@wpelevator/wp-release 0.12.0 → 0.14.0

package/dist/commands/sign.js

@@ -2,8 +2,29 @@ import { resolve } from 'node:path';
 import { stat } from 'node:fs/promises';
 import { ValidationError } from "../errors.js";
 import { getSignSummary } from "../summary.js";
-import { SIGNING_KEY_ENV, getPublicKey, parseSigningKey, writeSignature, } from "../signing.js";
-import { getBoolean } from "./command.js";
+import { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_FORMATS, SIGNING_KEY_ENV, getPublicKey, getPublicKeys, isSignatureFormat, parseSigningKey, writeSignature, } from "../signing.js";
+import { getBoolean, getStrings } from "./command.js";
+/**
+ * Get the signature formats from the --format values, which can be repeated
+ * or comma-separated.
+ *
+ * @param  values Option values.
+ * @return Unique formats, the default when none are given.
+ * @throws {ValidationError} If a format is unknown.
+ */
+export function parseSignatureFormats(values) {
+    const names = values
+        .flatMap((value) => value.split(','))
+        .map((name) => name.trim())
+        .filter(Boolean);
+    const unknown = names.filter((name) => !isSignatureFormat(name));
+    if (unknown.length) {
+        throw new ValidationError(`Unknown signature format ${unknown.join(', ')}, use ${Object.keys(SIGNATURE_FORMATS).join(', ')}.`);
+    }
+    return names.length
+        ? [...new Set(names.filter(isSignatureFormat))]
+        : [DEFAULT_SIGNATURE_FORMAT];
+}
 export default {
     name: 'sign',
     usage: 'sign <file>... [options]',
@@ -13,21 +34,32 @@ export default {
                           manifest
 
 Options:
-  --force                 Overwrite existing .sig files
+  --format <names>        Signature formats to write, comma-separated or
+                          repeated, like wordpress,minisign,ssh (default:
+                          wordpress):
+                          wordpress  <file>.sig for WordPress core's
+                                     verify_file_signature()
+                          minisign   <file>.minisig for "minisign -V"
+                          ssh        <file>.sshsig for "ssh-keygen -Y verify"
+                                     with the "file" namespace
+  --force                 Overwrite existing signature files
 
 The signing key is read from the ${SIGNING_KEY_ENV} environment variable, as a
 base64 32-byte Ed25519 seed or 64-byte libsodium secret key. There's no flag
 for it, since it would show in the process list.
 
-The signature is the one WordPress core's verify_file_signature() checks: a
-base64 Ed25519 signature of the raw SHA-384 digest of the file. Sign both
-the ZIP and the checksums manifest. Use --verbose to print the public key
-that belongs to the signing key.`,
+The wordpress signature is the one WordPress core's verify_file_signature()
+checks: a base64 Ed25519 signature of the raw SHA-384 digest of the file.
+All formats are signed by the same key. Sign both the ZIP and the checksums
+manifest. Use --verbose to print the public key of the signing key in the
+form of each format.`,
     options: {
+        format: { type: 'string', multiple: true },
         force: { type: 'boolean' },
     },
     async run({ values, positionals, cwd, logger, }) {
         const encoded = process.env[SIGNING_KEY_ENV];
+        const formats = parseSignatureFormats(getStrings(values, 'format'));
         if (!positionals.length) {
             throw new ValidationError('Pass the files to sign.');
         }
@@ -36,22 +68,25 @@ that belongs to the signing key.`,
         }
         const privateKey = parseSigningKey(encoded);
         const publicKey = getPublicKey(privateKey);
+        const publicKeys = getPublicKeys(privateKey);
         const paths = positionals.map((file) => resolve(cwd, file));
         await Promise.all(paths.map(async (path) => {
             if (!(await stat(path).catch(() => null))?.isFile()) {
                 throw new ValidationError(`${path} is not a file.`);
             }
         }));
-        logger.debug(`Signing with the public key ${publicKey}.`);
+        formats.forEach((format) => logger.debug(`Signing ${format} with the public key ${publicKeys[format]}.`));
         const signatures = [];
         const force = getBoolean(values, 'force');
+        const jobs = paths.flatMap((path) => formats.map((format) => ({ path, format })));
         // Sign in order, so that a failure leaves a predictable set of files.
-        for (const path of paths) {
-            const signaturePath = await writeSignature(path, privateKey, force);
+        for (const { path, format } of jobs) {
+            const signaturePath = await writeSignature(path, privateKey, force, format);
             logger.info(signaturePath);
             signatures.push(signaturePath);
         }
-        logger.summary((context) => getSignSummary(context, { signatures, publicKey }));
-        return { exitCode: 0, result: { signatures, publicKey } };
+        const result = { signatures, formats, publicKey, publicKeys };
+        logger.summary((context) => getSignSummary(context, result));
+        return { exitCode: 0, result };
     },
 };

