- " escape');
+            }
+            textLines.push(line.slice(2));
+        }
+        else {
+            textLines.push(line);
+        }
+    }
+    if (index >= lines.length) {
+        throw framingError(failureArg, `the message has no ${SIGNATURE_BEGIN} block`);
+    }
+    if (textLines.length === 0) {
+        throw framingError(failureArg, 'the message has no text section');
+    }
+    return {
+        signedText: textLines.join('\n'),
+        headerHashAlgorithms,
+        signature: readArmorBlock(lines.slice(index), 'SIGNATURE', failureArg),
+    };
+}
 /** RFC 4880 section 6.1 CRC-24, base64-encoded. */
 function crc24Base64(bytesArg) {
     let crc = 0xb704ce;
@@ -90,4 +361,4 @@ function crc24Base64(bytesArg) {
     crc &= 0xffffff;
     return Buffer.from([(crc >> 16) & 0xff, (crc >> 8) & 0xff, crc & 0xff]).toString('base64');
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3BlbnBncGZyYW1pbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9zaWduaW5nL29wZW5wZ3BmcmFtaW5nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNyRCxPQUFPLEVBQUUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxlQUFlLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUMxRyxPQUFPLEVBQUUsV0FBVyxFQUF1QixNQUFNLGNBQWMsQ0FBQztBQUVoRTs7OztHQUlHO0FBRUgsTUFBTSxXQUFXLEdBQUcsRUFBRSxDQUFDO0FBRXZCOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLDZCQUE2QixDQUFDLFFBSW5EO0lBQ0MsbUJBQW1CLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMzQyxlQUFlLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDbkYsb0JBQW9CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDN0IsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELGdHQUFnRztBQUNoRyxNQUFNLENBQUMsS0FBSyxVQUFVLDhCQUE4QixDQUFDLFFBSXBEO0lBQ0MsV0FBVyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDbkMsT0FBTyxjQUFjLENBQ25CLE1BQU0sNkJBQTZCLENBQUM7UUFDbEMsSUFBSSxFQUFFLFdBQVcsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO1FBQ2hDLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTTtRQUN2QixTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVM7S0FDOUIsQ0FBQyxDQUNILENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSw0QkFBNEIsQ0FBQyxRQUlsRDtJQUNDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNuQyxlQUFlLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sVUFBVSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztJQUM3RixNQUFNLE1BQU0sR0FBRyxNQUFNLFFBQVEsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUUsb0JBQW9CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDN0IsTUFBTSxJQUFJLEdBQUcsR0FBRyxVQUFVLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3RELE9BQU8sdURBQXVELElBQUksR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztBQUNoRyxDQUFDO0FBRUQsaURBQWlEO0FBQ2pELE1BQU0sVUFBVSxjQUFjLENBQUMsU0FBcUI7SUFDbEQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLFNBQVMsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUM1RyxNQUFNLEtBQUssR0FBYSxFQUFFLENBQUM7SUFDM0IsS0FBSyxJQUFJLE1BQU0sR0FBRyxDQUFDLEVBQUUsTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLEVBQUUsTUFBTSxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ25FLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE9BQU87UUFDTCwrQkFBK0I7UUFDL0IsRUFBRTtRQUNGLEdBQUcsS0FBSztRQUNSLElBQUksV0FBVyxDQUFDLFNBQVMsQ0FBQyxFQUFFO1FBQzVCLDZCQUE2QjtRQUM3QixFQUFFO0tBQ0gsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDZixDQUFDO0FBRUQsMERBQTBEO0FBQzFELE1BQU0sVUFBVSxtQkFBbUIsQ0FBQyxPQUFnQjtJQUNsRCxZQUFZLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzlCLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLG9DQUFvQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQzVCLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLGtEQUFrRCxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDbkgsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLG9CQUFvQixDQUFDLFNBQWtCO0lBQzlDLElBQUksQ0FBQyxDQUFDLFNBQVMsWUFBWSxVQUFVLENBQUMsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sSUFBSSxjQUFjLENBQUMsZ0JBQWdCLEVBQUUsd0NBQXdDLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM1RyxDQUFDO0FBQ0gsQ0FBQztBQUVELG1EQUFtRDtBQUNuRCxTQUFTLFdBQVcsQ0FBQyxRQUFvQjtJQUN2QyxJQUFJLEdBQUcsR0FBRyxRQUFRLENBQUM7SUFDbkIsS0FBSyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUN6QyxHQUFHLElBQUksUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN6QixLQUFLLElBQUksR0FBRyxHQUFHLENBQUMsRUFBRSxHQUFHLEdBQUcsQ0FBQyxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDakMsR0FBRyxLQUFLLENBQUMsQ0FBQztZQUNWLElBQUksR0FBRyxHQUFHLFNBQVMsRUFBRSxDQUFDO2dCQUNwQixHQUFHLElBQUksU0FBUyxDQUFDO1lBQ25CLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUNELEdBQUcsSUFBSSxRQUFRLENBQUM7SUFDaEIsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLElBQUksRUFBRSxDQUFDLEdBQUcsSUFBSSxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxHQUFHLElBQUksRUFBRSxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDN0YsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3BlbnBncGZyYW1pbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9zaWduaW5nL29wZW5wZ3BmcmFtaW5nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNwRSxPQUFPLEVBQUUsY0FBYyxFQUE0QixNQUFNLHFCQUFxQixDQUFDO0FBQy9FLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLGVBQWUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBQzFHLE9BQU8sRUFBRSxXQUFXLEVBQXVCLE1BQU0sY0FBYyxDQUFDO0FBRWhFOzs7Ozs7OztHQVFHO0FBRUgsTUFBTSxXQUFXLEdBQUcsRUFBRSxDQUFDO0FBRXZCOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLDZCQUE2QixDQUFDLFFBSW5EO0lBQ0MsbUJBQW1CLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMzQyxlQUFlLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDbkYsb0JBQW9CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDN0IsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELGdHQUFnRztBQUNoRyxNQUFNLENBQUMsS0FBSyxVQUFVLDhCQUE4QixDQUFDLFFBSXBEO0lBQ0MsV0FBVyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDbkMsT0FBTyxjQUFjLENBQ25CLE1BQU0sNkJBQTZCLENBQUM7UUFDbEMsSUFBSSxFQUFFLFdBQVcsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO1FBQ2hDLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTTtRQUN2QixTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVM7S0FDOUIsQ0FBQyxDQUNILENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSw0QkFBNEIsQ0FBQyxRQUlsRDtJQUNDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNuQyxlQUFlLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sVUFBVSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztJQUM3RixNQUFNLE1BQU0sR0FBRyxNQUFNLFFBQVEsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUUsb0JBQW9CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDN0IsTUFBTSxJQUFJLEdBQUcsR0FBRyxVQUFVLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3RELE9BQU8sdURBQXVELElBQUksR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztBQUNoRyxDQUFDO0FBRUQsaURBQWlEO0FBQ2pELE1BQU0sVUFBVSxjQUFjLENBQUMsU0FBcUI7SUFDbEQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLFNBQVMsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUM1RyxNQUFNLEtBQUssR0FBYSxFQUFFLENBQUM7SUFDM0IsS0FBSyxJQUFJLE1BQU0sR0FBRyxDQUFDLEVBQUUsTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLEVBQUUsTUFBTSxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ25FLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE9BQU87UUFDTCwrQkFBK0I7UUFDL0IsRUFBRTtRQUNGLEdBQUcsS0FBSztRQUNSLElBQUksV0FBVyxDQUFDLFNBQVMsQ0FBQyxFQUFFO1FBQzVCLDZCQUE2QjtRQUM3QixFQUFFO0tBQ0gsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDZixDQUFDO0FBRUQsMERBQTBEO0FBQzFELE1BQU0sVUFBVSxtQkFBbUIsQ0FBQyxPQUFnQjtJQUNsRCxZQUFZLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzlCLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLG9DQUFvQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQzVCLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLGtEQUFrRCxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDbkgsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLG9CQUFvQixDQUFDLFNBQWtCO0lBQzlDLElBQUksQ0FBQyxDQUFDLFNBQVMsWUFBWSxVQUFVLENBQUMsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sSUFBSSxjQUFjLENBQUMsZ0JBQWdCLEVBQUUsd0NBQXdDLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM1RyxDQUFDO0FBQ0gsQ0FBQztBQVVELHlHQUF5RztBQUN6RyxNQUFNLG9CQUFvQixHQUFHLGtDQUFrQyxDQUFDO0FBQ2hFLE1BQU0sbUJBQW1CLEdBQUcsd0JBQXdCLENBQUM7QUFDckQsTUFBTSxjQUFjLEdBQUcsd0JBQXdCLENBQUM7QUFDaEQsTUFBTSxnQkFBZ0IsR0FBRyxxQkFBcUIsQ0FBQztBQUMvQyxNQUFNLGVBQWUsR0FBRyxvQ0FBb0MsQ0FBQztBQUM3RCxNQUFNLGVBQWUsR0FBRywrQkFBK0IsQ0FBQztBQUV4RCxzRkFBc0Y7QUFDdEYsTUFBTSxlQUFlLEdBQWdDLElBQUksR0FBRyxDQUFDO0lBQzNELENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUNWLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUNYLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUNoQixDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDYixDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDYixDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUM7SUFDZCxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUM7SUFDZCxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUM7SUFDaEIsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDO0NBQ2pCLENBQUMsQ0FBQztBQUVILFNBQVMsWUFBWSxDQUFDLFVBQTJCLEVBQUUsVUFBa0I7SUFDbkUsT0FBTyxJQUFJLGNBQWMsQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUFFLEtBQUssRUFBRSxVQUFVLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQztBQUN0RixDQUFDO0FBRUQsK0VBQStFO0FBQy9FLE1BQU0sVUFBVSxnQkFBZ0IsQ0FBQyxRQUFvQixFQUFFLFVBQTJCO0lBQ2hGLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDekMsSUFBSSxRQUFRLENBQUMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxFQUFFLENBQUM7WUFDdkIsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLDJCQUEyQixDQUFDLENBQUM7UUFDOUQsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUNoQyxDQUFDO0FBRUQ7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sVUFBVSxPQUFPLENBQUMsT0FBZSxFQUFFLFFBQXFCLEVBQUUsVUFBMkI7SUFDekYsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDbkQsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsT0FBTyxLQUFLLEdBQUcsS0FBSyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDbkQsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUNiLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztJQUM1QixPQUFPLElBQUksSUFBSSxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzNDLElBQUksSUFBSSxDQUFDLENBQUM7SUFDWixDQUFDO0lBQ0QsT0FBTyxjQUFjLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsSUFBSSxHQUFHLENBQUMsQ0FBQyxFQUFFLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQztBQUM1RSxDQUFDO0FBRUQsa0hBQWtIO0FBQ2xILFNBQVMsV0FBVyxDQUFDLE9BQWU7SUFDbEMsSUFBSSxHQUFHLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQztJQUN6QixPQUFPLEdBQUcsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxLQUFLLEdBQUcsSUFBSSxPQUFPLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxLQUFLLElBQUksSUFBSSxPQUFPLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDdkcsR0FBRyxJQUFJLENBQUMsQ0FBQztJQUNYLENBQUM7SUFDRCxPQUFPLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