@push.rocks/smartlinuxrepo 1.0.0 → 1.1.1

package/ts/shared/errors.ts

@@ -14,6 +14,19 @@ import type { ILinuxPackageLimits } from './limits.js';
  * - `invalid-input`: a bad argument from the caller.
  * - `invalid-key`: a key the codec cannot use.
  * - `signing-failed`: a codec signer failed, or a signer returned something that is not signature bytes.
+ * - `malformed-signature`: an OpenPGP signature or cleartext-signed message the verifier refuses before
+ *   any cryptography: armor, encoding, framing, packet count, version, signature type, a hash outside
+ *   SHA-256/384/512, a `Hash:` header that does not name the signature's hash, a missing creation time,
+ *   a missing or wildcard issuer, or an unknown critical subpacket or notation.
+ * - `wrong-key`: the signature's issuer is neither the verifier's primary key nor one of its subkeys, or
+ *   its issuer fingerprint disagrees (`detail.value` carries the issuer in hex).
+ * - `unusable-key`: the issuing key or subkey cannot sign at the signature's creation time or at the
+ *   verification date: expired, revoked, no sign flag, a bad binding or back-signature, created after
+ *   the signature, or below the algorithm floor.
+ * - `bad-signature`: the cryptographic check failed, the signature was created after the verification
+ *   date, or it has expired at that date.
+ *
+ * New codes arrive in minor releases: a consumer that switches over `code` needs a default branch.
  *
  * The codec never wraps an error it did not raise: an error from the caller's
  * source or from a caller-supplied signer propagates unchanged. An underlying
@@ -31,7 +44,11 @@ export type TLinuxRepoErrorCode =
   | 'digest-mismatch'
   | 'invalid-input'
   | 'invalid-key'
-  | 'signing-failed';
+  | 'signing-failed'
+  | 'malformed-signature'
+  | 'wrong-key'
+  | 'unusable-key'
+  | 'bad-signature';
 
 /** Names the field, structure or limit an error is about. */
 export interface ILinuxRepoErrorDetail {

package/ts/signing/openpgpframing.ts

@@ -1,4 +1,5 @@
-import { LinuxRepoError } from '../shared/errors.js';
+import { decodeLatin1, decodeStrictUtf8 } from '../readers/text.js';
+import { LinuxRepoError, type TLinuxRepoErrorCode } from '../shared/errors.js';
 import { assertAsyncIterable, assertBytes, assertString, assertTimestamp } from '../shared/validation.js';
 import { singleChunk, type IOpenPgpSigner } from './signers.js';
 
@@ -6,6 +7,10 @@ import { singleChunk, type IOpenPgpSigner } from './signers.js';
  * The OpenPGP framing the codec owns: only the bytes of the signature packet
  * may vary; framing and armor are deterministic.
  * Armor has no headers, 64-column base64 and a CRC-24 line.
+ *
+ * The readers below are the strict inverses the verifier uses; openpgp.js's
+ * own dearmoring is never used (it skips text around the block, ignores the
+ * CRC-24 and strips trailing whitespace inside cleartext).
  */
 
 const BASE64_LINE = 64;
@@ -47,7 +52,7 @@ export async function createDetachedArmoredSignature(inputArg: {
  * Cleartext-signs `text` (`InRelease`). The text must be canonical: no CR and
  * no trailing spaces or tabs on any line. The signed text is `text` without
  * its final line break; the output always ends the text with one line break
- * before the signature block, as GnuPG and Go do. Lines starting with `-` are
+ * before the signature block, as GnuPG does. Lines starting with `-` are
  * dash-escaped. The header is always `Hash: SHA256`.
  */
 export async function createCleartextSignedMessage(inputArg: {
@@ -98,6 +103,294 @@ function assertSignatureBytes(packetArg: unknown): asserts packetArg is Uint8Arr
   }
 }
 