package/dist/commands/verify.d.ts

@@ -24,6 +24,9 @@ declare const _default: {
         'public-key': {
             type: "string";
         };
+        'signature-format': {
+            type: "string";
+        };
     };
     run({ values, positionals, cwd, logger }: import("./command.ts").CommandContext): Promise<CommandOutcome<unknown>>;
 };

package/dist/commands/verify.js

@@ -4,28 +4,29 @@ import { tmpdir } from 'node:os';
 import { basename, isAbsolute, join, posix, resolve } from 'node:path';
 import { readChecksums, verifyChecksums } from "../checksums.js";
 import { downloadFile, isUrl } from "../download.js";
-import { loadFileRules, parseExclude } from "../file-selection.js";
+import { ignoreOwnFile, ignoreOwnSignature, loadFileRules, parseExclude, } from "../file-selection.js";
 import { ValidationError } from "../errors.js";
 import { readPackageMeta } from "../package-meta.js";
 import { logProblems } from "../report.js";
 import { getVerifySummary } from "../summary.js";
 import { extractZip, readZipEntries } from "../unzip.js";
-import { SIGNATURE_EXTENSION, parsePublicKey, verifyFileSignature, } from "../signing.js";
-import { checkDirectory, getSourceDirArg, ignoreOwnFile, ignoreOwnSignature, sourceDirArgs, } from "./args.js";
+import { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_FORMATS, getSignaturePath, isSignatureFormat, parsePublicKey, verifyFileSignature, } from "../signing.js";
+import { checkDirectory, getSourceDirArg, sourceDirArgs } from "./args.js";
 import { getString, getStrings } from "./command.js";
 /**
  * Fail unless the manifest has a valid signature file.
  *
  * @param  checksumsPath Manifest path.
- * @param  publicKey     Base64 public key.
+ * @param  publicKey     Public key in any form that parsePublicKey() takes.
+ * @param  format        Signature format.
  * @throws {ValidationError} If the signature is missing or doesn't match.
  */
-async function checkSignature(checksumsPath, publicKey) {
-    const signaturePath = checksumsPath + SIGNATURE_EXTENSION;
+async function checkSignature(checksumsPath, publicKey, format) {
+    const signaturePath = getSignaturePath(checksumsPath, format);
     if (!existsSync(signaturePath)) {
         throw new ValidationError(`${signaturePath} doesn't exist.`);
     }
-    if (!(await verifyFileSignature(checksumsPath, signaturePath, parsePublicKey(publicKey)))) {
+    if (!(await verifyFileSignature(checksumsPath, signaturePath, parsePublicKey(publicKey), format))) {
         throw new ValidationError(`${signaturePath} isn't a valid signature of ${checksumsPath} for the public key.`);
     }
 }
@@ -111,15 +112,16 @@ function getEmbeddedPath(checksumsPath, embedded) {
  *
  * @param checksumsPath Manifest path.
  * @param path          Relative path of the embedded manifest, if any.
+ * @param format        Signature format.
  * @return Pairs of the originals and their copies.
  */
-function getCopyPairs(checksumsPath, path) {
+function getCopyPairs(checksumsPath, path, format) {
     return path
         ? [
             { original: checksumsPath, copy: path },
             {
-                original: checksumsPath + SIGNATURE_EXTENSION,
-                copy: path + SIGNATURE_EXTENSION,
+                original: getSignaturePath(checksumsPath, format),
+                copy: getSignaturePath(path, format),
             },
         ]
         : [];
@@ -172,12 +174,13 @@ async function hasSameContents(original, file) {
  * @param  input.manifest      Checksums manifest.
  * @param  input.checksumsPath Manifest path.
  * @param  input.embedded      Explicit path of the embedded manifest.
+ * @param  input.format        Signature format of the manifest signature.
  * @return The copies that were found to differ or be missing, and the paths of the existing copies.
  * @throws {ValidationError} If an explicit path can't be verified.
  */
