@wpelevator/wp-release 0.12.0 → 0.14.0

package/dist/signing.d.ts

@@ -1,4 +1,8 @@
 import type { KeyObject } from 'node:crypto';
+/**
+ * Extension of the signature files in the format that WordPress core's
+ * verify_file_signature() checks.
+ */
 export declare const SIGNATURE_EXTENSION = ".sig";
 /**
  * Environment variable with the base64 Ed25519 signing key.
@@ -7,11 +11,12 @@ export declare const SIGNING_KEY_ENV = "WP_RELEASE_SIGNING_KEY";
 /**
  * Generate an Ed25519 key pair in the base64 formats used by wp-release.
  *
- * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ * @return Private seed for WP_RELEASE_SIGNING_KEY, the base64 public key and the public key of each signature format.
  */
 export declare function generateSigningKeyPair(): {
     privateKey: string;
     publicKey: string;
+    publicKeys: Record<SignatureFormat, string>;
 };
 /**
  * Get an Ed25519 private key from the base64 format that sodium and the
@@ -24,11 +29,13 @@ export declare function generateSigningKeyPair(): {
  */
 export declare function parseSigningKey(encoded: string): KeyObject;
 /**
- * Get an Ed25519 public key from its base64 form.
+ * Get an Ed25519 public key from the base64 32-byte key, a minisign public
+ * key or an OpenSSH ssh-ed25519 public key. They're forms of the same key,
+ * so any of them checks the signatures of every format.
  *
- * @param  encoded Base64 32-byte public key.
+ * @param  encoded Public key.
  * @return Public key.
- * @throws {ValidationError} If the key has an unsupported length.
+ * @throws {ValidationError} If the key isn't in one of the forms.
  */
 export declare function parsePublicKey(encoded: string): KeyObject;
 /**
@@ -55,24 +62,72 @@ export declare function getFileDigest(path: string): Promise<Buffer>;
  * @return Base64 signature.
  */
 export declare function signFile(path: string, privateKey: KeyObject): Promise<string>;
+/** Names of the signature formats. */
+export type SignatureFormat = 'wordpress' | 'minisign' | 'ssh';
+/** How a signature format writes and checks signature files. */
+export interface SignatureFormatHandler {
+    /** Extension of the signature file, appended to the signed file name. */
+    extension: string;
+    /** Get the contents of the signature file of a file. */
+    create: (path: string, privateKey: KeyObject) => Promise<string>;
+    /** Check a file against its signature file. */
+    verify: (path: string, signaturePath: string, publicKey: KeyObject) => Promise<boolean>;
+    /** Get the public key in the form that the verifiers of the format take. */
+    getPublicKey: (key: KeyObject) => string;
+}
+export declare const DEFAULT_SIGNATURE_FORMAT: SignatureFormat;
+/**
+ * Signature formats, all Ed25519 signatures by the same key:
+ *
+ * - wordpress: base64 signature of the SHA-384 digest in <file>.sig, which
+ *   WordPress core's verify_file_signature() checks.
+ * - minisign: <file>.minisig, which `minisign -V` checks.
+ * - ssh: armored SSH signature in <file>.sshsig, which `ssh-keygen -Y verify`
+ *   checks with the "file" namespace.
+ */
+export declare const SIGNATURE_FORMATS: Record<SignatureFormat, SignatureFormatHandler>;
+/**
+ * Check that a value is the name of a signature format.
+ *
+ * @param value Value to check.
+ * @return Whether it's a signature format.
+ */
+export declare function isSignatureFormat(value: string): value is SignatureFormat;
+/**
+ * Get the signature file path of a file.
+ *
+ * @param path   File path.
+ * @param format Signature format.
+ * @return Signature file path.
+ */
+export declare function getSignaturePath(path: string, format?: SignatureFormat): string;
+/**
+ * Get the public key of a key in the form of each signature format.
+ *
+ * @param key Private or public key.
+ * @return Public keys by format.
+ */
+export declare function getPublicKeys(key: KeyObject): Record<SignatureFormat, string>;
 /**
- * Write the signature of a file to a .sig file next to it.
+ * Write the signature of a file to a signature file next to it.
  *
  * @param  path       File path.
  * @param  privateKey Private key from parseSigningKey().
  * @param  force      Whether to overwrite an existing signature file.
+ * @param  format     Signature format.
  * @return Signature file path.
  * @throws {ValidationError} If the signature file exists and force isn't set.
  */
-export declare function writeSignature(path: string, privateKey: KeyObject, force?: boolean): Promise<string>;
+export declare function writeSignature(path: string, privateKey: KeyObject, force?: boolean, format?: SignatureFormat): Promise<string>;
 /**
- * Check a file against a .sig file, which holds one base64 signature per
- * line. The file is valid when any of the signatures match, so that a file
+ * Check a file against a signature file. A wordpress .sig file can hold one
+ * signature per line, and is valid when any of them match, so that a file
  * can carry the signatures of a key rotation window.
  *
  * @param path          File path.
  * @param signaturePath Signature file path.
  * @param publicKey     Public key from parsePublicKey().
+ * @param format        Signature format.
  * @return Whether a signature matches.
  */
-export declare function verifyFileSignature(path: string, signaturePath: string, publicKey: KeyObject): Promise<boolean>;
+export declare function verifyFileSignature(path: string, signaturePath: string, publicKey: KeyObject, format?: SignatureFormat): Promise<boolean>;