+/** How a framing reader refuses its input: the error code and the input field it names. */
+export interface IFramingFailure {
+  code: TLinuxRepoErrorCode;
+  field: string;
+}
+
+export type TArmorLabel = 'PUBLIC KEY BLOCK' | 'SIGNATURE';
+
+/** A well-formed armor header line (`Key: Value`), as openpgp.js 6.3.2 checks it (`verifyHeaders$1`). */
+const ARMOR_HEADER_PATTERN = /^([^\s:]|[^\s:][^:]*[^\s:]): .+$/;
+const BASE64_LINE_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/;
+const BASE64_PATTERN = /^[A-Za-z0-9+/]*={0,2}$/;
+const CRC_LINE_PATTERN = /^=[A-Za-z0-9+/]{4}$/;
+const CLEARTEXT_BEGIN = '-----BEGIN PGP SIGNED MESSAGE-----';
+const SIGNATURE_BEGIN = '-----BEGIN PGP SIGNATURE-----';
+
+/** RFC 9580 table 23 hash text names (the `Hash:` header) and their algorithm IDs. */
+const HASH_TEXT_NAMES: ReadonlyMap<string, number> = new Map([
+  ['MD5', 1],
+  ['SHA1', 2],
+  ['RIPEMD160', 3],
+  ['SHA256', 8],
+  ['SHA384', 9],
+  ['SHA512', 10],
+  ['SHA224', 11],
+  ['SHA3-256', 12],
+  ['SHA3-512', 14],
+]);
+
+function framingError(failureArg: IFramingFailure, messageArg: string): LinuxRepoError {
+  return new LinuxRepoError(failureArg.code, messageArg, { field: failureArg.field });
+}
+
+/** Bytes that must be ASCII armor, as text; any byte above 0x7F is refused. */
+export function decodeArmorBytes(bytesArg: Uint8Array, failureArg: IFramingFailure): string {
+  for (let i = 0; i < bytesArg.length; i++) {
+    if (bytesArg[i] > 0x7f) {
+      throw framingError(failureArg, 'ASCII armor must be ASCII');
+    }
+  }
+  return decodeLatin1(bytesArg);
+}
+
+/**
+ * Reads exactly one ASCII armor block labelled `labelArg` (RFC 9580 section
+ * 6.2) and returns its bytes; the inverse of `armorSignature`. Lines may end
+ * in LF or CRLF and carry trailing spaces or tabs, and blank lines may
+ * surround the block. Well-formed `Key: Value` headers are ignored; the
+ * CRC-24 line is optional and must match when present. Refused with
+ * `failureArg`: non-ASCII text, another label, a second block or any other
+ * text outside the block, a malformed header line, no blank line before the
+ * data, base64 that is not canonical, no data, and a CRC-24 that does not
+ * match.
+ */
+export function dearmor(textArg: string, labelArg: TArmorLabel, failureArg: IFramingFailure): Uint8Array {
+  const lines = textArg.split('\n').map(trimLineEnd);
+  let first = 0;
+  while (first < lines.length && lines[first] === '') {
+    first += 1;
+  }
+  let last = lines.length - 1;
+  while (last >= first && lines[last] === '') {
+    last -= 1;
+  }
+  return readArmorBlock(lines.slice(first, last + 1), labelArg, failureArg);
+}
+
+/** The line without trailing spaces, tabs and CRs; a loop, as a `+$` regex is quadratic on a long run of them. */
+function trimLineEnd(lineArg: string): string {
+  let end = lineArg.length;
+  while (end > 0 && (lineArg[end - 1] === ' ' || lineArg[end - 1] === '\t' || lineArg[end - 1] === '\r')) {
+    end -= 1;
+  }
+  return lineArg.slice(0, end);
+}
+
+/** One armor block, from its BEGIN line to its END line, as exactly these lines; ASCII only. */
+function readArmorBlock(linesArg: readonly string[], labelArg: TArmorLabel, failureArg: IFramingFailure): Uint8Array {
+  if (linesArg.some((line) => !/^[\x00-\x7f]*$/.test(line))) {
+    throw framingError(failureArg, 'ASCII armor must be ASCII');
+  }
+  const begin = `-----BEGIN PGP ${labelArg}-----`;
+  const end = `-----END PGP ${labelArg}-----`;
+  if (linesArg[0] !== begin) {
+    throw framingError(failureArg, `expected exactly one ${begin} block and nothing else`);
+  }
+  const endIndex = linesArg.indexOf(end);
+  if (endIndex < 0 || endIndex !== linesArg.length - 1) {
+    throw framingError(failureArg, `expected exactly one ${begin} block ending in ${end} and nothing else`);
+  }
+  let index = 1;
+  for (; index < endIndex && linesArg[index] !== ''; index++) {
+    if (!ARMOR_HEADER_PATTERN.test(linesArg[index])) {
+      throw framingError(failureArg, 'malformed armor header line');