 async function checkEmbeddedCopies(input) {
-    const { dir, manifest, checksumsPath, embedded } = input;
-    const pairs = getCopyPairs(checksumsPath, getEmbeddedPath(checksumsPath, embedded));
+    const { dir, manifest, checksumsPath, embedded, format } = input;
+    const pairs = getCopyPairs(checksumsPath, getEmbeddedPath(checksumsPath, embedded), format);
     if (embedded) {
         checkExplicitPairs(pairs, manifest);
     }
@@ -268,17 +271,19 @@ async function findVersionMismatch(dir, manifest) {
  * @param input.checksumsPath
  * @param input.exclude
  * @param input.embedded
+ * @param input.format
  * @param input.logger
  * @return Exit code and result.
  */
 async function verifyTarget(input) {
-    const { target, manifest, checksumsPath, exclude, embedded, logger } = input;
+    const { target, manifest, checksumsPath, exclude, embedded, format, logger, } = input;
     const { dir } = target;
     const copies = await checkEmbeddedCopies({
         dir,
         manifest,
         checksumsPath,
         embedded,
+        format,
     });
     const rules = ignoreOwnSignature(ignoreOwnFile(await loadFileRules({ exclude: parseExclude(exclude) }), dir, checksumsPath), dir, checksumsPath);
     copies.paths.forEach((copy) => ignoreOwnFile(rules, dir, join(dir, copy)));
@@ -338,17 +343,25 @@ Options:
                           builds for a release, instead of <source-dir>
   --root-folder <name>    Folder in the ZIP (default: the one folder that
                           every entry is in)
-  --embedded <path>       Where the manifest and its .sig are shipped inside the
-                          files, like includes/checksums.json. Both the
-                          --checksums file and its .sig must exist, both
+  --embedded <path>       Where the manifest and its signature are shipped in
+                          the files, like includes/checksums.json. Both the
+                          --checksums file and its signature must exist, both
                           copies must be shipped, and they must be identical
                           to them. Without this option, a file with the name
-                          of the --checksums file at the root (and its .sig)
-                          is a copy only when it exists, the matching original
-                          exists and the manifest doesn't list it
-  --public-key <key>      Base64 Ed25519 public key. Checks <checksums>.sig, as
-                          written by "wp-release sign", before comparing any
-                          file, and fails when it's missing or invalid
+                          of the --checksums file at the root (and its
+                          signature) is a copy only when it exists, the
+                          matching original exists and the manifest doesn't
+                          list it
+  --public-key <key>      Ed25519 public key, as base64, a minisign public key
+                          or an ssh-ed25519 public key. Checks the signature
+                          of the manifest, as written by "wp-release sign",
+                          before comparing any file, and fails when it's
+                          missing or invalid
+  --signature-format <name>
+                          Format of the manifest signature: wordpress
+                          (<checksums>.sig), minisign (<checksums>.minisig)
+                          or ssh (<checksums>.sshsig) (default: wordpress).
+                          Also selects the signature copy for --embedded
   --exclude <patterns>    Gitignore-style patterns to skip in both the directory
                           and the manifest, comma-separated or repeated
 
@@ -361,7 +374,7 @@ Unlike "checksums" and "zip", verify doesn't read .distignore, so that an
 ignore file inside the checked directory can't hide added files. Use
 --exclude to skip files that aren't part of the release.
 