package/dist/signing.js

@@ -1,7 +1,13 @@
-import { createHash, createPrivateKey, generateKeyPairSync, createPublicKey, sign, verify, } from 'node:crypto';
-import { createReadStream } from 'node:fs';
+import { createPrivateKey, generateKeyPairSync, sign, verify, } from 'node:crypto';
 import { readFile, writeFile } from 'node:fs/promises';
+import { PUBLIC_KEY_BYTES, createRawPublicKey, digestFile, getRawPublicKey, } from "./ed25519.js";
 import { ValidationError } from "./errors.js";
+import { MINISIGN_EXTENSION, createMinisignSignature, getMinisignPublicKey, parseMinisignPublicKey, verifyMinisignSignature, } from "./minisign.js";
+import { SSH_SIGNATURE_EXTENSION, createSshSignature, getSshPublicKey, parseSshPublicKey, verifySshSignature, } from "./ssh-signature.js";
+/**
+ * Extension of the signature files in the format that WordPress core's
+ * verify_file_signature() checks.
+ */
 export const SIGNATURE_EXTENSION = '.sig';
 /**
  * Environment variable with the base64 Ed25519 signing key.
@@ -9,15 +15,12 @@ export const SIGNATURE_EXTENSION = '.sig';
 export const SIGNING_KEY_ENV = 'WP_RELEASE_SIGNING_KEY';
 const SEED_BYTES = 32;
 const SECRET_KEY_BYTES = 64;
-const PUBLIC_KEY_BYTES = 32;
 // DER prefix of a PKCS#8 Ed25519 private key, followed by the 32-byte seed.
 const PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
-// DER prefix of a SPKI Ed25519 public key, followed by the 32-byte key.
-const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
 /**
  * Generate an Ed25519 key pair in the base64 formats used by wp-release.
  *
- * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ * @return Private seed for WP_RELEASE_SIGNING_KEY, the base64 public key and the public key of each signature format.
  */
 export function generateSigningKeyPair() {
     const { privateKey, publicKey } = generateKeyPairSync('ed25519');
@@ -29,6 +32,7 @@ export function generateSigningKeyPair() {
     return {
         privateKey: Buffer.from(privateJwk.d, 'base64url').toString('base64'),
         publicKey: Buffer.from(publicJwk.x, 'base64url').toString('base64'),
+        publicKeys: getPublicKeys(publicKey),
     };
 }
 /**
@@ -61,22 +65,22 @@ export function parseSigningKey(encoded) {
     });
 }
 /**
- * Get an Ed25519 public key from its base64 form.
+ * Get an Ed25519 public key from the base64 32-byte key, a minisign public
+ * key or an OpenSSH ssh-ed25519 public key. They're forms of the same key,
+ * so any of them checks the signatures of every format.
  *
- * @param  encoded Base64 32-byte public key.
+ * @param  encoded Public key.
  * @return Public key.
- * @throws {ValidationError} If the key has an unsupported length.
+ * @throws {ValidationError} If the key isn't in one of the forms.
  */
 export function parsePublicKey(encoded) {
-    const bytes = decodeKey(encoded);
+    const bytes = parseSshPublicKey(encoded) ??
+        parseMinisignPublicKey(encoded) ??
+        decodeKey(encoded);
     if (PUBLIC_KEY_BYTES !== bytes.length) {
-        throw new ValidationError(`The public key must be a base64 ${PUBLIC_KEY_BYTES}-byte Ed25519 key, got ${bytes.length} bytes.`);
+        throw new ValidationError(`The public key must be a base64 ${PUBLIC_KEY_BYTES}-byte Ed25519 key, a minisign public key or an ssh-ed25519 public key, got ${bytes.length} bytes.`);
     }
-    return createPublicKey({
-        key: Buffer.concat([SPKI_PREFIX, bytes]),
-        format: 'der',
-        type: 'spki',
-    });
+    return createRawPublicKey(bytes);
 }
 /**
  * Get the base64 public key for a private key, in the format that
@@ -86,11 +90,7 @@ export function parsePublicKey(encoded) {
  * @return Base64 public key.
  */
 export function getPublicKey(privateKey) {
-    const der = createPublicKey(privateKey).export({
-        format: 'der',
-        type: 'spki',
-    });
-    return der.subarray(SPKI_PREFIX.length).toString('base64');
+    return getRawPublicKey(privateKey).toString('base64');
 }
 /**
  * Get the raw SHA-384 digest of a file, which is what WordPress core's
@@ -100,11 +100,7 @@ export function getPublicKey(privateKey) {
  * @return Digest bytes.
  */
 export async function getFileDigest(path) {
-    const hash = createHash('sha384');
-    for await (const chunk of createReadStream(path)) {
-        hash.update(chunk);
-    }
-    return hash.digest();
+    return digestFile(path, 'sha384');
 }
 /**
  * Sign a file with a detached Ed25519 signature of its raw SHA-384 digest.
@@ -117,18 +113,99 @@ export async function signFile(path, privateKey) {
     return sign(null, await getFileDigest(path), privateKey).toString('base64');
 }
 /**
- * Write the signature of a file to a .sig file next to it.
+ * Check a file against a .sig file, which holds one base64 signature per
+ * line. The file is valid when any of the signatures match, so that a file
