@wpelevator/wp-release 0.13.0 → 0.15.0

package/dist/package-zip.js

@@ -0,0 +1,78 @@
+import { existsSync } from 'node:fs';
+import { CHECKSUMS_EXTENSION, createChecksums, writeChecksums, } from "./checksums.js";
+import { ValidationError } from "./errors.js";
+import { ignoreOwnFile, ignoreOwnSignature, loadFileRules, selectFiles, } from "./file-selection.js";
+import { createZip } from "./zip.js";
+const ZIP_EXTENSION = '.zip';
+/**
+ * Get the checksums manifest path next to an archive, with .checksums.json
+ * instead of .zip.
+ *
+ * @param zipPath Archive path.
+ * @return Manifest path.
+ */
+export function getChecksumsPath(zipPath) {
+    const name = zipPath.endsWith(ZIP_EXTENSION)
+        ? zipPath.slice(0, -ZIP_EXTENSION.length)
+        : zipPath;
+    return name + CHECKSUMS_EXTENSION;
+}
+/**
+ * Fail before writing anything when an output file exists.
+ *
+ * @param  paths Output paths.
+ * @param  force Whether existing files are overwritten.
+ * @throws {ValidationError} If a file exists and force isn't set.
+ */
+function checkOverwrite(paths, force) {
+    const existing = paths.filter((path) => !force && existsSync(path));
+    if (existing.length) {
+        throw new ValidationError(`${existing.join(' and ')} already exists, pass --force to overwrite it.`);
+    }
+}
+/**
+ * Write a ZIP of the selected files of a plugin, theme or package, and
+ * optionally the checksums manifest of the same files next to it. The zip
+ * command, with a directory or a configured package release, and the
+ * snapshot builds of a monorepo all use it, so that every ZIP of a package
+ * selects its files the same way. Output files inside the source directory,
+ * and their signatures, are never archived.
+ *
+ * @param  input Files, archive path and manifest options.
+ * @return Paths of the written files and the number of archived files.
+ * @throws {ValidationError} Without selected files, or when an output file exists without force.
+ */
+export async function zipPackage(input) {
+    const { sourceDir, zipPath, force = false } = input;
+    const checksumsPath = input.checksums ? getChecksumsPath(zipPath) : null;
+    const outputs = [zipPath, checksumsPath].filter((path) => null !== path);
+    const rules = await loadFileRules(input.selection);
+    outputs.forEach((path) => ignoreOwnSignature(ignoreOwnFile(rules, sourceDir, path), sourceDir, path));
+    const files = await selectFiles(sourceDir, rules);
+    if (!files.length) {
+        throw new ValidationError(`No files to archive in ${sourceDir}.`);
+    }
+    checkOverwrite(outputs, force);
+    await createZip({
+        sourceDir,
+        files,
+        zipPath,
+        rootFolder: input.rootFolder,
+        force,
+    });
+    if (checksumsPath) {
+        const manifest = await createChecksums({
+            sourceDir,
+            rules,
+            slug: input.slug,
+            version: input.version ?? null,
+            type: input.type,
+        });
+        await writeChecksums(checksumsPath, manifest, force);
+    }
+    return {
+        zipPath,
+        ...(checksumsPath ? { checksumsPath } : {}),
+        files: files.length,
+    };
+}

package/dist/release-repository.d.ts

@@ -66,11 +66,12 @@ export declare class ReleaseRepository {
      */
     createTag(tag: string): Promise<void>;
     /**
-     * Push a tag to the origin remote.
+     * Push a tag to a remote.
      *
-     * @param tag Tag name.
+     * @param tag    Tag name.
+     * @param remote Remote name.
      */
-    pushTag(tag: string): Promise<void>;
+    pushTag(tag: string, remote: string): Promise<void>;
     /**
      * Find the commit that added a file.
      *

package/dist/release-repository.js

@@ -78,12 +78,13 @@ export class ReleaseRepository {
         await this.run(['tag', tag]);
     }
     /**
-     * Push a tag to the origin remote.
+     * Push a tag to a remote.
      *
-     * @param tag Tag name.
+     * @param tag    Tag name.
+     * @param remote Remote name.
      */
-    async pushTag(tag) {
-        await this.run(['push', 'origin', tag]);
+    async pushTag(tag, remote) {
+        await this.run(['push', remote, tag]);
     }
     /**
      * Find the commit that added a file.