+    }
+  }
+  if (index >= endIndex) {
+    throw framingError(failureArg, 'the armor has no blank line before its data');
+  }
+  index += 1;
+  const dataLines: string[] = [];
+  let crcLine: string | null = null;
+  for (; index < endIndex; index++) {
+    const line = linesArg[index];
+    if (index === endIndex - 1 && line.startsWith('=')) {
+      crcLine = line;
+      break;
+    }
+    if (!BASE64_LINE_PATTERN.test(line)) {
+      throw framingError(failureArg, 'the armor data is not base64');
+    }
+    dataLines.push(line);
+  }
+  const base64 = dataLines.join('');
+  if (base64.length === 0 || base64.length % 4 !== 0 || !BASE64_PATTERN.test(base64)) {
+    throw framingError(failureArg, 'the armor data is not one base64 string');
+  }
+  const decoded = Buffer.from(base64, 'base64');
+  if (decoded.toString('base64') !== base64) {
+    throw framingError(failureArg, 'the armor data is not canonical base64');
+  }
+  const bytes = new Uint8Array(decoded.buffer, decoded.byteOffset, decoded.byteLength);
+  if (crcLine !== null && (!CRC_LINE_PATTERN.test(crcLine) || crcLine.slice(1) !== crc24Base64(bytes))) {
+    throw framingError(failureArg, 'the armor CRC-24 does not match its data');
+  }
+  return bytes;
+}
+
+/**
+ * The packet tags of a binary OpenPGP packet sequence, read from the packet
+ * headers alone (RFC 9580 section 4.2); no body is parsed. openpgp.js skips
+ * marker, trust and padding packets and unknown non-critical packet types
+ * without a trace (`PacketList.read`, `dist/node/openpgp.mjs:12320-12385`),
+ * so the verifier counts packets here. Refused with `failureArg`: a header
+ * without its high bit, a partial body length (no key or signature packet
+ * may use one), and input that ends inside a header or a body.
+ */
+export function readPacketTags(bytesArg: Uint8Array, failureArg: IFramingFailure): number[] {
+  const tags: number[] = [];
+  let offset = 0;
+  while (offset < bytesArg.length) {
+    const ctb = bytesArg[offset];
+    if ((ctb & 0x80) === 0) {
+      throw framingError(failureArg, `no OpenPGP packet header at byte ${offset}`);
+    }
+    let tag: number;
+    let headerLength: number;
+    let bodyLength: number;
+    if ((ctb & 0x40) !== 0) {
+      tag = ctb & 0x3f;
+      const first = bytesArg[offset + 1];
+      if (first === undefined) {
+        throw framingError(failureArg, 'the input ends inside a packet header');
+      }
+      if (first < 192) {
+        headerLength = 2;
+        bodyLength = first;
+      } else if (first < 224) {
+        if (offset + 3 > bytesArg.length) {
+          throw framingError(failureArg, 'the input ends inside a packet header');
+        }
+        headerLength = 3;
+        bodyLength = (first - 192) * 256 + bytesArg[offset + 2] + 192;
+      } else if (first === 255) {
+        if (offset + 6 > bytesArg.length) {
+          throw framingError(failureArg, 'the input ends inside a packet header');
+        }
+        headerLength = 6;
+        bodyLength = readUint32(bytesArg, offset + 2);
+      } else {
+        throw framingError(failureArg, 'a partial body length is not allowed here');
+      }
+    } else {
+      tag = (ctb >> 2) & 0x0f;
+      const lengthType = ctb & 0x03;
+      if (lengthType === 3) {
+        // indeterminate length: the packet runs to the end of the input
+        headerLength = 1;
+        bodyLength = bytesArg.length - offset - 1;
+      } else {
+        const lengthBytes = 1 << lengthType;
+        if (offset + 1 + lengthBytes > bytesArg.length) {
+          throw framingError(failureArg, 'the input ends inside a packet header');
+        }
+        headerLength = 1 + lengthBytes;
+        bodyLength = 0;
+        for (let i = 0; i < lengthBytes; i++) {
+          bodyLength = bodyLength * 256 + bytesArg[offset + 1 + i];
+        }
+      }
+    }
+    const packetEnd = offset + headerLength + bodyLength;
+    if (packetEnd > bytesArg.length) {
+      throw framingError(failureArg, 'the input ends inside a packet');