0FBQy9CLENBQUM7QUFFRCxnR0FBZ0c7QUFDaEcsU0FBUyxjQUFjLENBQUMsUUFBMkIsRUFBRSxRQUFxQixFQUFFLFVBQTJCO0lBQ3JHLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzFELE1BQU0sWUFBWSxDQUFDLFVBQVUsRUFBRSwyQkFBMkIsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxrQkFBa0IsUUFBUSxPQUFPLENBQUM7SUFDaEQsTUFBTSxHQUFHLEdBQUcsZ0JBQWdCLFFBQVEsT0FBTyxDQUFDO0lBQzVDLElBQUksUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQzFCLE1BQU0sWUFBWSxDQUFDLFVBQVUsRUFBRSx3QkFBd0IsS0FBSyx5QkFBeUIsQ0FBQyxDQUFDO0lBQ3pGLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3ZDLElBQUksUUFBUSxHQUFHLENBQUMsSUFBSSxRQUFRLEtBQUssUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNyRCxNQUFNLFlBQVksQ0FBQyxVQUFVLEVBQUUsd0JBQXdCLEtBQUssb0JBQW9CLEdBQUcsbUJBQW1CLENBQUMsQ0FBQztJQUMxRyxDQUFDO0lBQ0QsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsT0FBTyxLQUFLLEdBQUcsUUFBUSxJQUFJLFFBQVEsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUMzRCxJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDaEQsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLDZCQUE2QixDQUFDLENBQUM7UUFDaEUsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLEtBQUssSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUN0QixNQUFNLFlBQVksQ0FBQyxVQUFVLEVBQUUsNkNBQTZDLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUNYLE1BQU0sU0FBUyxHQUFhLEVBQUUsQ0FBQztJQUMvQixJQUFJLE9BQU8sR0FBa0IsSUFBSSxDQUFDO0lBQ2xDLE9BQU8sS0FBSyxHQUFHLFFBQVEsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sSUFBSSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUM3QixJQUFJLEtBQUssS0FBSyxRQUFRLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNuRCxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQ2YsTUFBTTtRQUNSLENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDcEMsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLDhCQUE4QixDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELFNBQVMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDdkIsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDbEMsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDbkYsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLHlDQUF5QyxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQzlDLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLEVBQUUsQ0FBQztRQUMxQyxNQUFNLFlBQVksQ0FBQyxVQUFVLEVBQUUsd0NBQXdDLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxVQUFVLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNyRixJQUFJLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDckcsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLDBDQUEwQyxDQUFDLENBQUM7SUFDN0UsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxVQUFVLGNBQWMsQ0FBQyxRQUFvQixFQUFFLFVBQTJCO0lBQzlFLE1BQU0sSUFBSSxHQUFhLEVBQUUsQ0FBQztJQUMxQixJQUFJLE1BQU0sR0FBRyxDQUFDLENBQUM7SUFDZixPQUFPLE1BQU0sR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDaEMsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzdCLElBQUksQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdkIsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLG9DQUFvQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQy9FLENBQUM7UUFDRCxJQUFJLEdBQVcsQ0FBQztRQUNoQixJQUFJLFlBQW9CLENBQUM7UUFDekIsSUFBSSxVQUFrQixDQUFDO1FBQ3ZCLElBQUksQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdkIsR0FBRyxHQUFHLEdBQUcsR0FBRyxJQUFJLENBQUM7WUFDakIsTUFBTSxLQUFLLEdBQUcsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztZQUNuQyxJQUFJLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDeEIsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLHVDQUF1QyxDQUFDLENBQUM7WUFDMUUsQ0FBQztZQUNELElBQUksS0FBSyxHQUFHLEdBQUcsRUFBRSxDQUFDO2dCQUNoQixZQUFZLEdBQUcsQ0FBQyxDQUFDO2dCQUNqQixVQUFVLEdBQUcsS0FBSyxDQUFDO1lBQ3JCLENBQUM7aUJBQU0sSUFBSSxLQUFLLEdBQUcsR0FBRyxFQUFFLENBQUM7Z0JBQ3ZCLElBQUksTUFBTSxHQUFHLENBQUMsR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7b0JBQ2pDLE1BQU0sWUFBWSxDQUFDLFVBQVUsRUFBRSx1Q0FBdUMsQ0FBQyxDQUFDO2dCQUMxRSxDQUFDO2dCQUNELFlBQVksR0FBRyxDQUFDLENBQUM7Z0JBQ2pCLFVBQVUsR0FBRyxDQUFDLEtBQUssR0FBRyxHQUFHLENBQUMsR0FBRyxHQUFHLEdBQUcsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsR0FBRyxHQUFHLENBQUM7WUFDaEUsQ0FBQztpQkFBTSxJQUFJLEtBQUssS0FBSyxHQUFHLEVBQUUsQ0FBQztnQkFDekIsSUFBSSxNQUFNLEdBQUcsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztvQkFDakMsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLHVDQUF1QyxDQUFDLENBQUM7Z0JBQzFFLENBQUM7Z0JBQ0QsWUFBWSxHQUFHLENBQUMsQ0FBQztnQkFDakIsVUFBVSxHQUFHLFVBQVUsQ0FBQyxRQUFRLEVBQUUsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ2hELENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLFlBQVksQ0FBQyxVQUFVLEVBQUUsMkNBQTJDLENBQUMsQ0FBQztZQUM5RSxDQUFDO1FBQ0gsQ0FBQzthQUFNLENBQUM7WUFDTixHQUFHLEdBQUcsQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDLEdBQUcsSUFBSSxDQUFDO1lBQ3hCLE1BQU0sVUFBVSxHQUFHLEdBQUcsR0FBRyxJQUFJLENBQUM7WUFDOUIsSUFBSSxVQUFVLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQ3JCLGdFQUFnRTtnQkFDaEUsWUFBWSxHQUFHLENBQUMsQ0FBQztnQkFDakIsVUFBVSxHQUFHLFFBQVEsQ0FBQyxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsQ0FBQztZQUM1QyxDQUFDO2lCQUFNLENBQUM7Z0JBQ04sTUFBTSxXQUFXLEdBQUcsQ0FBQyxJQUFJLFVBQVUsQ0FBQztnQkFDcEMsSUFBSSxNQUFNLEdBQUcsQ0FBQyxHQUFHLFdBQVcsR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7b0JBQy9DLE1BQU0sWUFBWSxDQUFDLFVBQVUsRUFBRSx1Q0FBdUMsQ0FBQyxDQUFDO2dCQUMxRSxDQUFDO2dCQUNELFlBQVksR0FBRyxDQUFDLEdBQUcsV0FBVyxDQUFDO2dCQUMvQixVQUFVLEdBQUcsQ0FBQyxDQUFDO2dCQUNmLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxXQUFXLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztvQkFDckMsVUFBVSxHQUFHLFVBQVUsR0FBRyxHQUFHLEdBQUcsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQzNELENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLE1BQU0sR0FBRyxZQUFZLEdBQUcsVUFBVSxDQUFDO1FBQ3JELElBQUksU0FBUyxHQUFHLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoQyxNQUFNLFlBQVksQ0FBQyxVQUFVLEVBQUUsZ0NBQWdDLENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNmLE1BQU0sR0FBRyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQztBQUVELFNBQVMsVUFBVSxDQUFDLFFBQW9CLEVBQUUsU0FBaUI7SUFDekQsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxHQUFHLEdBQUcsR0FBRyxRQUFRLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxDQUFDLEdBQUcsR0FBRyxHQUFHLFFBQVEsQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxHQUFHLEdBQUcsUUFBUSxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsQ0FBQztBQUNqSSxDQUFDO0FBWUQ7Ozs7Ozs7Ozs7Ozs7R0FhRztBQUNILE1BQU0sVUFBVSwyQkFBMkIsQ0FBQyxRQUFvQixFQUFFLFVBQTJCO0lBQzNGLE1BQU0sSUFBSSxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3hDLElBQUksSUFBSSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ2xCLE1BQU0sWUFBWSxDQUFDLFVBQVUsRUFBRSxpREFBaUQsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUN4QixNQUFNLFlBQVksQ0FBQyxVQUFVLEVBQUUsdURBQXVELENBQUMsQ0FBQztJQUMxRixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUMvQixJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ25DLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFDRCxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzlDLE1BQU0sWUFBWSxDQUFDLFVBQVUsRUFBRSxpRUFBaUUsQ0FBQyxDQUFDO0lBQ3BHLENBQUM7SUFDRCxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUNqQyxNQUFNLFlBQVksQ0FBQyxVQUFVLEVBQUUsbUNBQW1DLGVBQWUsRUFBRSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUNELElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLE1BQU0sb0JBQW9CLEdBQWEsRUFBRSxDQUFDO0lBQzFDLE9BQU8sS0FBSyxHQUFHLEtBQUssQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzVELE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDakQsSUFBSSxNQUFNLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDcEIsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLDhEQUE4RCxDQUFDLENBQUM7UUFDakcsQ0FBQztRQUNELEtBQUssTUFBTSxJQUFJLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7WUFDbkQsSUFBSSxTQUFTLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sWUFBWSxDQUFDLFVBQVUsRUFBRSwwQ0FBMEMsSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztZQUMxRixDQUFDO1lBQ0Qsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7SUFDSCxDQUFDO0lBQ0QsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUNYLE1BQU0sU0FBUyxHQUFhLEVBQUUsQ0FBQztJQUMvQixPQUFPLEtBQUssR0FBRyxLQUFLLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxlQUFlLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUN6RSxNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDMUIsSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFDM0IsTUFBTSxZQUFZLENBQUMsVUFBVSxFQUFFLHFEQUFxRCxDQUFDLENBQUM7WUFDeEYsQ0FBQztZQUNELFNBQVMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2hDLENBQUM7YUFBTSxDQUFDO1lBQ04sU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN2QixDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUMxQixNQUFNLFlBQVksQ0FBQyxVQUFVLEVBQUUsc0JBQXNCLGVBQWUsUUFBUSxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUMzQixNQUFNLFlBQVksQ0FBQyxVQUFVLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBQ0QsT0FBTztRQUNMLFVBQVUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztRQUNoQyxvQkFBb0I7UUFDcEIsU0FBUyxFQUFFLGNBQWMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLFdBQVcsRUFBRSxVQUFVLENBQUM7S0FDdkUsQ0FBQztBQUNKLENBQUM7QUFFRCxtREFBbUQ7QUFDbkQsU0FBUyxXQUFXLENBQUMsUUFBb0I7SUFDdkMsSUFBSSxHQUFHLEdBQUcsUUFBUSxDQUFDO0lBQ25CLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDekMsR0FBRyxJQUFJLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDekIsS0FBSyxJQUFJLEdBQUcsR0FBRyxDQUFDLEVBQUUsR0FBRyxHQUFHLENBQUMsRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDO1lBQ2pDLEdBQUcsS0FBSyxDQUFDLENBQUM7WUFDVixJQUFJLEdBQUcsR0FBRyxTQUFTLEVBQUUsQ0FBQztnQkFDcEIsR0FBRyxJQUFJLFNBQVMsQ0FBQztZQUNuQixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxHQUFHLElBQUksUUFBUSxDQUFDO0lBQ2hCLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLEVBQUUsQ0FBQyxHQUFHLElBQUksRUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUMsR0FBRyxJQUFJLEVBQUUsR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQzdGLENBQUMifQ==

package/dist_ts/signing/verifiers.d.ts

@@ -0,0 +1,77 @@
+/** The hash algorithms the verifier accepts. */
+export type TOpenPgpHashAlgorithm = 'sha256' | 'sha384' | 'sha512';
+/** A signature that verified. */
+export interface IOpenPgpSignatureVerification {
+    /** The primary key or subkey that verified the signature, 40 uppercase hex digits. */
+    readonly signingKeyFingerprint: string;
+    /** The signature's creation time (whole seconds). */
+    readonly created: Date;
+    readonly hashAlgorithm: TOpenPgpHashAlgorithm;
+}
+/** A cleartext-signed message that verified. */
+export interface IOpenPgpCleartextVerification extends IOpenPgpSignatureVerification {
+    /**
+     * The signed text: dash-escaping removed, lines joined by LF, without the
+     * line break before the signature block (RFC 9580 section 7.1). For
+     * GnuPG's and the codec's `InRelease` this is `Release` without its final
+     * line break; for Gitea 28.2.0's (go-crypto) it is the whole `Release`.
