@wpelevator/wp-release 0.13.0 → 0.15.0

package/dist/ssh-signature.js

@@ -0,0 +1,156 @@
+import { sign, verify } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { PUBLIC_KEY_BYTES, digestFile, getRawPublicKey } from "./ed25519.js";
+export const SSH_SIGNATURE_EXTENSION = '.sshsig';
+/**
+ * Namespace of the signatures, which `ssh-keygen -Y verify -n` must match,
+ * so that a signature for files can't be used as one for something else.
+ */
+export const SSH_SIGNATURE_NAMESPACE = 'file';
+const KEY_TYPE = 'ssh-ed25519';
+const MAGIC = Buffer.from('SSHSIG');
+const VERSION = 1;
+const HASH_ALGORITHM = 'sha512';
+const ARMOR_BEGIN = '-----BEGIN SSH SIGNATURE-----';
+const ARMOR_END = '-----END SSH SIGNATURE-----';
+const ARMOR_LINE_LENGTH = 70;
+/**
+ * Encode a value as an SSH wire format string: its length as a 32-bit
+ * big-endian number, followed by its bytes.
+ *
+ * @param value Bytes or text.
+ * @return Encoded string.
+ */
+function encodeString(value) {
+    const bytes = Buffer.from(value);
+    const length = Buffer.alloc(4);
+    length.writeUInt32BE(bytes.length);
+    return Buffer.concat([length, bytes]);
+}
+/**
+ * Read the SSH wire format strings that follow each other in a buffer.
+ *
+ * @param bytes Encoded strings.
+ * @return Decoded strings, or null when the buffer isn't a list of strings.
+ */
+function decodeStrings(bytes) {
+    const strings = [];
+    let offset = 0;
+    while (offset + 4 <= bytes.length) {
+        const end = offset + 4 + bytes.readUInt32BE(offset);
+        strings.push(bytes.subarray(offset + 4, end));
+        offset = end;
+    }
+    return offset === bytes.length ? strings : null;
+}
+/**
+ * Encode an Ed25519 public key as an SSH public key blob.
+ *
+ * @param publicKey Public key bytes.
+ * @return Public key blob.
+ */
+function encodePublicKey(publicKey) {
+    return Buffer.concat([
+        encodeString(KEY_TYPE),
+        encodeString(publicKey),
+    ]);
+}
+/**
+ * Get the data that an SSH signature signs: the namespace, the hash
+ * algorithm and the digest of the file.
+ *
+ * @param digest        File digest.
+ * @param namespace     Signature namespace.
+ * @param hashAlgorithm Hash algorithm of the digest.
+ * @return Signed data.
+ */
+function getSignedData(digest, namespace, hashAlgorithm) {
+    return Buffer.concat([
+        MAGIC,
+        encodeString(namespace),
+        encodeString(''),
+        encodeString(hashAlgorithm),
+        encodeString(digest),
+    ]);
+}
+/**
+ * Get the OpenSSH public key of a key, the line of an authorized_keys or
+ * allowed_signers file.
+ *
+ * @param key Private or public key.
+ * @return OpenSSH public key.
+ */
+export function getSshPublicKey(key) {
+    return `${KEY_TYPE} ${encodePublicKey(getRawPublicKey(key)).toString('base64')}`;
+}
+/**
+ * Get the raw public key from an OpenSSH Ed25519 public key line, with or
+ * without a comment.
+ *
+ * @param encoded OpenSSH public key.
+ * @return Public key bytes, or null when it isn't an OpenSSH Ed25519 key.
+ */
+export function parseSshPublicKey(encoded) {
+    const [type, blob = ''] = encoded.trim().split(/\s+/);
+    const [blobType, publicKey] = decodeStrings(Buffer.from(blob, 'base64')) ?? [];
+    const isSsh = KEY_TYPE === type &&
+        KEY_TYPE === blobType?.toString() &&
+        PUBLIC_KEY_BYTES === publicKey?.length;
+    return isSsh && publicKey ? publicKey : null;
+}
+/**
+ * Create an SSH signature of a file, the armored format that
+ * `ssh-keygen -Y sign` writes, with the "file" namespace and a SHA-512
+ * digest.
+ *
+ * @param path       File path.
+ * @param privateKey Private key.
+ * @return Contents of the signature file.
+ */
+export async function createSshSignature(path, privateKey) {
+    const signature = sign(null, getSignedData(await digestFile(path, HASH_ALGORITHM), SSH_SIGNATURE_NAMESPACE, HASH_ALGORITHM), privateKey);
+    const version = Buffer.alloc(4);
+    version.writeUInt32BE(VERSION);
+    const encoded = Buffer.concat([
+        MAGIC,
+        version,
+        encodeString(encodePublicKey(getRawPublicKey(privateKey))),
+        encodeString(SSH_SIGNATURE_NAMESPACE),
+        encodeString(''),
+        encodeString(HASH_ALGORITHM),
+        encodeString(Buffer.concat([
+            encodeString(KEY_TYPE),
+            encodeString(signature),
+        ])),
+    ]).toString('base64');
+    const lines = encoded.match(new RegExp(`.{1,${ARMOR_LINE_LENGTH}}`, 'g'));
+    return [ARMOR_BEGIN, ...(lines ?? []), ARMOR_END, ''].join('\n');
+}
+/**
+ * Check a file against an SSH signature file. The signature must be made by
+ * the public key, for the "file" namespace, with a SHA-512 or SHA-256 digest.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether the signature matches.
+ */
+export async function verifySshSignature(path, signaturePath, publicKey) {
+    const armored = (await readFile(signaturePath, 'utf8')).trim();
+    const bytes = Buffer.from(armored.slice(ARMOR_BEGIN.length, -ARMOR_END.length), 'base64');
+    const [signer, namespace, reserved, hashAlgorithm = Buffer.alloc(0), signatureBlob = Buffer.alloc(0),] = decodeStrings(bytes.subarray(MAGIC.length + 4)) ?? [];
+    const [signatureType, signature] = decodeStrings(signatureBlob) ?? [];
+    const isValidShape = armored.startsWith(ARMOR_BEGIN) &&
+        armored.endsWith(ARMOR_END) &&
+        bytes.length > MAGIC.length + 4 &&
+        MAGIC.equals(bytes.subarray(0, MAGIC.length)) &&
+        VERSION === bytes.readUInt32BE(MAGIC.length) &&
+        signer?.equals(encodePublicKey(getRawPublicKey(publicKey))) &&
+        SSH_SIGNATURE_NAMESPACE === namespace?.toString() &&
+        0 === reserved?.length &&
+        ['sha512', 'sha256'].includes(hashAlgorithm.toString()) &&
+        KEY_TYPE === signatureType?.toString() &&
+        undefined !== signature;
+    return (Boolean(isValidShape) &&
+        verify(null, getSignedData(await digestFile(path, hashAlgorithm.toString()), SSH_SIGNATURE_NAMESPACE, hashAlgorithm.toString()), publicKey, signature ?? Buffer.alloc(0)));
+}