package/dist/signing.d.ts

@@ -1,4 +1,8 @@
 import type { KeyObject } from 'node:crypto';
+/**
+ * Extension of the signature files in the format that WordPress core's
+ * verify_file_signature() checks.
+ */
 export declare const SIGNATURE_EXTENSION = ".sig";
 /**
  * Environment variable with the base64 Ed25519 signing key.
@@ -7,11 +11,12 @@ export declare const SIGNING_KEY_ENV = "WP_RELEASE_SIGNING_KEY";
 /**
  * Generate an Ed25519 key pair in the base64 formats used by wp-release.
  *
- * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ * @return Private seed for WP_RELEASE_SIGNING_KEY, the base64 public key and the public key of each signature format.
  */
 export declare function generateSigningKeyPair(): {
     privateKey: string;
     publicKey: string;
+    publicKeys: Record<SignatureFormat, string>;
 };
 /**
  * Get an Ed25519 private key from the base64 format that sodium and the
@@ -24,11 +29,13 @@ export declare function generateSigningKeyPair(): {
  */
 export declare function parseSigningKey(encoded: string): KeyObject;
 /**
- * Get an Ed25519 public key from its base64 form.
+ * Get an Ed25519 public key from the base64 32-byte key, a minisign public
+ * key or an OpenSSH ssh-ed25519 public key. They're forms of the same key,
+ * so any of them checks the signatures of every format.
  *
- * @param  encoded Base64 32-byte public key.
+ * @param  encoded Public key.
  * @return Public key.
- * @throws {ValidationError} If the key has an unsupported length.
+ * @throws {ValidationError} If the key isn't in one of the forms.
  */
 export declare function parsePublicKey(encoded: string): KeyObject;
 /**
@@ -55,24 +62,108 @@ export declare function getFileDigest(path: string): Promise<Buffer>;
  * @return Base64 signature.
  */
 export declare function signFile(path: string, privateKey: KeyObject): Promise<string>;
+/** Names of the signature formats. */
+export type SignatureFormat = 'wordpress' | 'minisign' | 'ssh';
+/** How a signature format writes and checks signature files. */
+export interface SignatureFormatHandler {
+    /** Extension of the signature file, appended to the signed file name. */
+    extension: string;
+    /** Get the contents of the signature file of a file. */
+    create: (path: string, privateKey: KeyObject) => Promise<string>;
+    /** Check a file against its signature file. */
+    verify: (path: string, signaturePath: string, publicKey: KeyObject) => Promise<boolean>;
+    /** Get the public key in the form that the verifiers of the format take. */
+    getPublicKey: (key: KeyObject) => string;
+}
+export declare const DEFAULT_SIGNATURE_FORMAT: SignatureFormat;
+/**
+ * Signature formats, all Ed25519 signatures by the same key:
+ *
+ * - wordpress: base64 signature of the SHA-384 digest in <file>.sig, which
+ *   WordPress core's verify_file_signature() checks.
+ * - minisign: <file>.minisig, which `minisign -V` checks.
+ * - ssh: armored SSH signature in <file>.sshsig, which `ssh-keygen -Y verify`
+ *   checks with the "file" namespace.
+ */
+export declare const SIGNATURE_FORMATS: Record<SignatureFormat, SignatureFormatHandler>;
 /**
- * Write the signature of a file to a .sig file next to it.
+ * Check that a value is the name of a signature format.
+ *
+ * @param value Value to check.
+ * @return Whether it's a signature format.
+ */
+export declare function isSignatureFormat(value: string): value is SignatureFormat;
+/**
+ * Get the signature file path of a file.
+ *
+ * @param path   File path.
+ * @param format Signature format.
+ * @return Signature file path.
+ */
+export declare function getSignaturePath(path: string, format?: SignatureFormat): string;
+/**
+ * Get the public key of a key in the form of each signature format.
+ *
+ * @param key Private or public key.
+ * @return Public keys by format.
+ */
+export declare function getPublicKeys(key: KeyObject): Record<SignatureFormat, string>;
+/**
+ * Write the signature of a file to a signature file next to it.
  *
  * @param  path       File path.
  * @param  privateKey Private key from parseSigningKey().
  * @param  force      Whether to overwrite an existing signature file.
+ * @param  format     Signature format.
  * @return Signature file path.
  * @throws {ValidationError} If the signature file exists and force isn't set.
  */
-export declare function writeSignature(path: string, privateKey: KeyObject, force?: boolean): Promise<string>;
+export declare function writeSignature(path: string, privateKey: KeyObject, force?: boolean, format?: SignatureFormat): Promise<string>;
+export interface SignFilesInput {
+    /** Absolute paths of the files to sign. */
+    paths: string[];
+    /** Signature formats to write, the WordPress .sig by default. */
+    formats?: SignatureFormat[];
+    /** Base64 signing key, from the WP_RELEASE_SIGNING_KEY environment variable by default. */
+    key?: string;
+    /** Overwrite existing signature files. */
+    force?: boolean;
+}
+export interface SignFilesResult {
+    /** Absolute paths of the written signature files. */
+    signatures: string[];
+    /** Base64 public key of the signing key. */
+    publicKey: string;
+    /** Public key of the signing key in the form of each signature format. */
+    publicKeys: Record<SignatureFormat, string>;
+}
+/**
+ * Validate the signing key and destinations before writing files. The input
+ * files need not exist yet, so zip can check before creating its artifacts.
+ *
+ * @param  input Files, formats, key and whether to overwrite.
+ * @return Parsed signing key.
+ * @throws {ValidationError} Without a valid key or when a signature already exists without force.
+ */
+export declare function checkSigningInput(input: SignFilesInput): KeyObject;
+/**
+ * Sign files with a signature file of each format next to each, in order,
+ * so that a failure leaves a predictable set of files.
+ *
+ * @param  input Files, formats, key and whether to overwrite.
+ * @return The written signature files and the public keys.
+ * @throws {ValidationError} Without a key, for an invalid key, a missing file or an existing signature file without force.
+ */
+export declare function signFiles(input: SignFilesInput): Promise<SignFilesResult>;
 /**
- * Check a file against a .sig file, which holds one base64 signature per
- * line. The file is valid when any of the signatures match, so that a file
+ * Check a file against a signature file. A wordpress .sig file can hold one
+ * signature per line, and is valid when any of them match, so that a file
  * can carry the signatures of a key rotation window.
  *
  * @param path          File path.
  * @param signaturePath Signature file path.
  * @param publicKey     Public key from parsePublicKey().
+ * @param format        Signature format.
  * @return Whether a signature matches.
  */
-export declare function verifyFileSignature(path: string, signaturePath: string, publicKey: KeyObject): Promise<boolean>;
+export declare function verifyFileSignature(path: string, signaturePath: string, publicKey: KeyObject, format?: SignatureFormat): Promise<boolean>;

