@serve.zone/interfaces 32.52.0 → 32.54.0

package/ts/runtime.appstorecatalog.ts

@@ -62,11 +62,96 @@ const publicKeyObjectOf = (publicKeyArg: string): plugins.crypto.KeyObject =>
     key: { kty: 'OKP', crv: 'Ed25519', x: Buffer.from(publicKeyArg, 'hex').toString('base64url') },
   });
 
+/** One PEM block of exactly this label and nothing around it but whitespace. */
+const isSinglePemBlock = (pemArg: string, labelArg: string): boolean =>
+  new RegExp(`^-----BEGIN ${labelArg}-----\\r?\\n(?:[A-Za-z0-9+/=]+\\r?\\n)+-----END ${labelArg}-----$`)
+    .test(pemArg.trim());
+
+const signingKeyOf = async (privateKeyArg: plugins.crypto.KeyObject): Promise<IAppStoreCatalogSigningKey> => {
+  const publicKey = rawPublicKeyOf(plugins.crypto.createPublicKey(privateKeyArg));
+  return { keyId: await computeAppStoreCatalogSigningKeyId(publicKey), publicKey, privateKey: privateKeyArg };
+};
+
+/** The Ed25519 private key of a signing key whose `publicKey` it matches; `keyId` is the caller's check. */
+const readSigningPrivateKey = (keyArg: IAppStoreCatalogSigningKey): plugins.crypto.KeyObject => {
+  const { privateKey } = keyArg;
+  if (!(privateKey instanceof plugins.crypto.KeyObject) || privateKey.type !== 'private'
+    || privateKey.asymmetricKeyType !== 'ed25519') {
+    throw new Error('App Store catalog signing key must be an Ed25519 private key');
+  }
+  if (rawPublicKeyOf(plugins.crypto.createPublicKey(privateKey)) !== keyArg.publicKey) {
+    throw new Error(`App Store catalog signing key ${keyArg.keyId} does not match its private key`);
+  }
+  return privateKey;
+};
+
 /** A fresh Ed25519 catalog signing key with its key id. */
-export const createAppStoreCatalogSigningKey = async (): Promise<IAppStoreCatalogSigningKey> => {
-  const pair = plugins.crypto.generateKeyPairSync('ed25519');
-  const publicKey = rawPublicKeyOf(pair.publicKey);
-  return { keyId: await computeAppStoreCatalogSigningKeyId(publicKey), publicKey, privateKey: pair.privateKey };
+export const createAppStoreCatalogSigningKey = async (): Promise<IAppStoreCatalogSigningKey> =>
+  await signingKeyOf(plugins.crypto.generateKeyPairSync('ed25519').privateKey);
+
+/**
+ * Reads a catalog signing key from the text of a PKCS#8 PEM file holding an unencrypted Ed25519
+ * private key (`-----BEGIN PRIVATE KEY-----`, as `openssl genpkey -algorithm ed25519` writes it)
+ * and derives its public key and key id. Errors never quote the input.
+ */
+export const importAppStoreCatalogSigningKeyPem = async (pkcs8PemArg: string): Promise<IAppStoreCatalogSigningKey> => {
+  if (typeof pkcs8PemArg !== 'string' || !isSinglePemBlock(pkcs8PemArg, 'PRIVATE KEY')) {
+    throw new Error('App Store catalog signing key must be one unencrypted PKCS#8 PEM private key block');
+  }
+  let privateKey: plugins.crypto.KeyObject;
+  try {
+    privateKey = plugins.crypto.createPrivateKey({ key: pkcs8PemArg, format: 'pem' });
+  } catch {
+    throw new Error('App Store catalog signing key is not a readable PKCS#8 PEM private key');
+  }
+  if (privateKey.asymmetricKeyType !== 'ed25519') {
+    throw new Error('App Store catalog signing key must be an Ed25519 private key');
+  }
+  return await signingKeyOf(privateKey);
+};
+
+/** The PKCS#8 PEM text of a signing key, for the key file `importAppStoreCatalogSigningKeyPem` reads. */
