@push.rocks/smartlinuxrepo 1.1.2 → 1.2.0

package/ts/shared/errors.ts

@@ -6,7 +6,9 @@ import type { ILinuxPackageLimits } from './limits.js';
  * - `unsupported-compression`: a compression the format does not allow.
  * - `malformed-archive`: broken container structure (ar, tar, gzip, xz, zstd framing or data).
  * - `malformed-header`: a broken package header (RPM lead and headers).
- * - `missing-field` / `invalid-field`: package metadata that is absent or not acceptable.
+ * - `missing-field` / `invalid-field`: package metadata that is absent or not acceptable; for the index
+ *   readers, a unit without its key (`Filename`, `pkgid`, `id`, a `<data>` part, the `APKINDEX` member)
+ *   or a Release checksum line that fails its grammar.
  * - `unsupported-package-format`: input that is not the expected package format, or uses a form of it
  *   the codec does not read (the data of a sparse tar entry).
  * - `truncated`: only a clean early end of input.
@@ -17,14 +19,20 @@ import type { ILinuxPackageLimits } from './limits.js';
  * - `malformed-signature`: an OpenPGP signature or cleartext-signed message the verifier refuses before
  *   any cryptography: armor, encoding, framing, packet count, version, signature type, a hash outside
  *   SHA-256/384/512, a `Hash:` header that does not name the signature's hash, a missing creation time,
- *   a missing or wildcard issuer, or an unknown critical subpacket or notation.
+ *   a missing or wildcard issuer, or an unknown critical subpacket or notation; and an Alpine index
+ *   whose signature member the Alpine verifier refuses (no `.SIGN.` entry, more than one, a type other
+ *   than `RSA`, an entry that is not a regular `.SIGN.<type>.<keyName>` file).
  * - `wrong-key`: the signature's issuer is neither the verifier's primary key nor one of its subkeys, or
- *   its issuer fingerprint disagrees (`detail.value` carries the issuer in hex).
+ *   its issuer fingerprint disagrees (`detail.value` carries the issuer in hex); for the Alpine verifier,
+ *   the `.SIGN.RSA.<keyName>` entry names another key (`detail.value` carries that key name).
  * - `unusable-key`: the issuing key or subkey cannot sign at the signature's creation time or at the
  *   verification date: expired, revoked, no sign flag, a bad binding or back-signature, created after
  *   the signature, or below the algorithm floor.
  * - `bad-signature`: the cryptographic check failed, the signature was created after the verification
  *   date, or it has expired at that date.
+ * - `malformed-index`: an index document an index reader refuses (1.2.0): line framing, block or
+ *   stanza structure, XML well-formedness, a DOCTYPE, an unexpected root or child element, an
+ *   ambiguous duplicate key line or element, or a tar member type an index does not hold.
  *
  * New codes arrive in minor releases: a consumer that switches over `code` needs a default branch.
  *
@@ -48,7 +56,8 @@ export type TLinuxRepoErrorCode =
   | 'malformed-signature'
   | 'wrong-key'
   | 'unusable-key'
-  | 'bad-signature';
+  | 'bad-signature'
+  | 'malformed-index';
 
 /** Names the field, structure or limit an error is about. */
 export interface ILinuxRepoErrorDetail {

package/ts/shared/limits.ts

@@ -29,6 +29,11 @@ export interface ILinuxPackageLimits {
    * `maxMetadataBytes`, not here.
    */
   maxHeaderBytes: number;
+  /**
+   * One decoded index document (decompressed output, or the plain input), in
+   * bytes. Only the index readers read it (1.2.0).
+   */
+  maxIndexBytes: number;
 }
 