package/dist/signing.js

@@ -1,7 +1,14 @@
-import { createHash, createPrivateKey, generateKeyPairSync, createPublicKey, sign, verify, } from 'node:crypto';
-import { createReadStream } from 'node:fs';
-import { readFile, writeFile } from 'node:fs/promises';
+import { createPrivateKey, generateKeyPairSync, sign, verify, } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { readFile, stat, writeFile } from 'node:fs/promises';
+import { PUBLIC_KEY_BYTES, createRawPublicKey, digestFile, getRawPublicKey, } from "./ed25519.js";
 import { ValidationError } from "./errors.js";
+import { MINISIGN_EXTENSION, createMinisignSignature, getMinisignPublicKey, parseMinisignPublicKey, verifyMinisignSignature, } from "./minisign.js";
+import { SSH_SIGNATURE_EXTENSION, createSshSignature, getSshPublicKey, parseSshPublicKey, verifySshSignature, } from "./ssh-signature.js";
+/**
+ * Extension of the signature files in the format that WordPress core's
+ * verify_file_signature() checks.
+ */
 export const SIGNATURE_EXTENSION = '.sig';
 /**
  * Environment variable with the base64 Ed25519 signing key.
@@ -9,15 +16,12 @@ export const SIGNATURE_EXTENSION = '.sig';
 export const SIGNING_KEY_ENV = 'WP_RELEASE_SIGNING_KEY';
 const SEED_BYTES = 32;
 const SECRET_KEY_BYTES = 64;
-const PUBLIC_KEY_BYTES = 32;
 // DER prefix of a PKCS#8 Ed25519 private key, followed by the 32-byte seed.
 const PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
-// DER prefix of a SPKI Ed25519 public key, followed by the 32-byte key.
-const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
 /**
  * Generate an Ed25519 key pair in the base64 formats used by wp-release.
  *
- * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ * @return Private seed for WP_RELEASE_SIGNING_KEY, the base64 public key and the public key of each signature format.
  */
 export function generateSigningKeyPair() {
     const { privateKey, publicKey } = generateKeyPairSync('ed25519');
@@ -29,6 +33,7 @@ export function generateSigningKeyPair() {
     return {
         privateKey: Buffer.from(privateJwk.d, 'base64url').toString('base64'),
         publicKey: Buffer.from(publicJwk.x, 'base64url').toString('base64'),
+        publicKeys: getPublicKeys(publicKey),
     };
 }
 /**
@@ -61,22 +66,22 @@ export function parseSigningKey(encoded) {
     });
 }
 /**
- * Get an Ed25519 public key from its base64 form.
+ * Get an Ed25519 public key from the base64 32-byte key, a minisign public
+ * key or an OpenSSH ssh-ed25519 public key. They're forms of the same key,
+ * so any of them checks the signatures of every format.
  *
- * @param  encoded Base64 32-byte public key.
+ * @param  encoded Public key.
  * @return Public key.
- * @throws {ValidationError} If the key has an unsupported length.
+ * @throws {ValidationError} If the key isn't in one of the forms.
  */
 export function parsePublicKey(encoded) {
-    const bytes = decodeKey(encoded);
+    const bytes = parseSshPublicKey(encoded) ??
+        parseMinisignPublicKey(encoded) ??
+        decodeKey(encoded);
     if (PUBLIC_KEY_BYTES !== bytes.length) {
-        throw new ValidationError(`The public key must be a base64 ${PUBLIC_KEY_BYTES}-byte Ed25519 key, got ${bytes.length} bytes.`);
+        throw new ValidationError(`The public key must be a base64 ${PUBLIC_KEY_BYTES}-byte Ed25519 key, a minisign public key or an ssh-ed25519 public key, got ${bytes.length} bytes.`);
     }
-    return createPublicKey({
-        key: Buffer.concat([SPKI_PREFIX, bytes]),
-        format: 'der',
-        type: 'spki',
-    });
+    return createRawPublicKey(bytes);
 }
 /**
  * Get the base64 public key for a private key, in the format that
@@ -86,11 +91,7 @@ export function parsePublicKey(encoded) {
  * @return Base64 public key.
  */
 export function getPublicKey(privateKey) {
-    const der = createPublicKey(privateKey).export({
-        format: 'der',
-        type: 'spki',
-    });
-    return der.subarray(SPKI_PREFIX.length).toString('base64');