package/dist/summary.d.ts

@@ -1,6 +1,6 @@
 import type { ChecksumsResult } from './commands/checksums.ts';
 import type { SignResult } from './commands/sign.ts';
-import type { ZipResult } from './commands/zip.ts';
+import type { ZipPackageResult } from './package-zip.ts';
 import type { ChangesetTagResult } from './changeset-release.ts';
 import type { PackageRelease } from './changesets.ts';
 import type { DeployOptions } from './deploy-options.ts';
@@ -76,7 +76,7 @@ export declare function formatFile(context: SummaryContext, file: string, line?:
  * @param result  ZIP and manifest paths and the number of files.
  * @return Markdown summary.
  */
-export declare function getZipSummary(context: SummaryContext, result: ZipResult): string;
+export declare function getZipSummary(context: SummaryContext, result: ZipPackageResult): string;
 /**
  * Get the summary of a checksums manifest.
  *
@@ -89,7 +89,7 @@ export declare function getChecksumsSummary(context: SummaryContext, result: Che
  * Get the summary of signed files.
  *
  * @param context Workspace directory.
- * @param result  Signature paths and the public key.
+ * @param result  Signature paths and the public keys of the formats.
  * @return Markdown summary.
  */
 export declare function getSignSummary(context: SummaryContext, result: SignResult): string;