-A manifest can't list itself. A copy of the manifest and of its .sig inside
+A manifest can't list itself. A copy of the manifest and of its signature in
 the checked files is therefore skipped, but it must be identical to the
 --checksums file. A path that the manifest lists is never skipped, and a
 file that isn't a matching copy is reported as extra. See --embedded for
@@ -372,6 +385,7 @@ where the copies are looked for.`,
         'root-folder': { type: 'string' },
         embedded: { type: 'string' },
         'public-key': { type: 'string' },
+        'signature-format': { type: 'string' },
         ...sourceDirArgs,
         exclude: { type: 'string', multiple: true },
     },
@@ -389,8 +403,12 @@ where the copies are looked for.`,
         }
         const checksumsPath = resolve(cwd, checksums);
         const publicKey = getString(values, 'public-key');
+        const format = getString(values, 'signature-format') ?? DEFAULT_SIGNATURE_FORMAT;
+        if (!isSignatureFormat(format)) {
+            throw new ValidationError(`Unknown signature format ${format}, use ${Object.keys(SIGNATURE_FORMATS).join(', ')}.`);
+        }
         if (publicKey) {
-            await checkSignature(checksumsPath, publicKey);
+            await checkSignature(checksumsPath, publicKey, format);
             logger.info(`Signature of ${checksumsPath} is valid.`);
         }
         const manifest = await readChecksums(checksumsPath);
@@ -407,6 +425,7 @@ where the copies are looked for.`,
                 checksumsPath,
                 exclude: getStrings(values, 'exclude'),
                 embedded: getString(values, 'embedded'),
+                format,
                 logger,
             });
         }

package/dist/commands/zip.d.ts

@@ -1,12 +1,13 @@
+import type { ZipPackageResult } from '../package-zip.ts';
 import type { CommandOutcome } from './command.ts';
 /** Result of the zip command. */
-export interface ZipResult {
-    /** Absolute path of the ZIP. */
-    zipPath: string;
-    /** Absolute path of the checksums manifest, set with --checksums. */
-    checksumsPath?: string;
-    /** Number of archived files. */
-    files: number;
+export interface ZipResult extends ZipPackageResult {
+    /** Plugin or theme slug. */
+    slug: string;
+    /** Version in the filename and the checksums manifest, null when it's unknown. */
+    version: string | null;
+    /** Zipped package, with --package. */
+    package?: string;
 }
 declare const _default: {
     name: string;
@@ -14,6 +15,9 @@ declare const _default: {
     summary: string;
     help: string;
     options: {
+        package: {
+            type: "string";
+        };
         checksums: {
             type: "boolean";
         };
@@ -39,6 +43,6 @@ declare const _default: {
             type: "string";
         };
     };
-    run({ values, positionals, cwd, logger, }: import("./command.ts").CommandContext): Promise<CommandOutcome<ZipResult>>;
+    run({ values, positionals, cwd, configFile, logger, }: import("./command.ts").CommandContext): Promise<CommandOutcome<ZipResult>>;
 };
 export default _default;