+    return getRawPublicKey(privateKey).toString('base64');
 }
 /**
  * Get the raw SHA-384 digest of a file, which is what WordPress core's
@@ -100,11 +101,7 @@ export function getPublicKey(privateKey) {
  * @return Digest bytes.
  */
 export async function getFileDigest(path) {
-    const hash = createHash('sha384');
-    for await (const chunk of createReadStream(path)) {
-        hash.update(chunk);
-    }
-    return hash.digest();
+    return digestFile(path, 'sha384');
 }
 /**
  * Sign a file with a detached Ed25519 signature of its raw SHA-384 digest.
@@ -117,18 +114,99 @@ export async function signFile(path, privateKey) {
     return sign(null, await getFileDigest(path), privateKey).toString('base64');
 }
 /**
- * Write the signature of a file to a .sig file next to it.
+ * Check a file against a .sig file, which holds one base64 signature per
+ * line. The file is valid when any of the signatures match, so that a file
+ * can carry the signatures of a key rotation window.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether a signature matches.
+ */
+async function verifyWordPressSignature(path, signaturePath, publicKey) {
+    const digest = await getFileDigest(path);
+    const signatures = (await readFile(signaturePath, 'utf8'))
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean);
+    return signatures.some((signature) => verify(null, digest, publicKey, Buffer.from(signature, 'base64')));
+}
+export const DEFAULT_SIGNATURE_FORMAT = 'wordpress';
+/**
+ * Signature formats, all Ed25519 signatures by the same key:
+ *
+ * - wordpress: base64 signature of the SHA-384 digest in <file>.sig, which
+ *   WordPress core's verify_file_signature() checks.
+ * - minisign: <file>.minisig, which `minisign -V` checks.
+ * - ssh: armored SSH signature in <file>.sshsig, which `ssh-keygen -Y verify`
+ *   checks with the "file" namespace.
+ */
+export const SIGNATURE_FORMATS = {
+    wordpress: {
+        extension: SIGNATURE_EXTENSION,
+        create: async (path, privateKey) => (await signFile(path, privateKey)) + '\n',
+        verify: verifyWordPressSignature,
+        getPublicKey,
+    },
+    minisign: {
+        extension: MINISIGN_EXTENSION,
+        create: createMinisignSignature,
+        verify: verifyMinisignSignature,
+        getPublicKey: getMinisignPublicKey,
+    },
+    ssh: {
+        extension: SSH_SIGNATURE_EXTENSION,
+        create: createSshSignature,
+        verify: verifySshSignature,
+        getPublicKey: getSshPublicKey,
+    },
+};
+/**
+ * Check that a value is the name of a signature format.
+ *
+ * @param value Value to check.
+ * @return Whether it's a signature format.
+ */
+export function isSignatureFormat(value) {
+    return Object.hasOwn(SIGNATURE_FORMATS, value);
+}
+/**
+ * Get the signature file path of a file.
+ *
+ * @param path   File path.
+ * @param format Signature format.
+ * @return Signature file path.
+ */
+export function getSignaturePath(path, format = DEFAULT_SIGNATURE_FORMAT) {
+    return path + SIGNATURE_FORMATS[format].extension;
+}
+/**
+ * Get the public key of a key in the form of each signature format.
+ *
+ * @param key Private or public key.
+ * @return Public keys by format.
+ */
+export function getPublicKeys(key) {
+    return {
+        wordpress: SIGNATURE_FORMATS.wordpress.getPublicKey(key),
+        minisign: SIGNATURE_FORMATS.minisign.getPublicKey(key),
+        ssh: SIGNATURE_FORMATS.ssh.getPublicKey(key),
+    };
+}
+/**
+ * Write the signature of a file to a signature file next to it.
  *
  * @param  path       File path.
  * @param  privateKey Private key from parseSigningKey().
  * @param  force      Whether to overwrite an existing signature file.
+ * @param  format     Signature format.
  * @return Signature file path.
  * @throws {ValidationError} If the signature file exists and force isn't set.
  */
-export async function writeSignature(path, privateKey, force = false) {
-    const signaturePath = path + SIGNATURE_EXTENSION;
-    const signature = await signFile(path, privateKey);