 const KiB = 1024;
@@ -44,7 +49,9 @@ const GiB = 1024 * MiB;
  * - `maxEntries` and `maxFileListBytes` are Gitea's Arch file-list caps
  *   (Alpine's 1024 `.PKGINFO` values fold into `maxEntries`);
  * - `maxHeaderBytes` covers a full PAX + GNU long name + GNU long link chain at
- *   Go `archive/tar`'s 1 MiB per special record, and Gitea's 64 KiB line limit.
+ *   Go `archive/tar`'s 1 MiB per special record, and Gitea's 64 KiB line limit;
+ * - `maxIndexBytes` bounds the memory of one index reader call (the decoded
+ *   document is buffered once); 256 MiB holds a full Debian `main` `Packages`.
  */
 export const DEFAULT_LINUX_PACKAGE_LIMITS: Readonly<ILinuxPackageLimits> = Object.freeze({
   maxPackageBytes: 8 * GiB,
@@ -54,6 +61,7 @@ export const DEFAULT_LINUX_PACKAGE_LIMITS: Readonly<ILinuxPackageLimits> = Objec
   maxEntries: 100_000,
   maxFileListBytes: 16 * MiB,
   maxHeaderBytes: 4 * MiB,
+  maxIndexBytes: 256 * MiB,
 });
 
 const LIMIT_KEYS = Object.keys(DEFAULT_LINUX_PACKAGE_LIMITS) as Array<keyof ILinuxPackageLimits>;

package/ts/shared/types.ts

@@ -249,3 +249,6 @@ export interface ILinuxIndexFile {
   /** Other paths serving the same bytes (Debian `by-hash/<ALGO>/<hex>` for every listed hash). */
   aliases: string[];
 }
+
+/** The stream compressions the readers decode; the caller names it from the file name. */
+export type TLinuxCompression = 'none' | 'gzip' | 'xz' | 'zstd';