package/dist/summary.js

@@ -138,14 +138,14 @@ export function getChecksumsSummary(context, result) {
  * Get the summary of signed files.
  *
  * @param context Workspace directory.
- * @param result  Signature paths and the public key.
+ * @param result  Signature paths and the public keys of the formats.
  * @return Markdown summary.
  */
 export function getSignSummary(context, result) {
     return joinBlocks([
         '### Signatures',
         formatList(result.signatures.map((path) => formatFile(context, path))),
-        `Public key: ${formatCode(result.publicKey)}`,
+        ...result.formats.map((format) => `Public key (${format}): ${formatCode(result.publicKeys[format])}`),
     ]);
 }
 /**

package/dist/tag-format.d.ts

@@ -1,20 +1,29 @@
 import type { ConfiguredDeployPackage } from './changeset-packages.ts';
 /**
- * Format the tag of a package release.
+ * Tag format of the package releases, like plugins/alpha/1.2.0 in a
+ * monorepo, or 1.2.0 for a package at the repository root.
+ */
+export declare const DEFAULT_TAG_FORMAT = "{path}/{version}";
+/**
+ * Fill in a template of a package with {name}, {path} and {version}, like a
+ * deploy template. A package at the root of the repository has an empty
+ * {path}.
  *
- * @param format  Tag format with {name}, {slug}, {path}, {type} and {version}.
+ * @param format  Template with {name}, {path} and {version}.
  * @param pkg     Configured package, with or without a version.
- * @param version Released version, empty for the tag prefix of the package.
- * @return Tag name.
+ * @param version Released version, empty when there's none.
+ * @return Formatted text.
  */
-export declare function formatTag(format: string, pkg: ConfiguredDeployPackage, version: string): string;
+export declare function formatTemplate(format: string, pkg: Pick<ConfiguredDeployPackage, 'name' | 'path'>, version: string): string;
 /**
- * Format the tag prefix of a package before its name is known, for packages
- * versioned by their git tags.
+ * Format the tag of a package release, or its tag prefix without a version.
+ * Empty placeholders leave no repeated or leading slashes, so a package at
+ * the repository root gets 1.2.0 for {path}/{version}. A trailing slash is
+ * kept, since it separates the tag prefix from the version.
  *
- * @param pattern     Tag pattern of the version source.
- * @param packagePath Package path relative to the package root.
- * @param tagType     Configured {type} of the package tags.
- * @return Tag prefix.
+ * @param format  Tag format with {name}, {path} and {version}.
+ * @param pkg     Configured package, with or without a version.
+ * @param version Released version, empty for the tag prefix of the package.
+ * @return Tag name or prefix.
  */
-export declare function formatTemplatePrefix(pattern: string, packagePath: string, tagType?: string): string;
+export declare function formatTag(format: string, pkg: Pick<ConfiguredDeployPackage, 'name' | 'path'>, version: string): string;

