@push.rocks/smartlinuxrepo 1.1.2 → 1.2.0

package/ts/debian/indexreader.ts

@@ -0,0 +1,372 @@
+import { LinuxRepoError } from '../shared/errors.js';
+import { resolveLinuxPackageLimits, type ILinuxPackageLimits } from '../shared/limits.js';
+import type { TLinuxCompression } from '../shared/types.js';
+import {
+  assertLinuxCompression,
+  assertReaderBytes,
+  assertReaderInput,
+  checkUnitBytes,
+  countUnit,
+  isBlankLine,
+  lines,
+  readIndexDocument,
+  type ILine,
+} from '../readers/document.js';
+import { decodeGoUtf8, decodeLatin1 } from '../readers/text.js';
+import { fromByteString, goTrimSpace } from './gostring.js';
+
+/** One stanza of a `Packages` index. */
+export interface IDebianPackagesStanza {
+  /** The stanza's lines, first line through the last LF, without a separating empty line (a view into `decoded`). */
+  readonly bytes: Uint8Array;
+  /** The stanza's offset in `decoded`. */
+  readonly offset: number;
+  /** The first-line value of the stanza's last `Filename` field: the unit key. */
+  readonly filename: string;
+  /** The first-line values of the last `Package`, `Version` and `Architecture` fields; `''` when absent. */
+  readonly package: string;
+  readonly version: string;
+  readonly architecture: string;
+}
+
+/** A `Packages` index read into its stanzas. */
+export interface IDebianPackagesIndex {
+  /** The decompressed document (a copy for `'none'`); every `offset` indexes into it. */
+  readonly decoded: Uint8Array;
+  /** Every stanza in document order, duplicates included. */
+  readonly stanzas: readonly IDebianPackagesStanza[];
+}
+
+/** One field of a `Release` file. */
+export interface IDebianReleaseField {
+  /** The field name as written. */
+  readonly name: string;
+  /**
+   * The first-line value without surrounding spaces and tabs, then `"\n"`
+   * plus each continuation line verbatim.
+   */
+  readonly value: string;
+  /** The field's line(s), each with its LF. */
+  readonly bytes: Uint8Array;
+}
+
+/** One file of a `Release` checksum list. */
+export interface IDebianReleaseFile {
+  readonly path: string;
+  readonly size: number;
+  /** As written: hex of the algorithm's length. */
+  readonly digest: string;
+}
+
+/** A `Release` file read into its fields and checksum lists. */
+export interface IDebianRelease {
+  /** Every field in order, the checksum fields included. */
+  readonly fields: readonly IDebianReleaseField[];
+  /** The `MD5Sum`, `SHA1`, `SHA256` and `SHA512` lists; `[]` when the field is absent. */
+  readonly files: {
+    readonly md5Sum: readonly IDebianReleaseFile[];
+    readonly sha1: readonly IDebianReleaseFile[];
+    readonly sha256: readonly IDebianReleaseFile[];
+    readonly sha512: readonly IDebianReleaseFile[];
+  };
+}
+
+const SPACE = 0x20;
+const TAB = 0x09;
+const COLON = 0x3a;
+
+/** The four checksum fields of a Release, lower-cased, with their list key and hex length. */
+const RELEASE_CHECKSUM_FIELDS: ReadonlyMap<string, { key: keyof IDebianRelease['files']; hexLength: number }> = new Map([
+  ['md5sum', { key: 'md5Sum', hexLength: 32 }],
+  ['sha1', { key: 'sha1', hexLength: 40 }],
+  ['sha256', { key: 'sha256', hexLength: 64 }],
+  ['sha512', { key: 'sha512', hexLength: 128 }],
+] as const);
+
+/**
+ * Reads a `Packages` index (`dists/<d>/<c>/binary-<a>/Packages`, `.gz`,
+ * `.xz`; the caller names `compression` from the file name) into its stanzas.
+ *
+ * - Lines end in LF, the last one too; a line longer than `maxHeaderBytes`
+ *   is `limit-exceeded`.
+ * - A stanza is a maximal run of non-empty lines; one or more empty lines
+ *   separate stanzas, and leading or trailing empty lines are accepted.
+ * - A line holding only spaces or tabs is `malformed-index` (Gitea and the
+ *   codec cannot write one; Debian Policy and the strip rule would read it