+ * can carry the signatures of a key rotation window.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether a signature matches.
+ */
+async function verifyWordPressSignature(path, signaturePath, publicKey) {
+    const digest = await getFileDigest(path);
+    const signatures = (await readFile(signaturePath, 'utf8'))
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean);
+    return signatures.some((signature) => verify(null, digest, publicKey, Buffer.from(signature, 'base64')));
+}
+export const DEFAULT_SIGNATURE_FORMAT = 'wordpress';
+/**
+ * Signature formats, all Ed25519 signatures by the same key:
+ *
+ * - wordpress: base64 signature of the SHA-384 digest in <file>.sig, which
+ *   WordPress core's verify_file_signature() checks.
+ * - minisign: <file>.minisig, which `minisign -V` checks.
+ * - ssh: armored SSH signature in <file>.sshsig, which `ssh-keygen -Y verify`
+ *   checks with the "file" namespace.
+ */
+export const SIGNATURE_FORMATS = {
+    wordpress: {
+        extension: SIGNATURE_EXTENSION,
+        create: async (path, privateKey) => (await signFile(path, privateKey)) + '\n',
+        verify: verifyWordPressSignature,
+        getPublicKey,
+    },
+    minisign: {
+        extension: MINISIGN_EXTENSION,
+        create: createMinisignSignature,
+        verify: verifyMinisignSignature,
+        getPublicKey: getMinisignPublicKey,
+    },
+    ssh: {
+        extension: SSH_SIGNATURE_EXTENSION,
+        create: createSshSignature,
+        verify: verifySshSignature,
+        getPublicKey: getSshPublicKey,
+    },
+};
+/**
+ * Check that a value is the name of a signature format.
+ *
+ * @param value Value to check.
+ * @return Whether it's a signature format.
+ */
+export function isSignatureFormat(value) {
+    return Object.hasOwn(SIGNATURE_FORMATS, value);
+}
+/**
+ * Get the signature file path of a file.
+ *
+ * @param path   File path.
+ * @param format Signature format.
+ * @return Signature file path.
+ */
+export function getSignaturePath(path, format = DEFAULT_SIGNATURE_FORMAT) {
+    return path + SIGNATURE_FORMATS[format].extension;
+}
+/**
+ * Get the public key of a key in the form of each signature format.
+ *
+ * @param key Private or public key.
+ * @return Public keys by format.
+ */
+export function getPublicKeys(key) {
+    return {
+        wordpress: SIGNATURE_FORMATS.wordpress.getPublicKey(key),
+        minisign: SIGNATURE_FORMATS.minisign.getPublicKey(key),
+        ssh: SIGNATURE_FORMATS.ssh.getPublicKey(key),
+    };
+}
+/**
+ * Write the signature of a file to a signature file next to it.
  *
  * @param  path       File path.
  * @param  privateKey Private key from parseSigningKey().
  * @param  force      Whether to overwrite an existing signature file.
+ * @param  format     Signature format.
  * @return Signature file path.
  * @throws {ValidationError} If the signature file exists and force isn't set.
  */
-export async function writeSignature(path, privateKey, force = false) {
-    const signaturePath = path + SIGNATURE_EXTENSION;
-    const signature = await signFile(path, privateKey);
-    await writeFile(signaturePath, signature + '\n', {
+export async function writeSignature(path, privateKey, force = false, format = DEFAULT_SIGNATURE_FORMAT) {
+    const signaturePath = getSignaturePath(path, format);
+    const signature = await SIGNATURE_FORMATS[format].create(path, privateKey);
+    await writeFile(signaturePath, signature, {
         flag: force ? 'w' : 'wx',
     }).catch((error) => {
         throw 'EEXIST' === error.code
@@ -138,20 +215,16 @@ export async function writeSignature(path, privateKey, force = false) {
     return signaturePath;
 }
 /**
- * Check a file against a .sig file, which holds one base64 signature per
- * line. The file is valid when any of the signatures match, so that a file
+ * Check a file against a signature file. A wordpress .sig file can hold one
+ * signature per line, and is valid when any of them match, so that a file
  * can carry the signatures of a key rotation window.
  *
  * @param path          File path.
  * @param signaturePath Signature file path.
  * @param publicKey     Public key from parsePublicKey().
+ * @param format        Signature format.
  * @return Whether a signature matches.
  */
-export async function verifyFileSignature(path, signaturePath, publicKey) {
-    const digest = await getFileDigest(path);
-    const signatures = (await readFile(signaturePath, 'utf8'))
-        .split('\n')
-        .map((line) => line.trim())
-        .filter(Boolean);
-    return signatures.some((signature) => verify(null, digest, publicKey, Buffer.from(signature, 'base64')));
+export async function verifyFileSignature(path, signaturePath, publicKey, format = DEFAULT_SIGNATURE_FORMAT) {
+    return SIGNATURE_FORMATS[format].verify(path, signaturePath, publicKey);
 }