package/dist/tag-format.js

@@ -1,51 +1,37 @@
-import path from 'node:path';
 /**
- * Format the tag of a package release.
+ * Tag format of the package releases, like plugins/alpha/1.2.0 in a
+ * monorepo, or 1.2.0 for a package at the repository root.
+ */
+export const DEFAULT_TAG_FORMAT = '{path}/{version}';
+/**
+ * Fill in a template of a package with {name}, {path} and {version}, like a
+ * deploy template. A package at the root of the repository has an empty
+ * {path}.
  *
- * @param format  Tag format with {name}, {slug}, {path}, {type} and {version}.
+ * @param format  Template with {name}, {path} and {version}.
  * @param pkg     Configured package, with or without a version.
- * @param version Released version, empty for the tag prefix of the package.
- * @return Tag name.
+ * @param version Released version, empty when there's none.
+ * @return Formatted text.
  */
-export function formatTag(format, pkg, version) {
-    const type = pkg.group.tagType ?? defaultTagType(pkg.path, pkg.type);
+export function formatTemplate(format, pkg, version) {
     return format
         .replaceAll('{name}', pkg.name)
-        .replaceAll('{slug}', '.' === pkg.path
-        ? path.basename(pkg.directory)
-        : path.basename(pkg.path))
-        .replaceAll('{path}', pkg.path)
-        .replaceAll('{type}', type)
+        .replaceAll('{path}', '.' === pkg.path ? '' : pkg.path)
         .replaceAll('{version}', version);
 }
 /**
- * Format the tag prefix of a package before its name is known, for packages
- * versioned by their git tags.
+ * Format the tag of a package release, or its tag prefix without a version.
+ * Empty placeholders leave no repeated or leading slashes, so a package at
+ * the repository root gets 1.2.0 for {path}/{version}. A trailing slash is
+ * kept, since it separates the tag prefix from the version.
  *
- * @param pattern     Tag pattern of the version source.
- * @param packagePath Package path relative to the package root.
- * @param tagType     Configured {type} of the package tags.
- * @return Tag prefix.
+ * @param format  Tag format with {name}, {path} and {version}.
+ * @param pkg     Configured package, with or without a version.
+ * @param version Released version, empty for the tag prefix of the package.
+ * @return Tag name or prefix.
  */
-export function formatTemplatePrefix(pattern, packagePath, tagType) {
-    return pattern
-        .replaceAll('{path}', packagePath)
-        .replaceAll('{type}', tagType ?? defaultTagType(packagePath))
-        .replaceAll('{name}', packagePath.split('/').at(-1) ?? packagePath)
-        .replaceAll('{slug}', packagePath.split('/').at(-1) ?? packagePath)
-        .replaceAll('{version}', '');
-}
-function defaultTagType(packagePath, type) {
-    if ('.' === packagePath && type) {
-        return type;
-    }
-    const first = packagePath.split('/')[0] ?? 'package';
-    const irregular = {
-        actions: 'action',
-        plugins: 'plugin',
-        themes: 'theme',
-        php: 'php',
-        js: 'js',
-    };
-    return irregular[first] ?? first.replace(/s$/, '');
+export function formatTag(format, pkg, version) {
+    return formatTemplate(format, pkg, version)
+        .replace(/\/{2,}/g, '/')
+        .replace(/^\/+/, '');
 }

package/dist/version-files.d.ts

@@ -1,19 +1,18 @@
 import type { PackageVersionSource, PackageVersionTarget } from './changeset-config.ts';
-import type { ConfiguredPackage } from './changeset-packages.ts';
+import type { ConfiguredPackage, ConfiguredDeployPackage } from './changeset-packages.ts';
 import type { FileJournal } from './file-journal.ts';
 import type { ReleaseRepository } from './release-repository.ts';
 /**
  * Read the current version of a package from its configured source.
  *
- * @param  repository   Repository, for versions stored as git tags.
- * @param  directory    Package directory.
- * @param  descriptor   Version source.
- * @param  relativePath Package path relative to the package root.
- * @param  tagType      Configured {type} of the package tags.
+ * @param  repository Repository, for versions stored as git tags.
+ * @param  directory  Package directory.
+ * @param  descriptor Version source.
+ * @param  pkg        Package name and path, for the tags of a git-tag source.
  * @return Current version.
  * @throws {ValidationError} If the version is missing.
  */
-export declare function readVersion(repository: ReleaseRepository, directory: string, descriptor: PackageVersionSource, relativePath: string, tagType?: string): Promise<string>;
+export declare function readVersion(repository: ReleaseRepository, directory: string, descriptor: PackageVersionSource, pkg: Pick<ConfiguredDeployPackage, 'name' | 'path'>): Promise<string>;
 /**
  * Write a version to a configured version target.
  *