+ *   differently). A stanza starting with a continuation line is
+ *   `malformed-index`. A line without `:` is accepted (Gitea can write one).
+ * - Field names are the Go `TrimSpace` of the bytes before the first `:`,
+ *   matched ASCII case-insensitively; values are the Go `TrimSpace` of the
+ *   rest of the field's first line, decoded as Go does (U+FFFD for invalid
+ *   UTF-8), from the field's last occurrence.
+ * - A stanza without `Filename` is `missing-field` (`Filename`, `value` the
+ *   stanza offset).
+ *
+ * Bounds: the decoded document by `maxIndexBytes`, stanzas by `maxEntries`,
+ * one stanza by `maxMetadataBytes`. Every stanza is returned in document
+ * order, duplicates included; `bytes` are views into `decoded`.
+ */
+export async function readDebianPackagesIndex(inputArg: {
+  bytes: Uint8Array;
+  compression: TLinuxCompression;
+  limits?: Partial<ILinuxPackageLimits>;
+}): Promise<IDebianPackagesIndex> {
+  assertReaderInput(inputArg);
+  assertReaderBytes(inputArg.bytes);
+  assertLinuxCompression(inputArg.compression);
+  const limits = resolveLinuxPackageLimits(inputArg.limits);
+  const decoded = await readIndexDocument(inputArg.bytes, inputArg.compression, limits);
+
+  const stanzas: IDebianPackagesStanza[] = [];
+  let stanza: IStanzaState | null = null;
+  const finish = (endArg: number) => {
+    if (stanza === null) {
+      return;
+    }
+    const current: IStanzaState = stanza;
+    stanza = null;
+    if (current.filename === null) {
+      throw new LinuxRepoError('missing-field', 'a Packages stanza has no Filename field', {
+        field: 'Filename',
+        value: current.start,
+      });
+    }
+    stanzas.push({
+      bytes: decoded.subarray(current.start, endArg),
+      offset: current.start,
+      filename: current.filename,
+      package: current.package,
+      version: current.version,
+      architecture: current.architecture,
+    });
+  };
+  for (const line of lines(decoded, limits.maxHeaderBytes, 'Packages')) {
+    if (line.end === line.start) {
+      finish(line.start);
+      continue;
+    }
+    if (isBlankLine(decoded, line)) {
+      throw new LinuxRepoError('malformed-index', 'a Packages line holds only spaces or tabs', {
+        field: 'Packages',
+        value: line.start,
+      });
+    }
+    const first = decoded[line.start];
+    if (stanza === null) {
+      if (first === SPACE || first === TAB) {
+        throw new LinuxRepoError('malformed-index', 'a Packages stanza starts with a continuation line', {
+          field: 'Packages',
+          value: line.start,
+        });
+      }
+      countUnit(stanzas.length + 1, limits, 'Packages stanza');
+      stanza = { start: line.start, filename: null, package: '', version: '', architecture: '' };
+    }
+    checkUnitBytes(line.end + 1 - stanza.start, limits, 'Packages stanza');
+    if (first === SPACE || first === TAB) {
+      continue;
+    }
+    readPackagesField(decoded, line, stanza);
+  }
+  finish(decoded.length);
+  return { decoded, stanzas };
+}
+
+interface IStanzaState {
+  start: number;
+  filename: string | null;
+  package: string;
+  version: string;
+  architecture: string;
+}
+
+/** Takes the key fields' first-line values; a later occurrence replaces an earlier one. */
+function readPackagesField(bytesArg: Uint8Array, lineArg: ILine, stanzaArg: IStanzaState): void {
+  const line = bytesArg.subarray(lineArg.start, lineArg.end);
+  const colon = line.indexOf(COLON);
+  if (colon < 0) {
+    return;
+  }
+  const name = asciiLower(goTrimSpace(decodeLatin1(line.subarray(0, colon))));
+  if (name !== 'filename' && name !== 'package' && name !== 'version' && name !== 'architecture') {
+    return;
+  }