package/ts/signing/verifiers.ts

@@ -1,6 +1,8 @@
 import * as plugins from '../plugins.js';
+import { splitAlpineIndexSignature } from '../alpine/apkindexreader.js';
 import { LinuxRepoError } from '../shared/errors.js';
-import { assertBytes, assertString, assertTimestamp } from '../shared/validation.js';
+import { resolveLinuxPackageLimits, type ILinuxPackageLimits } from '../shared/limits.js';
+import { assertBytes, assertSegmentName, assertString, assertTimestamp } from '../shared/validation.js';
 import {
   dearmor,
   decodeArmorBytes,
@@ -355,3 +357,113 @@ async function verifySignature(inputArg: {
     hashAlgorithm,
   };
 }
+
+/** An Alpine index signature that verified. */
+export interface IAlpineSignatureVerification {
+  /** The key name of the `.SIGN.RSA.<keyName>` entry: the verifier's. */
+  readonly keyName: string;
+  readonly hashAlgorithm: 'sha1';
+}
+
+/**
+ * Verifies Alpine index signatures against one RSA public key. Fails closed
+ * with a `LinuxRepoError` and never returns a verdict of failure:
+ * `malformed-signature`, `wrong-key` or `bad-signature` (bad arguments are
+ * `invalid-input`; the index's own framing keeps its reader codes).
+ */
+export interface IAlpineVerifier {
+  /** The key name apk finds the public key under (`/etc/apk/keys/<keyName>`). */
+  readonly keyName: string;
+  /**
+   * Verifies the one `.SIGN.RSA.<keyName>` entry of an `APKINDEX.tar.gz` over
+   * its signed bytes (everything after the signature member): RSASSA-PKCS1-v1_5
+   * over SHA-1, as apk-tools 2 and Gitea sign. The split is
+   * `readAlpineIndex`'s; no signature member, more than one `.SIGN.` entry or
+   * a type other than `RSA` is `malformed-signature`, an entry naming another
+   * key `wrong-key` (`detail.value` the entry's key name), and a signature
+   * that does not verify `bad-signature`. The format carries no time.
+   */
+  verifyIndexSignature(inputArg: { index: Uint8Array; limits?: Partial<ILinuxPackageLimits> }): Promise<IAlpineSignatureVerification>;
+}
+
+/** The OpenPGP verifier's RSA floor (`VERIFY_CONFIG.minRSABits`), for the Alpine key too. */
+const ALPINE_MIN_RSA_BITS = 2047;
+const ALPINE_PUBLIC_KEY_PEM = /^-----BEGIN PUBLIC KEY-----\n(?:[A-Za-z0-9+/=]+\n)+-----END PUBLIC KEY-----\n?$/;
+
+/**
+ * Builds an Alpine verifier from one PKIX `PUBLIC KEY` PEM block, the form
+ * Gitea serves (`GET /alpine/key`, `util.GenerateKeyPair`) and Alpine installs
+ * in `/etc/apk/keys`, and the key name apk finds it under. The PEM must be
+ * exactly one block with nothing around it but one final LF, and an RSA key
+ * of at least 2047 bits (the OpenPGP verifier's floor); anything else is
+ * `invalid-key` (`publicKeyPem`). A `keyName` that is empty or holds `/` or a
+ * control character is `invalid-input`.
+ */
+export function createAlpineVerifier(inputArg: { publicKeyPem: string; keyName: string }): IAlpineVerifier {
+  if (inputArg === null || typeof inputArg !== 'object') {
+    throw new LinuxRepoError('invalid-input', 'input must be an object', { field: 'input' });
+  }
+  assertString(inputArg.publicKeyPem, 'publicKeyPem');
+  assertSegmentName(inputArg.keyName, 'keyName');
+  if (!ALPINE_PUBLIC_KEY_PEM.test(inputArg.publicKeyPem)) {
+    throw new LinuxRepoError('invalid-key', 'the Alpine public key must be exactly one PKIX "PUBLIC KEY" PEM block', {
+      field: 'publicKeyPem',
+    });
+  }
+  let key: plugins.crypto.KeyObject;
+  try {
+    key = plugins.crypto.createPublicKey({ key: inputArg.publicKeyPem, format: 'pem' });
+  } catch (error) {
+    throw new LinuxRepoError('invalid-key', 'the Alpine public key cannot be read', { field: 'publicKeyPem' }, {
+      cause: error,
+    });
+  }
+  const modulusLength = key.asymmetricKeyDetails?.modulusLength ?? 0;
+  if (key.asymmetricKeyType !== 'rsa' || modulusLength < ALPINE_MIN_RSA_BITS) {
+    throw new LinuxRepoError('invalid-key', `the Alpine public key must be an RSA key of at least ${ALPINE_MIN_RSA_BITS} bits`, {
+      field: 'publicKeyPem',
+    });
+  }
+  const keyName = inputArg.keyName;
+  return {
+    keyName,
+    verifyIndexSignature: async (input) => {
+      assertInputObject(input);
+      assertBytes(input.index, 'index');
+      const limits = resolveLinuxPackageLimits(input.limits);
+      const split = await splitAlpineIndexSignature(input.index, limits);
+      const malformed = (messageArg: string) => new LinuxRepoError('malformed-signature', messageArg, { field: 'index' });
+      if (split.signatures.length === 0) {
+        throw malformed('the index is not signed');
+      }
+      if (split.signatures.length > 1) {
+        throw malformed(`the index holds ${split.signatures.length} .SIGN. entries, expected one`);
+      }
+      const entry = split.signatures[0];
+      if (entry.type !== 'RSA') {
+        throw malformed(`the index signature type is ${JSON.stringify(entry.type)}, expected "RSA"`);
+      }
+      if (entry.keyName !== keyName) {
+        throw new LinuxRepoError('wrong-key', 'the index was signed under another key name', {
+          field: 'index',
+          value: entry.keyName,
+        });
+      }
+      let verified: boolean;
+      try {
+        verified = plugins.crypto.verify(
+          'sha1',
+          input.index.subarray(split.signedOffset),
+          { key, padding: plugins.crypto.constants.RSA_PKCS1_PADDING },
+          entry.signature,
+        );
+      } catch (error) {
+        throw new LinuxRepoError('bad-signature', 'the index signature does not verify', { field: 'index' }, { cause: error });
+      }
+      if (!verified) {
+        throw new LinuxRepoError('bad-signature', 'the index signature does not verify', { field: 'index' });
+      }
+      return { keyName, hashAlgorithm: 'sha1' };
+    },
+  };
+}