package/dist/version-files.js

@@ -4,21 +4,20 @@ import { ValidationError } from "./errors.js";
 import { readJson } from "./json-files.js";
 import { findMainPluginFile } from "./package-meta.js";
 import { escapeRegExp } from "./regexp.js";
-import { formatTemplatePrefix } from "./tag-format.js";
+import { DEFAULT_TAG_FORMAT, formatTag } from "./tag-format.js";
 import { findConstantValues } from "./version-check.js";
 import { compareVersions, isPrerelease } from "./versions.js";
 /**
  * Read the current version of a package from its configured source.
  *
- * @param  repository   Repository, for versions stored as git tags.
- * @param  directory    Package directory.
- * @param  descriptor   Version source.
- * @param  relativePath Package path relative to the package root.
- * @param  tagType      Configured {type} of the package tags.
+ * @param  repository Repository, for versions stored as git tags.
+ * @param  directory  Package directory.
+ * @param  descriptor Version source.
+ * @param  pkg        Package name and path, for the tags of a git-tag source.
  * @return Current version.
  * @throws {ValidationError} If the version is missing.
  */
-export async function readVersion(repository, directory, descriptor, relativePath, tagType) {
+export async function readVersion(repository, directory, descriptor, pkg) {
     if ('package-json' === descriptor.kind ||
         'composer-json' === descriptor.kind) {
         const manifest = await readJson(path.join(directory, descriptor.file));
@@ -29,8 +28,8 @@ export async function readVersion(repository, directory, descriptor, relativePat
         throw new ValidationError(`Missing ${descriptor.file}#${descriptor.field} in ${directory}.`);
     }
     if ('git-tag' === descriptor.kind) {
-        const pattern = descriptor.pattern ?? '{path}/{version}';
-        const tags = await repository.listTags(formatTemplatePrefix(pattern, relativePath, tagType));
+        const pattern = descriptor.pattern ?? DEFAULT_TAG_FORMAT;
+        const tags = await repository.listTags(formatTag(pattern, pkg, ''));
         const versions = tags
             .map((tag) => tag.match(/(?:^|\/|v)(\d+(?:\.\d+){1,3})$/)?.[1])
             .filter((item) => Boolean(item));
@@ -38,7 +37,7 @@ export async function readVersion(repository, directory, descriptor, relativePat
         if (versions[0]) {
             return versions[0];
         }
-        throw new ValidationError(`No git tag matches ${pattern} for ${relativePath}.`);
+        throw new ValidationError(`No git tag matches ${pattern} for ${pkg.path}.`);
     }
     if ('php-constant' === descriptor.kind) {
         const file = path.join(directory, descriptor.file);
@@ -142,7 +141,7 @@ export async function verifyVersionTargets(repository, pkg, expected) {
             actual = undefined;
         }
         else {
-            actual = await readVersion(repository, pkg.directory, target, pkg.path, pkg.group.tagType);
+            actual = await readVersion(repository, pkg.directory, target, pkg);
         }
         if (undefined !== actual && actual !== expected) {
             throw new ValidationError(`Version mismatch for ${pkg.name}: expected ${expected}, found ${actual}.`);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@wpelevator/wp-release",
-	"version": "0.13.0",
+	"version": "0.15.0",
 	"description": "Package, checksum, sign, verify and version-check WordPress plugins and themes, and deploy plugins to WordPress.org SVN",
 	"license": "MIT",
 	"repository": {
@@ -58,7 +58,7 @@
 		"build": "tsc -p tsconfig.build.json",
 		"prepack": "npm run build",
 		"lint": "npm-run-all lint:*",
-		"lint:js": "wp-scripts lint-js src",
+		"lint:js": "wp-scripts lint-js",
 		"lint:types": "tsc -p tsconfig.json",
 		"format": "wp-scripts format src",
 		"test": "node --test --conditions=wpelevator-source"