+  const value = fromByteString(goTrimSpace(decodeLatin1(line.subarray(colon + 1))));
+  if (name === 'filename') {
+    stanzaArg.filename = value;
+  } else if (name === 'package') {
+    stanzaArg.package = value;
+  } else if (name === 'version') {
+    stanzaArg.version = value;
+  } else {
+    stanzaArg.architecture = value;
+  }
+}
+
+/**
+ * Reads a `Release` file (the plain `dists/<d>/Release`) into its fields and
+ * checksum lists. For an `InRelease`, verify it with `createOpenPgpVerifier`
+ * and pass the verified `signedText` here (plus a final LF when it lacks one).
+ *
+ * - Lines end in LF, the last one too; a line longer than `maxHeaderBytes`
+ *   is `limit-exceeded`.
+ * - Exactly one stanza: an empty line, a line holding only spaces or tabs, a
+ *   continuation line before the first field, a field line without `:`, a
+ *   field name that is empty or holds a space or tab, a second checksum field
+ *   of one algorithm, or an empty document is `malformed-index`.
+ * - `MD5Sum`, `SHA1`, `SHA256` and `SHA512` (ASCII case-insensitive) hold an
+ *   empty first-line value and continuation lines of leading whitespace, then
+ *   exactly three tokens separated by one or more spaces or tabs: the digest
+ *   (hex of the algorithm's length), the size (decimal digits within a safe
+ *   integer) and the path. Anything else is `invalid-field` (`field` the field
+ *   name as written, `value` the line's offset).
+ *
+ * Bounds: the document by `maxIndexBytes`, fields and the files per list by
+ * `maxEntries`. Field names and values are decoded as Go does (U+FFFD for
+ * invalid UTF-8); `bytes` are views into a copy of the input.
+ */
+export async function readDebianRelease(inputArg: {
+  bytes: Uint8Array;
+  limits?: Partial<ILinuxPackageLimits>;
+}): Promise<IDebianRelease> {
+  assertReaderInput(inputArg);
+  assertReaderBytes(inputArg.bytes);
+  const limits = resolveLinuxPackageLimits(inputArg.limits);
+  const decoded = await readIndexDocument(inputArg.bytes, 'none', limits);
+
+  const malformed = (messageArg: string, offsetArg: number) =>
+    new LinuxRepoError('malformed-index', messageArg, { field: 'Release', value: offsetArg });
+  const fields: IDebianReleaseField[] = [];
+  const files: { md5Sum: IDebianReleaseFile[]; sha1: IDebianReleaseFile[]; sha256: IDebianReleaseFile[]; sha512: IDebianReleaseFile[] } = {
+    md5Sum: [],
+    sha1: [],
+    sha256: [],
+    sha512: [],
+  };
+  const seenChecksumFields = new Set<string>();
+  let field: IReleaseFieldState | null = null;
+  const finishField = (endArg: number) => {
+    if (field !== null) {
+      const value = [field.firstValue, ...field.continuations].join('\n');
+      fields.push({ name: field.name, value, bytes: decoded.subarray(field.start, endArg) });
+      field = null;
+    }
+  };
+  for (const line of lines(decoded, limits.maxHeaderBytes, 'Release')) {
+    if (line.end === line.start) {
+      throw malformed('a Release file holds an empty line', line.start);
+    }
+    if (isBlankLine(decoded, line)) {
+      throw malformed('a Release line holds only spaces or tabs', line.start);
+    }
+    const first = decoded[line.start];
+    if (first === SPACE || first === TAB) {
+      if (field === null) {
+        throw malformed('a Release file starts with a continuation line', line.start);
+      }
+      const current: IReleaseFieldState = field;
+      if (current.checksum !== null) {
+        const list = files[current.checksum.key];
+        countUnit(list.length + 1, limits, `Release ${current.name} file`);
+        list.push(readChecksumLine(decoded, line, current.name, current.checksum.hexLength));
+      }
+      current.continuations.push(decodeGoUtf8(decoded.subarray(line.start, line.end)));
+      continue;
+    }
+    finishField(line.start);