package/dist/commands/zip.js

@@ -1,49 +1,122 @@
-import { existsSync } from 'node:fs';
 import { basename, resolve } from 'node:path';
-import { CHECKSUMS_EXTENSION, createChecksums, writeChecksums, } from "../checksums.js";
 import { ValidationError } from "../errors.js";
-import { loadFileRules, resolveFileSelection, selectFiles, } from "../file-selection.js";
+import { resolveFileSelection } from "../file-selection.js";
 import { FILENAME_FORMAT, formatFilename } from "../filename.js";
+import { getPackageFiles } from "../package-deploy.js";
 import { readPackageMeta } from "../package-meta.js";
+import { zipPackage } from "../package-zip.js";
 import { getZipSummary } from "../summary.js";
-import { createZip } from "../zip.js";
-import { checkDirectory, fileSelectionArgs, getFileSelectionInput, getSourceDirArg, ignoreOwnFile, ignoreOwnSignature, resolveOutput, sourceDirArgs, } from "./args.js";
-import { getBoolean, getString } from "./command.js";
-const ZIP_EXTENSION = '.zip';
+import { checkDirectory, fileSelectionArgs, getFileSelectionInput, getSourceDirArg, resolveOutput, sourceDirArgs, } from "./args.js";
+import { getBoolean, getString, getStrings } from "./command.js";
+/** Options of a source directory and its files, which --package takes from the config. */
+const SOURCE_FLAGS = [
+    'source-dir',
+    'distignore',
+    'no-distignore',
+    'exclude',
+    'exclude-gitattributes',
+];
 /**
- * Get the checksums manifest path next to an archive, with .checksums.json
- * instead of .zip.
+ * Get the configured package to zip, failing for the options that set the
+ * source directory and the files instead.
  *
- * @param zipPath Archive path.
- * @return Manifest path.
+ * @param  values      Parsed CLI values.
+ * @param  positionals Positional arguments.
+ * @return The package identifier or path, or undefined without --package.
+ * @throws {ValidationError} For an empty --package, or --package with a source directory or file selection option.
  */
-function getChecksumsPath(zipPath) {
-    const name = zipPath.endsWith(ZIP_EXTENSION)
-        ? zipPath.slice(0, -ZIP_EXTENSION.length)
-        : zipPath;
-    return name + CHECKSUMS_EXTENSION;
+function getPackageArg(values, positionals) {
+    const name = getString(values, 'package')?.trim();
+    const conflicts = SOURCE_FLAGS.filter((flag) => undefined !== getString(values, flag) ||
+        getBoolean(values, flag) ||
+        getStrings(values, flag).length);
+    if ('' === name) {
+        throw new ValidationError('--package <name> must not be empty.');
+    }
+    if (name && (positionals.length || conflicts.length)) {
+        throw new ValidationError(`--package takes the directory and files of the package from the config, so it can't be combined with ${positionals.length
+            ? 'a source directory'
+            : conflicts.map((flag) => `--${flag}`).join(', ')}.`);
+    }
+    return name;
 }
 /**
- * Fail before writing anything when an output file exists.
+ * Describe the files of a directory with the slug and the version from the
+ * options, or from the plugin or theme headers.
  *
- * @param  paths Output paths.
- * @param  force Whether existing files are overwritten.
- * @throws {ValidationError} If a file exists and force isn't set.
+ * @param values    Parsed CLI values.
+ * @param sourceDir Directory to zip.
+ * @param selection File selection.
+ * @param slug      Default slug.
+ * @return Source directory, file selection, slug, version and type.
  */
-function checkOverwrite(paths, force) {
-    const existing = paths.filter((path) => !force && existsSync(path));
-    if (existing.length) {
-        throw new ValidationError(`${existing.join(' and ')} already exists, pass --force to overwrite it.`);
-    }
+async function describeSource(values, sourceDir, selection, slug) {
+    const name = getString(values, 'slug') ?? slug;
+    const meta = await readPackageMeta({ dir: sourceDir, slug: name });
+    return {
+        sourceDir,
+        selection,
+        slug: name,
+        version: getString(values, 'version') ?? meta?.version ?? null,
+        ...(meta ? { type: meta.type } : {}),
+    };
+}
+/**
+ * Get the files of a source directory from the CLI options.
+ *
+ * @param values      Parsed CLI values.
+ * @param positionals Positional arguments.
+ * @param cwd         Working directory.
+ * @return Source directory, file selection, slug and version.
+ */
+async function getDirectorySource(values, positionals, cwd) {
+    const sourceDir = resolve(cwd, getSourceDirArg(values, positionals));
+    await checkDirectory(sourceDir);
+    return describeSource(values, sourceDir, resolveFileSelection({
+        cwd,
+        sourceDir,
+        ...getFileSelectionInput(values),
+    }), basename(cwd));
+}
+/**
+ * Get the directory of a configured package with the files config of its
+ * package group, which its deploys use too.
+ *
+ * @param  values     Parsed CLI values.
+ * @param  cwd        Repository root with the wp-release config.
+ * @param  name       Package identifier or path under the configured root.
+ * @param  configFile Config file, instead of the conventional one.
+ * @return Source directory, file selection, slug, version and package.
+ * @throws {ValidationError} Without a config or for an unknown package.
+ */
+async function getPackageSource(values, cwd, name, configFile) {
+    const pkg = await getPackageFiles({
+        cwd,
+        package: name,
+        ...(configFile ? { configFile } : {}),
+    });
+    const source = await describeSource(values, pkg.directory, resolveFileSelection({
+        cwd,
+        sourceDir: pkg.directory,
+        ...pkg.files,
+    }), basename(pkg.directory));
+    return { ...source, package: pkg.name };
 }
 export default {
     name: 'zip',
-    usage: 'zip [<source-dir>] [options]',
+    usage: 'zip [<source-dir>] [options] | zip --package <name> [options]',
     summary: 'Create a ZIP archive of a plugin or theme with a {slug}/ root folder.',
     help: `Arguments:
   <source-dir>                Directory to archive (default: .), also accepted
                               as --source-dir <dir>
 