package/dist/ssh-signature.d.ts

@@ -0,0 +1,43 @@
+import type { KeyObject } from 'node:crypto';
+export declare const SSH_SIGNATURE_EXTENSION = ".sshsig";
+/**
+ * Namespace of the signatures, which `ssh-keygen -Y verify -n` must match,
+ * so that a signature for files can't be used as one for something else.
+ */
+export declare const SSH_SIGNATURE_NAMESPACE = "file";
+/**
+ * Get the OpenSSH public key of a key, the line of an authorized_keys or
+ * allowed_signers file.
+ *
+ * @param key Private or public key.
+ * @return OpenSSH public key.
+ */
+export declare function getSshPublicKey(key: KeyObject): string;
+/**
+ * Get the raw public key from an OpenSSH Ed25519 public key line, with or
+ * without a comment.
+ *
+ * @param encoded OpenSSH public key.
+ * @return Public key bytes, or null when it isn't an OpenSSH Ed25519 key.
+ */
+export declare function parseSshPublicKey(encoded: string): Buffer | null;
+/**
+ * Create an SSH signature of a file, the armored format that
+ * `ssh-keygen -Y sign` writes, with the "file" namespace and a SHA-512
+ * digest.
+ *
+ * @param path       File path.
+ * @param privateKey Private key.
+ * @return Contents of the signature file.
+ */
+export declare function createSshSignature(path: string, privateKey: KeyObject): Promise<string>;
+/**
+ * Check a file against an SSH signature file. The signature must be made by
+ * the public key, for the "file" namespace, with a SHA-512 or SHA-256 digest.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether the signature matches.
+ */
+export declare function verifySshSignature(path: string, signaturePath: string, publicKey: KeyObject): Promise<boolean>;