-    await writeFile(signaturePath, signature + '\n', {
+export async function writeSignature(path, privateKey, force = false, format = DEFAULT_SIGNATURE_FORMAT) {
+    const signaturePath = getSignaturePath(path, format);
+    const signature = await SIGNATURE_FORMATS[format].create(path, privateKey);
+    await writeFile(signaturePath, signature, {
         flag: force ? 'w' : 'wx',
     }).catch((error) => {
         throw 'EEXIST' === error.code
@@ -138,20 +216,66 @@ export async function writeSignature(path, privateKey, force = false) {
     return signaturePath;
 }
 /**
- * Check a file against a .sig file, which holds one base64 signature per
- * line. The file is valid when any of the signatures match, so that a file
+ * Validate the signing key and destinations before writing files. The input
+ * files need not exist yet, so zip can check before creating its artifacts.
+ *
+ * @param  input Files, formats, key and whether to overwrite.
+ * @return Parsed signing key.
+ * @throws {ValidationError} Without a valid key or when a signature already exists without force.
+ */
+export function checkSigningInput(input) {
+    const encoded = input.key ?? process.env[SIGNING_KEY_ENV];
+    const formats = input.formats ?? [DEFAULT_SIGNATURE_FORMAT];
+    if (!encoded?.trim()) {
+        throw new ValidationError(`Set the ${SIGNING_KEY_ENV} environment variable to the base64 Ed25519 signing key.`);
+    }
+    const privateKey = parseSigningKey(encoded);
+    const existing = input.paths
+        .flatMap((path) => formats.map((format) => getSignaturePath(path, format)))
+        .filter((path) => !input.force && existsSync(path));
+    if (existing.length) {
+        throw new ValidationError(`${existing.join(' and ')} already exists, pass --force to overwrite it.`);
+    }
+    return privateKey;
+}
+/**
+ * Sign files with a signature file of each format next to each, in order,
+ * so that a failure leaves a predictable set of files.
+ *
+ * @param  input Files, formats, key and whether to overwrite.
+ * @return The written signature files and the public keys.
+ * @throws {ValidationError} Without a key, for an invalid key, a missing file or an existing signature file without force.
+ */
+export async function signFiles(input) {
+    const formats = input.formats ?? [DEFAULT_SIGNATURE_FORMAT];
+    const privateKey = checkSigningInput(input);
+    await Promise.all(input.paths.map(async (path) => {
+        if (!(await stat(path).catch(() => null))?.isFile()) {
+            throw new ValidationError(`${path} is not a file.`);
+        }
+    }));
+    const signatures = [];
+    const jobs = input.paths.flatMap((path) => formats.map((format) => ({ path, format })));
+    for (const { path, format } of jobs) {
+        signatures.push(await writeSignature(path, privateKey, input.force, format));
+    }
+    return {
+        signatures,
+        publicKey: getPublicKey(privateKey),
+        publicKeys: getPublicKeys(privateKey),
+    };
+}
+/**
+ * Check a file against a signature file. A wordpress .sig file can hold one
+ * signature per line, and is valid when any of them match, so that a file
  * can carry the signatures of a key rotation window.
  *
  * @param path          File path.
  * @param signaturePath Signature file path.
  * @param publicKey     Public key from parsePublicKey().
+ * @param format        Signature format.
  * @return Whether a signature matches.
  */
-export async function verifyFileSignature(path, signaturePath, publicKey) {
-    const digest = await getFileDigest(path);
-    const signatures = (await readFile(signaturePath, 'utf8'))
-        .split('\n')
-        .map((line) => line.trim())
-        .filter(Boolean);
-    return signatures.some((signature) => verify(null, digest, publicKey, Buffer.from(signature, 'base64')));
+export async function verifyFileSignature(path, signaturePath, publicKey, format = DEFAULT_SIGNATURE_FORMAT) {
+    return SIGNATURE_FORMATS[format].verify(path, signaturePath, publicKey);
 }