+Configured packages (instead of the source directory and the file selection
+options):
+  --package <name>            Zip this package of the wp-release config, by
+                              identifier or path under the configured root,
+                              like plugins/alpha, with the files config of its
+                              package group, the same files as its deploys
+
 Options:
   --output <file>             ZIP file (default: the --filename-format name with
                               .zip in the current directory)
@@ -64,7 +137,13 @@ Options:
   --force                     Overwrite existing output files
 
 Entries are sorted and use a fixed timestamp and file mode, so the same files
-always give the same ZIP.`,
+always give the same ZIP.
+
+Examples:
+  wp-release zip dist --slug my-plugin --checksums
+      Zip a build with its checksums manifest
+  wp-release zip --package plugins/alpha --checksums
+      Zip a package of the config with its configured files`,
     options: {
         slug: { type: 'string' },
         version: { type: 'string' },
@@ -74,65 +153,43 @@ always give the same ZIP.`,
         output: { type: 'string' },
         ...sourceDirArgs,
         ...fileSelectionArgs,
+        package: { type: 'string' },
         checksums: { type: 'boolean' },
         force: { type: 'boolean' },
     },
-    async run({ values, positionals, cwd, logger, }) {
-        const sourceDir = resolve(cwd, getSourceDirArg(values, positionals));
-        const slug = getString(values, 'slug') ?? basename(cwd);
-        const force = getBoolean(values, 'force');
-        await checkDirectory(sourceDir);
-        const meta = await readPackageMeta({ dir: sourceDir, slug });
-        const version = getString(values, 'version') ?? meta?.version ?? null;
-        const filename = formatFilename(getString(values, 'filename-format') ?? FILENAME_FORMAT, { slug, version });
-        const zipPath = resolveOutput({
-            cwd,
-            output: getString(values, 'output'),
-            filename: filename + ZIP_EXTENSION,
-        });
-        const checksumsPath = getBoolean(values, 'checksums')
-            ? getChecksumsPath(zipPath)
-            : null;
-        const selection = resolveFileSelection({
-            cwd,
-            sourceDir,
-            ...getFileSelectionInput(values),
-        });
-        const rules = ignoreOwnSignature(ignoreOwnFile(await loadFileRules(selection), sourceDir, zipPath), sourceDir, zipPath);
-        if (checksumsPath) {
-            ignoreOwnSignature(ignoreOwnFile(rules, sourceDir, checksumsPath), sourceDir, checksumsPath);
-        }
-        const files = await selectFiles(sourceDir, rules);
-        if (!files.length) {
-            throw new ValidationError(`No files to archive in ${sourceDir}.`);
-        }
-        checkOverwrite([zipPath, checksumsPath ?? ''].filter(Boolean), force);
-        await createZip({
-            sourceDir,
-            files,
-            zipPath,
+    async run({ values, positionals, cwd, configFile, logger, }) {
+        const name = getPackageArg(values, positionals);
+        const source = name
+            ? await getPackageSource(values, cwd, name, configFile)
+            : await getDirectorySource(values, positionals, cwd);
+        const filename = formatFilename(getString(values, 'filename-format') ?? FILENAME_FORMAT, { slug: source.slug, version: source.version });
+        const zipped = await zipPackage({
+            sourceDir: source.sourceDir,
+            selection: source.selection,
+            zipPath: resolveOutput({
+                cwd,
+                output: getString(values, 'output'),
+                filename: `${filename}.zip`,
+            }),
             rootFolder: getBoolean(values, 'no-root-folder')
                 ? null
-                : getString(values, 'root-folder') ?? slug,
-            force,
+                : getString(values, 'root-folder') ?? source.slug,
+            slug: source.slug,
+            version: source.version,
+            ...(source.type ? { type: source.type } : {}),
+            checksums: getBoolean(values, 'checksums'),
+            force: getBoolean(values, 'force'),
         });
-        logger.debug(`Archived ${files.length} files from ${sourceDir}.`);
-        logger.info(zipPath);
-        if (checksumsPath) {
-            const manifest = await createChecksums({
-                sourceDir,
-                rules,
-                slug,
-                version,
-                type: meta?.type,
-            });
-            await writeChecksums(checksumsPath, manifest, force);
-            logger.info(checksumsPath);
+        logger.debug(`Archived ${zipped.files} files from ${source.sourceDir}.`);
+        logger.info(zipped.zipPath);
+        if (zipped.checksumsPath) {
+            logger.info(zipped.checksumsPath);
         }
         const result = {
-            zipPath,
-            ...(checksumsPath ? { checksumsPath } : {}),
-            files: files.length,
+            ...zipped,
+            slug: source.slug,
+            version: source.version,
+            ...(source.package ? { package: source.package } : {}),
         };
         logger.summary((context) => getZipSummary(context, result));
         return { exitCode: 0, result };