+    const colon = decoded.subarray(line.start, line.end).indexOf(COLON);
+    if (colon < 0) {
+      throw malformed('a Release field line has no ":"', line.start);
+    }
+    const nameBytes = decoded.subarray(line.start, line.start + colon);
+    if (nameBytes.length === 0 || nameBytes.includes(SPACE) || nameBytes.includes(TAB)) {
+      throw malformed('a Release field name is empty or holds a space or tab', line.start);
+    }
+    const name = decodeGoUtf8(nameBytes);
+    const lower = asciiLower(decodeLatin1(nameBytes));
+    const checksum = RELEASE_CHECKSUM_FIELDS.get(lower) ?? null;
+    const firstValue = decodeGoUtf8(trimSpaceTab(decoded.subarray(line.start + colon + 1, line.end)));
+    if (checksum !== null) {
+      if (seenChecksumFields.has(lower)) {
+        throw malformed(`a Release file holds a second ${name} field`, line.start);
+      }
+      seenChecksumFields.add(lower);
+      if (firstValue !== '') {
+        throw new LinuxRepoError('invalid-field', `the ${name} field has a value on its first line`, {
+          field: name,
+          value: line.start,
+        });
+      }
+    }
+    countUnit(fields.length + 1, limits, 'Release field');
+    field = { name, start: line.start, firstValue, continuations: [], checksum };
+  }
+  finishField(decoded.length);
+  if (fields.length === 0) {
+    throw malformed('a Release file holds no field', 0);
+  }
+  return { fields, files };
+}
+
+interface IReleaseFieldState {
+  name: string;
+  start: number;
+  firstValue: string;
+  continuations: string[];
+  checksum: { key: keyof IDebianRelease['files']; hexLength: number } | null;
+}
+
+/** One checksum line: leading whitespace, then digest, size and path separated by spaces or tabs. */
+function readChecksumLine(bytesArg: Uint8Array, lineArg: ILine, fieldArg: string, hexLengthArg: number): IDebianReleaseFile {
+  const tokens: Array<[number, number]> = [];
+  let i = lineArg.start;
+  while (i < lineArg.end) {
+    while (i < lineArg.end && (bytesArg[i] === SPACE || bytesArg[i] === TAB)) {
+      i += 1;
+    }
+    if (i === lineArg.end) {
+      break;
+    }
+    const start = i;
+    while (i < lineArg.end && bytesArg[i] !== SPACE && bytesArg[i] !== TAB) {
+      i += 1;
+    }
+    tokens.push([start, i]);
+    if (tokens.length > 3) {
+      break;
+    }
+  }
+  const last = bytesArg[lineArg.end - 1];
+  const invalid = (whatArg: string) =>
+    new LinuxRepoError('invalid-field', `a ${fieldArg} line ${whatArg}`, { field: fieldArg, value: lineArg.start });
+  if (tokens.length !== 3 || last === SPACE || last === TAB) {
+    throw invalid('is not "<digest> <size> <path>"');
+  }
+  const digest = decodeLatin1(bytesArg.subarray(tokens[0][0], tokens[0][1]));
+  if (digest.length !== hexLengthArg || !/^[0-9a-fA-F]+$/.test(digest)) {
+    throw invalid(`has a digest that is not ${hexLengthArg} hex digits`);
+  }
+  const sizeText = decodeLatin1(bytesArg.subarray(tokens[1][0], tokens[1][1]));
+  const size = /^[0-9]+$/.test(sizeText) ? Number(sizeText) : Number.NaN;
+  if (!Number.isSafeInteger(size)) {
+    throw invalid('has a size that is not decimal digits within a safe integer');
+  }
+  return { path: decodeGoUtf8(bytesArg.subarray(tokens[2][0], tokens[2][1])), size, digest };
+}
+
+function trimSpaceTab(bytesArg: Uint8Array): Uint8Array {
+  let start = 0;
+  let end = bytesArg.length;
+  while (start < end && (bytesArg[start] === SPACE || bytesArg[start] === TAB)) {
+    start += 1;
+  }
+  while (end > start && (bytesArg[end - 1] === SPACE || bytesArg[end - 1] === TAB)) {
+    end -= 1;
+  }
+  return bytesArg.subarray(start, end);
+}
+
+/** ASCII-only lowercasing of a byte string. */
+function asciiLower(valueArg: string): string {
+  return valueArg.replace(/[A-Z]+/g, (matchArg) => matchArg.toLowerCase());
+}