+export const exportAppStoreCatalogSigningKeyPem = async (keyArg: IAppStoreCatalogSigningKey): Promise<string> => {
+  const privateKey = readSigningPrivateKey(keyArg);
+  if (await computeAppStoreCatalogSigningKeyId(keyArg.publicKey) !== keyArg.keyId) {
+    throw new Error(`App Store catalog signing key ${keyArg.keyId} does not match its public key`);
+  }
+  return privateKey.export({ format: 'pem', type: 'pkcs8' });
+};
+
+/** The trusted-key record a consumer ships for a signing key: its public half only. */
+export const getAppStoreCatalogTrustedKey = (keyArg: IAppStoreCatalogSigningKey): IAppStoreCatalogTrustedKey => ({
+  keyId: keyArg.keyId,
+  publicKey: keyArg.publicKey,
+});
+
+/**
+ * Reads a trusted key from the text of an SPKI PEM public key (`-----BEGIN PUBLIC KEY-----`, as
+ * `openssl pkey -pubout` writes it) holding an Ed25519 key. Errors never quote the input.
+ */
+export const importAppStoreCatalogTrustedKeyPem = async (spkiPemArg: string): Promise<IAppStoreCatalogTrustedKey> => {
+  if (typeof spkiPemArg !== 'string' || !isSinglePemBlock(spkiPemArg, 'PUBLIC KEY')) {
+    throw new Error('App Store catalog trusted key must be one SPKI PEM public key block');
+  }
+  let publicKeyObject: plugins.crypto.KeyObject;
+  try {
+    publicKeyObject = plugins.crypto.createPublicKey({ key: spkiPemArg, format: 'pem' });
+  } catch {
+    throw new Error('App Store catalog trusted key is not a readable SPKI PEM public key');
+  }
+  if (publicKeyObject.type !== 'public' || publicKeyObject.asymmetricKeyType !== 'ed25519') {
+    throw new Error('App Store catalog trusted key must be an Ed25519 public key');
+  }
+  const publicKey = rawPublicKeyOf(publicKeyObject);
+  return { keyId: await computeAppStoreCatalogSigningKeyId(publicKey), publicKey };
+};
+
+/** The SPKI PEM text of a trusted key whose `keyId` matches its public key. */
+export const exportAppStoreCatalogTrustedKeyPem = async (keyArg: IAppStoreCatalogTrustedKey): Promise<string> => {
+  if (await computeAppStoreCatalogSigningKeyId(keyArg.publicKey) !== keyArg.keyId) {
+    throw new Error(`App Store catalog trusted key ${keyArg.keyId} does not match its public key`);
+  }
+  return publicKeyObjectOf(keyArg.publicKey).export({ format: 'pem', type: 'spki' });
 };
 
 /**
@@ -91,13 +176,8 @@ export const signAppStoreCatalog = async (
   const payload = createAppStoreCatalogSignaturePayload(catalogDigest);
   const signatures: IAppStoreCatalogSignature[] = [];
   for (const key of signingKeysArg) {
-    const { privateKey } = key;
-    if (!(privateKey instanceof plugins.crypto.KeyObject) || privateKey.type !== 'private'
-      || privateKey.asymmetricKeyType !== 'ed25519') {
-      throw new Error('App Store catalog signing key must be an Ed25519 private key');
-    }
-    const publicKey = rawPublicKeyOf(plugins.crypto.createPublicKey(privateKey));
-    if (publicKey !== key.publicKey || await computeAppStoreCatalogSigningKeyId(publicKey) !== key.keyId) {
+    const privateKey = readSigningPrivateKey(key);
+    if (await computeAppStoreCatalogSigningKeyId(key.publicKey) !== key.keyId) {
       throw new Error(`App Store catalog signing key ${key.keyId} does not match its private key`);
     }
     signatures.push({