package/dist/ed25519.d.ts

@@ -0,0 +1,25 @@
+import type { KeyObject } from 'node:crypto';
+export declare const PUBLIC_KEY_BYTES = 32;
+/**
+ * Get the raw 32 bytes of an Ed25519 public key.
+ *
+ * @param key Private or public key.
+ * @return Public key bytes.
+ */
+export declare function getRawPublicKey(key: KeyObject): Buffer;
+/**
+ * Get an Ed25519 public key from its raw 32 bytes.
+ *
+ * @param bytes Public key bytes.
+ * @return Public key.
+ */
+export declare function createRawPublicKey(bytes: Buffer): KeyObject;
+/**
+ * Get the raw digest of a file, which the signature formats sign instead of
+ * the whole file.
+ *
+ * @param path      File path.
+ * @param algorithm Node.js hash algorithm, like sha384 or blake2b512.
+ * @return Digest bytes.
+ */
+export declare function digestFile(path: string, algorithm: string): Promise<Buffer>;

package/dist/ed25519.js

@@ -0,0 +1,44 @@
+import { createHash, createPublicKey } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+export const PUBLIC_KEY_BYTES = 32;
+// DER prefix of a SPKI Ed25519 public key, followed by the 32-byte key.
+const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+/**
+ * Get the raw 32 bytes of an Ed25519 public key.
+ *
+ * @param key Private or public key.
+ * @return Public key bytes.
+ */
+export function getRawPublicKey(key) {
+    return ('private' === key.type ? createPublicKey(key) : key)
+        .export({ format: 'der', type: 'spki' })
+        .subarray(SPKI_PREFIX.length);
+}
+/**
+ * Get an Ed25519 public key from its raw 32 bytes.
+ *
+ * @param bytes Public key bytes.
+ * @return Public key.
+ */
+export function createRawPublicKey(bytes) {
+    return createPublicKey({
+        key: Buffer.concat([SPKI_PREFIX, bytes]),
+        format: 'der',
+        type: 'spki',
+    });
+}
+/**
+ * Get the raw digest of a file, which the signature formats sign instead of
+ * the whole file.
+ *
+ * @param path      File path.
+ * @param algorithm Node.js hash algorithm, like sha384 or blake2b512.
+ * @return Digest bytes.
+ */
+export async function digestFile(path, algorithm) {
+    const hash = createHash(algorithm);
+    for await (const chunk of createReadStream(path)) {
+        hash.update(chunk);
+    }
+    return hash.digest();
+}