package/dist/ssh-signature.js

@@ -0,0 +1,156 @@
+import { sign, verify } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { PUBLIC_KEY_BYTES, digestFile, getRawPublicKey } from "./ed25519.js";
+export const SSH_SIGNATURE_EXTENSION = '.sshsig';
+/**
+ * Namespace of the signatures, which `ssh-keygen -Y verify -n` must match,
+ * so that a signature for files can't be used as one for something else.
+ */
+export const SSH_SIGNATURE_NAMESPACE = 'file';
+const KEY_TYPE = 'ssh-ed25519';
+const MAGIC = Buffer.from('SSHSIG');
+const VERSION = 1;
+const HASH_ALGORITHM = 'sha512';
+const ARMOR_BEGIN = '-----BEGIN SSH SIGNATURE-----';
+const ARMOR_END = '-----END SSH SIGNATURE-----';
+const ARMOR_LINE_LENGTH = 70;
+/**
+ * Encode a value as an SSH wire format string: its length as a 32-bit
+ * big-endian number, followed by its bytes.
+ *
+ * @param value Bytes or text.
+ * @return Encoded string.
+ */
+function encodeString(value) {
+    const bytes = Buffer.from(value);
+    const length = Buffer.alloc(4);
+    length.writeUInt32BE(bytes.length);
+    return Buffer.concat([length, bytes]);
+}
+/**
+ * Read the SSH wire format strings that follow each other in a buffer.
+ *
+ * @param bytes Encoded strings.
+ * @return Decoded strings, or null when the buffer isn't a list of strings.
+ */
+function decodeStrings(bytes) {
+    const strings = [];
+    let offset = 0;
+    while (offset + 4 <= bytes.length) {
+        const end = offset + 4 + bytes.readUInt32BE(offset);
+        strings.push(bytes.subarray(offset + 4, end));
+        offset = end;
+    }
+    return offset === bytes.length ? strings : null;
+}
+/**
+ * Encode an Ed25519 public key as an SSH public key blob.
+ *
+ * @param publicKey Public key bytes.
+ * @return Public key blob.
+ */
+function encodePublicKey(publicKey) {
+    return Buffer.concat([
+        encodeString(KEY_TYPE),
+        encodeString(publicKey),
+    ]);
+}
+/**
+ * Get the data that an SSH signature signs: the namespace, the hash
+ * algorithm and the digest of the file.
+ *
+ * @param digest        File digest.
+ * @param namespace     Signature namespace.
+ * @param hashAlgorithm Hash algorithm of the digest.
+ * @return Signed data.
+ */
+function getSignedData(digest, namespace, hashAlgorithm) {
+    return Buffer.concat([
+        MAGIC,
+        encodeString(namespace),
+        encodeString(''),
+        encodeString(hashAlgorithm),
+        encodeString(digest),
+    ]);
+}
+/**
+ * Get the OpenSSH public key of a key, the line of an authorized_keys or
+ * allowed_signers file.
+ *
+ * @param key Private or public key.
+ * @return OpenSSH public key.
+ */
+export function getSshPublicKey(key) {
+    return `${KEY_TYPE} ${encodePublicKey(getRawPublicKey(key)).toString('base64')}`;
+}
+/**
+ * Get the raw public key from an OpenSSH Ed25519 public key line, with or
+ * without a comment.
+ *
+ * @param encoded OpenSSH public key.
+ * @return Public key bytes, or null when it isn't an OpenSSH Ed25519 key.
+ */