+     */
+    readonly signedText: string;
+}
+/**
+ * Verifies OpenPGP signatures against one public key. Every method fails
+ * closed with a `LinuxRepoError` and never returns a verdict of failure:
+ * `malformed-signature`, `wrong-key`, `unusable-key` or `bad-signature`
+ * (bad arguments are `invalid-input`).
+ *
+ * A signature is valid when it is exactly one OpenPGP v4 signature packet,
+ * SHA-256, SHA-384 or SHA-512, issued by the primary key or one of its
+ * subkeys, created at or before `date` and not expired at `date`, made by a
+ * key or subkey that can sign both at the signature's creation time and at
+ * `date` (not expired, not revoked, sign flag set, valid binding and
+ * back-signature, openpgp.js's algorithm floor), and when it verifies
+ * cryptographically. `date` is required; the codec reads no clock.
+ */
+export interface IOpenPgpVerifier {
+    /** The primary key's v4 fingerprint, 40 uppercase hex digits (as `IOpenPgpKeyPair.fingerprint`). */
+    readonly fingerprint: string;
+    /**
+     * A binary detached signature of type 0x00 over `data`: the packet
+     * `IOpenPgpSigner.signBinary` returns, an Arch `.sig`.
+     */
+    verifyDetachedSignature(inputArg: {
+        data: Uint8Array;
+        signature: Uint8Array;
+        date: Date;
+    }): Promise<IOpenPgpSignatureVerification>;
+    /**
+     * An armored detached signature of type 0x00 over `data`: `Release.gpg`,
+     * `repomd.xml.asc`. The armor is ASCII.
+     */
+    verifyArmoredDetachedSignature(inputArg: {
+        data: Uint8Array;
+        signatureArmored: Uint8Array;
+        date: Date;
+    }): Promise<IOpenPgpSignatureVerification>;
+    /**
+     * A cleartext-signed message with a signature of type 0x01: `InRelease`.
+     * The message is strict UTF-8 with LF line endings; see
+     * `splitCleartextSignedMessage` for what its framing may hold.
+     */
+    verifyCleartextMessage(inputArg: {
+        message: Uint8Array;
+        date: Date;
+    }): Promise<IOpenPgpCleartextVerification>;
+}
+/**
+ * Builds a verifier from one armored OpenPGP public key: exactly one
+ * transferable v4 public key (the primary key with its user IDs, subkeys and
+ * self-signatures, all v4) in exactly one `PUBLIC KEY BLOCK`. A private key
+ * block, several blocks or keys, a v6 key, text around the block, an armor
+ * CRC-24 that does not match or any other garbage is `invalid-key`
+ * (`detail.field` `publicKeyArmored`). Only the structure is checked here;
+ * whether a key can sign depends on time and is checked at verification.
+ */
+export declare function createOpenPgpVerifier(inputArg: {
+    publicKeyArmored: string;
+}): Promise<IOpenPgpVerifier>;