package/ts/debian/reader.ts

@@ -5,7 +5,8 @@ import type { IDebianPackageRecord } from '../shared/types.js';
 import { ArReader } from '../readers/ar.js';
 import { skipToEnd } from '../readers/bytes.js';
 import { PackageByteSource } from '../readers/bytesource.js';
-import { withDecompressingReader, type TLinuxCompression } from '../readers/decompress.js';
+import { withDecompressingReader } from '../readers/decompress.js';
+import type { TLinuxCompression } from '../shared/types.js';
 import { readTarEntryData, TarReader } from '../readers/tar.js';
 import { parseDebianControlFile, type IDebianControl } from './control.js';
 

package/ts/debian/rules.ts

@@ -1,4 +1,6 @@
-import { hasControlCharacter } from '../shared/validation.js';
+import { decodeLatin1 } from '../readers/text.js';
+import { assertBytes, hasControlCharacter } from '../shared/validation.js';
+import { goTrimSpace } from './gostring.js';
 
 /** Gitea's distribution and component rule (`modules/packages/debian/metadata.go:67`, applied at upload). */
 export const DEBIAN_SYMBOL_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9.~+_-]*$/;
@@ -42,3 +44,83 @@ const POOL_FILE_NAME_REFUSED_PATTERN = /[/#?\s\p{Cc}]/u;
 export function hasPoolFileNameRefusedCharacter(textArg: string): boolean {
   return POOL_FILE_NAME_REFUSED_PATTERN.test(textArg);
 }
+
+/**
+ * The fields a `Packages` stanza writes itself (`renderDebianPackagesStanza`;
+ * Gitea `services/packages/debian/repository.go:202-209`): `Filename`,
+ * `Size`, `MD5sum`, `SHA1`, `SHA256`, `SHA512`.
+ */
+const INDEX_OWNED_FIELDS: ReadonlySet<string> = new Set(['filename', 'size', 'md5sum', 'sha1', 'sha256', 'sha512']);
+
+const LF = 0x0a;
+
+/**
+ * Whether the bytes before a line's first `:` name an index-owned field: Go
+ * `strings.TrimSpace` of them, matched ASCII case-insensitively. Every other
+ * byte is compared as is, so no non-ASCII text matches (for these six names
+ * this equals `toLowerCase()` on the decoded name, the renderer's former rule).
+ */
+function isIndexOwnedFieldName(nameArg: Uint8Array): boolean {
+  const name = goTrimSpace(decodeLatin1(nameArg));
+  if (name.length < 4 || name.length > 8) {
+    return false;
+  }
+  let lower = '';
+  for (let i = 0; i < name.length; i++) {
+    const code = name.charCodeAt(i);
+    lower += String.fromCharCode(code >= 0x41 && code <= 0x5a ? code + 0x20 : code);
+  }
+  return INDEX_OWNED_FIELDS.has(lower);
+}
+
+/**
+ * The stanza without its index-owned fields: `Filename`, `Size`, `MD5sum`,
+ * `SHA1`, `SHA256` and `SHA512`, matched ASCII case-insensitively on the Go
+ * `TrimSpace` of the bytes before the line's first `:`, each with its
+ * continuation lines. The one line walk `renderDebianPackagesStanza` applies
+ * to a record's control text, on bytes:
+ * - a line starting with a space or tab follows the dropping state of its field;
+ * - otherwise the field is dropped exactly when its name is one of the six;
+ * - a line without a `:` is kept and ends dropping.
+ *
+ * Lines end at LF and keep it; a final line without LF is a line too. The
+ * result is a new array, the kept lines in order. Applied to a stanza that
+ * `readDebianPackagesIndex` returns, from Gitea or from the codec for the same
+ * control file, it yields the same bytes: the trimmed control text without
+ * the index-owned fields, plus a final LF. A non-`Uint8Array` is
+ * `invalid-input`.
+ */
+export function stripDebianIndexOwnedFields(stanzaArg: Uint8Array): Uint8Array {
+  assertBytes(stanzaArg, 'stanza');
+  const kept: Uint8Array[] = [];
+  let total = 0;
+  let dropping = false;
+  let start = 0;
+  while (start < stanzaArg.length) {
+    const lineFeed = stanzaArg.indexOf(LF, start);
+    const end = lineFeed < 0 ? stanzaArg.length : lineFeed + 1;
+    const first = stanzaArg[start];
+    if (first === 0x20 || first === 0x09) {
+      if (!dropping) {
+        kept.push(stanzaArg.subarray(start, end));
+        total += end - start;
+      }
+    } else {
+      const lineEnd = lineFeed < 0 ? stanzaArg.length : lineFeed;
+      const colon = stanzaArg.subarray(start, lineEnd).indexOf(0x3a);
+      dropping = colon >= 0 && isIndexOwnedFieldName(stanzaArg.subarray(start, start + colon));
+      if (!dropping) {
+        kept.push(stanzaArg.subarray(start, end));
+        total += end - start;
+      }
+    }
+    start = end;
+  }
+  const result = new Uint8Array(total);
+  let offset = 0;
+  for (const line of kept) {
+    result.set(line, offset);
+    offset += line.length;
+  }
+  return result;
+}