+export function parseSshPublicKey(encoded) {
+    const [type, blob = ''] = encoded.trim().split(/\s+/);
+    const [blobType, publicKey] = decodeStrings(Buffer.from(blob, 'base64')) ?? [];
+    const isSsh = KEY_TYPE === type &&
+        KEY_TYPE === blobType?.toString() &&
+        PUBLIC_KEY_BYTES === publicKey?.length;
+    return isSsh && publicKey ? publicKey : null;
+}
+/**
+ * Create an SSH signature of a file, the armored format that
+ * `ssh-keygen -Y sign` writes, with the "file" namespace and a SHA-512
+ * digest.
+ *
+ * @param path       File path.
+ * @param privateKey Private key.
+ * @return Contents of the signature file.
+ */
+export async function createSshSignature(path, privateKey) {
+    const signature = sign(null, getSignedData(await digestFile(path, HASH_ALGORITHM), SSH_SIGNATURE_NAMESPACE, HASH_ALGORITHM), privateKey);
+    const version = Buffer.alloc(4);
+    version.writeUInt32BE(VERSION);
+    const encoded = Buffer.concat([
+        MAGIC,
+        version,
+        encodeString(encodePublicKey(getRawPublicKey(privateKey))),
+        encodeString(SSH_SIGNATURE_NAMESPACE),
+        encodeString(''),
+        encodeString(HASH_ALGORITHM),
+        encodeString(Buffer.concat([
+            encodeString(KEY_TYPE),
+            encodeString(signature),
+        ])),
+    ]).toString('base64');
+    const lines = encoded.match(new RegExp(`.{1,${ARMOR_LINE_LENGTH}}`, 'g'));
+    return [ARMOR_BEGIN, ...(lines ?? []), ARMOR_END, ''].join('\n');
+}
+/**
+ * Check a file against an SSH signature file. The signature must be made by
+ * the public key, for the "file" namespace, with a SHA-512 or SHA-256 digest.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether the signature matches.
+ */
+export async function verifySshSignature(path, signaturePath, publicKey) {
+    const armored = (await readFile(signaturePath, 'utf8')).trim();
+    const bytes = Buffer.from(armored.slice(ARMOR_BEGIN.length, -ARMOR_END.length), 'base64');
+    const [signer, namespace, reserved, hashAlgorithm = Buffer.alloc(0), signatureBlob = Buffer.alloc(0),] = decodeStrings(bytes.subarray(MAGIC.length + 4)) ?? [];
+    const [signatureType, signature] = decodeStrings(signatureBlob) ?? [];
+    const isValidShape = armored.startsWith(ARMOR_BEGIN) &&
+        armored.endsWith(ARMOR_END) &&
+        bytes.length > MAGIC.length + 4 &&
+        MAGIC.equals(bytes.subarray(0, MAGIC.length)) &&
+        VERSION === bytes.readUInt32BE(MAGIC.length) &&
+        signer?.equals(encodePublicKey(getRawPublicKey(publicKey))) &&
+        SSH_SIGNATURE_NAMESPACE === namespace?.toString() &&
+        0 === reserved?.length &&
+        ['sha512', 'sha256'].includes(hashAlgorithm.toString()) &&
+        KEY_TYPE === signatureType?.toString() &&
+        undefined !== signature;
+    return (Boolean(isValidShape) &&
+        verify(null, getSignedData(await digestFile(path, hashAlgorithm.toString()), SSH_SIGNATURE_NAMESPACE, hashAlgorithm.toString()), publicKey, signature ?? Buffer.alloc(0)));
+}