+    }
+    tags.push(tag);
+    offset = packetEnd;
+  }
+  return tags;
+}
+
+function readUint32(bytesArg: Uint8Array, offsetArg: number): number {
+  return ((bytesArg[offsetArg] * 256 + bytesArg[offsetArg + 1]) * 256 + bytesArg[offsetArg + 2]) * 256 + bytesArg[offsetArg + 3];
+}
+
+/** A cleartext-signed message split into its parts. */
+export interface ICleartextSignedParts {
+  /** Dash-escaping removed, lines joined by LF, without the line break before the signature block. */
+  signedText: string;
+  /** The RFC 9580 hash algorithm IDs the `Hash:` headers name, in order; empty without headers. */
+  headerHashAlgorithms: number[];
+  /** The bytes of the signature armor block. */
+  signature: Uint8Array;
+}
+
+/**
+ * Splits a cleartext-signed message (`InRelease`, RFC 9580 section 7); the
+ * inverse of `createCleartextSignedMessage`, and as strict as apt's own split
+ * (apt-pkg `SplitClearSignedFile`). The message is strict UTF-8 with LF line
+ * endings: the first line is `-----BEGIN PGP SIGNED MESSAGE-----`, then
+ * optional `Hash:` headers (comma-separated RFC 9580 text names), a blank
+ * line, the dash-escaped text and exactly one signature armor block, which
+ * may be followed by one line break and nothing else. Refused with
+ * `failureArg`: invalid UTF-8, a CR, a line ending in a space or tab, text
+ * before the message block or after the signature block, any other header, an
+ * unknown hash name, a text line starting with `-` but not `- `, and an empty
+ * text section. Armor headers inside the signature block are ignored as in
+ * `dearmor`.
+ */
+export function splitCleartextSignedMessage(bytesArg: Uint8Array, failureArg: IFramingFailure): ICleartextSignedParts {
+  const text = decodeStrictUtf8(bytesArg);
+  if (text === null) {
+    throw framingError(failureArg, 'the cleartext-signed message is not valid UTF-8');
+  }
+  if (text.includes('\r')) {
+    throw framingError(failureArg, 'the cleartext-signed message must use LF line endings');
+  }
+  const lines = text.split('\n');
+  if (lines[lines.length - 1] === '') {
+    lines.pop();
+  }
+  if (lines.some((line) => /[ \t]$/.test(line))) {
+    throw framingError(failureArg, 'a line of the cleartext-signed message ends with a space or tab');
+  }
+  if (lines[0] !== CLEARTEXT_BEGIN) {
+    throw framingError(failureArg, `the message does not start with ${CLEARTEXT_BEGIN}`);
+  }
+  let index = 1;
+  const headerHashAlgorithms: number[] = [];
+  for (; index < lines.length && lines[index] !== ''; index++) {
+    const header = /^Hash: (.+)$/.exec(lines[index]);
+    if (header === null) {
+      throw framingError(failureArg, 'only Hash: headers are allowed in a cleartext-signed message');
+    }
+    for (const name of header[1].split(',')) {
+      const algorithm = HASH_TEXT_NAMES.get(name.trim());
+      if (algorithm === undefined) {
+        throw framingError(failureArg, `unknown hash name in the Hash: header: ${name.trim()}`);
+      }
+      headerHashAlgorithms.push(algorithm);
+    }
+  }
+  index += 1;
+  const textLines: string[] = [];
+  for (; index < lines.length && lines[index] !== SIGNATURE_BEGIN; index++) {
+    const line = lines[index];
+    if (line.startsWith('-')) {
+      if (!line.startsWith('- ')) {
+        throw framingError(failureArg, 'a text line starts with "-" without the "- " escape');
+      }
+      textLines.push(line.slice(2));
+    } else {
+      textLines.push(line);
+    }
+  }
+  if (index >= lines.length) {
+    throw framingError(failureArg, `the message has no ${SIGNATURE_BEGIN} block`);
+  }
+  if (textLines.length === 0) {
+    throw framingError(failureArg, 'the message has no text section');
+  }
+  return {
+    signedText: textLines.join('\n'),
+    headerHashAlgorithms,
+    signature: readArmorBlock(lines.slice(index), 'SIGNATURE', failureArg),
+  };
+}
+
 /** RFC 4880 section 6.1 CRC-24, base64-encoded. */
 function crc24Base64(bytesArg: Uint8Array): string {
   let crc = 0xb704ce;