package/dist/ssh-signature.d.ts

@@ -0,0 +1,43 @@
+import type { KeyObject } from 'node:crypto';
+export declare const SSH_SIGNATURE_EXTENSION = ".sshsig";
+/**
+ * Namespace of the signatures, which `ssh-keygen -Y verify -n` must match,
+ * so that a signature for files can't be used as one for something else.
+ */
+export declare const SSH_SIGNATURE_NAMESPACE = "file";
+/**
+ * Get the OpenSSH public key of a key, the line of an authorized_keys or
+ * allowed_signers file.
+ *
+ * @param key Private or public key.
+ * @return OpenSSH public key.
+ */
+export declare function getSshPublicKey(key: KeyObject): string;
+/**
+ * Get the raw public key from an OpenSSH Ed25519 public key line, with or
+ * without a comment.
+ *
+ * @param encoded OpenSSH public key.
+ * @return Public key bytes, or null when it isn't an OpenSSH Ed25519 key.
+ */
+export declare function parseSshPublicKey(encoded: string): Buffer | null;
+/**
+ * Create an SSH signature of a file, the armored format that
+ * `ssh-keygen -Y sign` writes, with the "file" namespace and a SHA-512
+ * digest.
+ *
+ * @param path       File path.
+ * @param privateKey Private key.
+ * @return Contents of the signature file.
+ */
+export declare function createSshSignature(path: string, privateKey: KeyObject): Promise<string>;
+/**
+ * Check a file against an SSH signature file. The signature must be made by
+ * the public key, for the "file" namespace, with a SHA-512 or SHA-256 digest.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether the signature matches.
+ */
+export declare function verifySshSignature(path: string, signaturePath: string, publicKey: KeyObject): Promise<boolean>;