package/dist/summary.d.ts

@@ -1,6 +1,6 @@
 import type { ChecksumsResult } from './commands/checksums.ts';
 import type { SignResult } from './commands/sign.ts';
-import type { ZipResult } from './commands/zip.ts';
+import type { ZipPackageResult } from './package-zip.ts';
 import type { ChangesetTagResult } from './changeset-release.ts';
 import type { PackageRelease } from './changesets.ts';
 import type { DeployOptions } from './deploy-options.ts';
@@ -76,7 +76,7 @@ export declare function formatFile(context: SummaryContext, file: string, line?:
  * @param result  ZIP and manifest paths and the number of files.
  * @return Markdown summary.
  */
-export declare function getZipSummary(context: SummaryContext, result: ZipResult): string;
+export declare function getZipSummary(context: SummaryContext, result: ZipPackageResult): string;
 /**
  * Get the summary of a checksums manifest.
  *
@@ -89,7 +89,7 @@ export declare function getChecksumsSummary(context: SummaryContext, result: Che
  * Get the summary of signed files.
  *
  * @param context Workspace directory.
- * @param result  Signature paths and the public key.
+ * @param result  Signature paths and the public keys of the formats.
  * @return Markdown summary.
  */
 export declare function getSignSummary(context: SummaryContext, result: SignResult): string;

package/dist/summary.js

@@ -138,14 +138,14 @@ export function getChecksumsSummary(context, result) {
  * Get the summary of signed files.
  *
  * @param context Workspace directory.
- * @param result  Signature paths and the public key.
+ * @param result  Signature paths and the public keys of the formats.
  * @return Markdown summary.
  */
 export function getSignSummary(context, result) {
     return joinBlocks([
         '### Signatures',
         formatList(result.signatures.map((path) => formatFile(context, path))),
-        `Public key: ${formatCode(result.publicKey)}`,
+        ...result.formats.map((format) => `Public key (${format}): ${formatCode(result.publicKeys[format])}`),
     ]);
 }
 /**

package/dist/tag-format.d.ts

@@ -1,20 +1,29 @@
-import type { ConfiguredPackage } from './changeset-packages.ts';
+import type { ConfiguredDeployPackage } from './changeset-packages.ts';
 /**
- * Format the tag of a package release.
+ * Tag format of the package releases, like plugins/alpha/1.2.0 in a
+ * monorepo, or 1.2.0 for a package at the repository root.
+ */
+export declare const DEFAULT_TAG_FORMAT = "{path}/{version}";
+/**
+ * Fill in a template of a package with {name}, {path} and {version}, like a
+ * deploy template. A package at the root of the repository has an empty
+ * {path}.
  *
- * @param format  Tag format with {name}, {slug}, {path}, {type} and {version}.
- * @param pkg     Configured package.
- * @param version Released version, empty for the tag prefix of the package.
- * @return Tag name.
+ * @param format  Template with {name}, {path} and {version}.
+ * @param pkg     Configured package, with or without a version.
+ * @param version Released version, empty when there's none.
+ * @return Formatted text.
  */
-export declare function formatTag(format: string, pkg: ConfiguredPackage, version: string): string;
+export declare function formatTemplate(format: string, pkg: Pick<ConfiguredDeployPackage, 'name' | 'path'>, version: string): string;
 /**
- * Format the tag prefix of a package before its name is known, for packages
- * versioned by their git tags.
+ * Format the tag of a package release, or its tag prefix without a version.
+ * Empty placeholders leave no repeated or leading slashes, so a package at
+ * the repository root gets 1.2.0 for {path}/{version}. A trailing slash is
+ * kept, since it separates the tag prefix from the version.
  *
- * @param pattern     Tag pattern of the version source.
- * @param packagePath Package path relative to the package root.
- * @param tagType     Configured {type} of the package tags.
- * @return Tag prefix.
+ * @param format  Tag format with {name}, {path} and {version}.
+ * @param pkg     Configured package, with or without a version.
+ * @param version Released version, empty for the tag prefix of the package.
+ * @return Tag name or prefix.
  */
-export declare function formatTemplatePrefix(pattern: string, packagePath: string, tagType?: string): string;
+export declare function formatTag(format: string, pkg: Pick<ConfiguredDeployPackage, 'name' | 'path'>, version: string): string;