package/ts/index.ts

@@ -21,6 +21,7 @@ export type {
   TLinuxPackageRecord,
   TLinuxIndexFileStage,
   ILinuxIndexFile,
+  TLinuxCompression,
 } from './shared/types.js';
 export { DEFAULT_LINUX_PACKAGE_LIMITS } from './shared/limits.js';
 export type { ILinuxPackageLimits } from './shared/limits.js';
@@ -29,8 +30,10 @@ export type { TLinuxRepoErrorCode, ILinuxRepoErrorDetail } from './shared/errors
 export { isIndexableArchitecture } from './shared/architecture.js';
 export { createAlpineSigner, createOpenPgpSigner } from './signing/signers.js';
 export type { IAlpineSigner, IOpenPgpSigner } from './signing/signers.js';
-export { createOpenPgpVerifier } from './signing/verifiers.js';
+export { createAlpineVerifier, createOpenPgpVerifier } from './signing/verifiers.js';
 export type {
+  IAlpineSignatureVerification,
+  IAlpineVerifier,
   IOpenPgpCleartextVerification,
   IOpenPgpSignatureVerification,
   IOpenPgpVerifier,
@@ -41,15 +44,50 @@ export type { IAlpineKeyPair, IOpenPgpKeyPair } from './signing/keys.js';
 export { readDebianPackage } from './debian/reader.js';
 export { buildDebianIndex } from './debian/indexbuilder.js';
 export type { IDebianIndexEntry } from './debian/indexbuilder.js';
-export { isDebianReleaseValue, isDebianSymbol } from './debian/rules.js';
+export { isDebianReleaseValue, isDebianSymbol, stripDebianIndexOwnedFields } from './debian/rules.js';
+export { readDebianPackagesIndex, readDebianRelease } from './debian/indexreader.js';
+export type {
+  IDebianPackagesIndex,
+  IDebianPackagesStanza,
+  IDebianRelease,
+  IDebianReleaseField,
+  IDebianReleaseFile,
+} from './debian/indexreader.js';
 export { readRpmPackage } from './rpm/reader.js';
 export { signRpmPackage } from './rpm/sign.js';
 export { buildRpmIndex } from './rpm/builder.js';
 export { mergeRpmUpdates } from './rpm/updates.js';
 export { renderRpmRepoConfig } from './rpm/repoconfig.js';
+export { isRpmPrimaryPath } from './rpm/repodata.js';
+export { readRpmRepodata, readRpmRepomd, readRpmUpdateInfo } from './rpm/repodatareader.js';
+export type {
+  IRpmRepodata,
+  IRpmRepodataFile,
+  IRpmRepodataPackage,
+  IRpmRepomd,
+  IRpmRepomdChecksum,
+  IRpmRepomdData,
+  IRpmRepomdElement,
+  IRpmUpdateInfo,
+  IRpmUpdateInfoPackage,
+  IRpmUpdateInfoUpdate,
+  IRpmXmlAttribute,
+  IRpmXmlFrame,
+  TRpmRepodataDocument,
+} from './rpm/repodatareader.js';
 export { readArchPackage } from './arch/reader.js';
 export { buildArchIndex } from './arch/builder.js';
 export type { IArchIndexEntry } from './arch/builder.js';
 export { signArchPackage } from './arch/signer.js';
+export { compareArchVersions } from './arch/vercmp.js';
+export { readArchIndex } from './arch/indexreader.js';
+export type { IArchIndex, IArchIndexMember } from './arch/indexreader.js';
 export { readAlpinePackage } from './alpine/reader.js';
 export { buildAlpineIndex } from './alpine/apkindex.js';
+export { readAlpineIndex } from './alpine/apkindexreader.js';
+export type {
+  IAlpineIndex,
+  IAlpineIndexBlock,
+  IAlpineIndexMember,
+  IAlpineIndexSignatureEntry,
+} from './alpine/apkindexreader.js';

package/ts/readers/decompress.ts

@@ -1,11 +1,9 @@
 import * as plugins from '../plugins.js';
 import { LinuxRepoError, limitExceeded, truncated } from '../shared/errors.js';
 import type { ILinuxPackageLimits } from '../shared/limits.js';
+import type { TLinuxCompression } from '../shared/types.js';
 import { READ_CHUNK_BYTES, takeFront, type IByteReader } from './bytes.js';
 
-/** The stream compressions the readers decode. */
-export type TLinuxCompression = 'none' | 'gzip' | 'xz' | 'zstd';
-
 export interface IDecompressOptions {
   /** Bound on the decompressed bytes delivered. */
   maxOutputBytes: number;