@wpelevator/wp-release 0.3.0 → 0.4.0

package/README.md

@@ -4,7 +4,7 @@ Package, checksum, verify and version-check WordPress plugins and themes, and de
 
 Themes are released by uploading a ZIP on WordPress.org, so `deploy-svn` is for plugins only; use `zip` to build the theme upload.
 
-**Status:** first release (0.x). All commands are implemented and tested against local SVN repositories, but `deploy-svn` hasn't been used for a WordPress.org deploy yet, so try it with `--dry-run` first. Signing checksums manifests is planned.
+**Status:** first release (0.x). All commands are implemented and tested against local SVN repositories, but `deploy-svn` hasn't been used for a WordPress.org deploy yet, so try it with `--dry-run` first. Signatures are tested against libsodium, but haven't been used for a real release yet.
 
 Option names follow the existing community tools (10up WordPress.org actions, `wp dist-archive`, `wp-scripts plugin-zip`, `grunt-wp-deploy`) so that migrating needs few or no renames. See [Comparison with existing tools](#comparison-with-existing-tools) for the differences.
 
@@ -28,7 +28,8 @@ npx wp-release --help
 |---|---|
 | `wp-release zip [<source-dir>] [options]` | Create a ZIP archive with a `{slug}/` root folder, respecting `.distignore`. |
 | `wp-release checksums [<source-dir>] [options]` | Write the MD5 and SHA-256 hashes of every distributed file to a checksums manifest. |
-| `wp-release verify [<source-dir>] --checksums <file> [options]` | Check a plugin or theme directory against a checksums manifest. |
+| `wp-release sign <file>... [options]` | Sign files with Ed25519, writing a detached `<file>.sig` next to each. |
+| `wp-release verify [<source-dir>] --checksums <file> [options]` | Check a plugin or theme directory, or a ZIP, against a checksums manifest. |
 | `wp-release version-check [<source-dir>] [options]` | Check that the `Version` header, readme `Stable tag`, PHP constants and git tag agree. |
 | `wp-release deploy-svn [<source-dir>] [options]` | Deploy a plugin to the WordPress.org plugin SVN repository. |
 
@@ -40,8 +41,9 @@ Run `npx wp-release <command> --help` for the options of each command. Every com
 
 | Capability | CLI command | GitHub Action |
 |---|---|---|
-| Build a ZIP | `wp-release zip` | |
-| Create a checksums manifest | `wp-release checksums` | |
+| Build a ZIP | `wp-release zip` | [`wpelevator/wp-release-zip`](../../actions/wp-release-zip) |
+| Create a checksums manifest | `wp-release checksums` | [`wpelevator/wp-release-checksums`](../../actions/wp-release-checksums) |
+| Sign files | `wp-release sign` | [`wpelevator/wp-release-sign`](../../actions/wp-release-sign) |
 | Verify files against a manifest | `wp-release verify` | |
 | Check that the versions agree | `wp-release version-check` | |
 | Deploy to WordPress.org SVN | `wp-release deploy-svn` | [`wpelevator/wp-release-deploy-svn`](../../actions/wp-release-deploy-svn) |
@@ -130,8 +132,50 @@ wp-release verify wp-content/plugins/my-plugin --checksums my-plugin.1.2.0.check
 - A file matches when its SHA-256 equals the manifest. Manifests without SHA-256 fall back to MD5, and a hash can also be a list of accepted values.
 - `verify` doesn't read `.distignore`, so that an ignore file inside the checked directory can't hide added files. `--exclude <patterns>` skips paths in both the directory and the manifest, for files that aren't part of the release, such as caches.
 - Manifest paths outside the package folder (absolute or with `..`) are rejected.
+- `--zip <file|url>` checks the files of a ZIP instead of a directory. The ZIP can be a URL, such as the one that WordPress.org builds for a release, and its single root folder is found automatically (or set `--root-folder`). The ZIP is extracted to a temporary directory after the same safety checks as `deploy-svn --from-zip`.
+- The version in the manifest must match the `Version` header of the checked files, so that an older release with its own valid manifest can't pass as a newer one.
+- A manifest can't list itself. A copy of the manifest and of its `.sig` inside the checked files, at the root with the same names as the `--checksums` file or at the path of `--embedded`, is skipped when comparing files, but it must be identical to the `--checksums` file. See [Manifest inside the plugin](#manifest-inside-the-plugin).
 
-A checksums manifest proves only that the files match the manifest. Signing the manifest, so that the manifest itself can be trusted, is planned.
+A checksums manifest proves only that the files match the manifest. With `--public-key <key>`, `verify` first checks `<checksums>.sig` against the base64 Ed25519 public key and fails with exit code `2` before comparing any file when the signature is missing or invalid, so that the manifest itself can be trusted. See [Sign](#sign).
+
+### Manifest inside the plugin
+
+A release can ship its signed manifest inside the plugin, so that an installed copy can be checked later with the public key, and also publish the same two files as release assets. Both use the same files:
+
+```bash
+wp-release checksums build --slug my-plugin --output build/checksums.json
+wp-release sign build/checksums.json
+wp-release zip build --slug my-plugin
+wp-release deploy-svn build --trunk --svn-tag 1.2.0
+```
+
+- Write the manifest into the directory that is zipped and deployed. It lists every file except itself, and `checksums`, `zip` and `verify` also skip its `<name>.sig`, so running `checksums` again on a build that already has the pair gives the same manifest. Sign it last, since the signature covers the exact bytes of the manifest.
+- `zip` and `deploy-svn` carry the pair like any other file. Don't use `zip --checksums` here, since it would write a second manifest that lists the first one. Attach `build/checksums.json` and `build/checksums.json.sig` to the GitHub release as they are.
+- The signature covers file hashes and not a ZIP, so it stays valid for the ZIP that WordPress.org builds from SVN. Check what WordPress.org serves after a deploy, with the manifest and public key from your build:
+
+  ```bash
+  wp-release verify --zip https://downloads.wordpress.org/plugin/my-plugin.1.2.0.zip \
+    --checksums build/checksums.json --public-key "$PUBLIC_KEY"
+  ```
+
+- The manifest can have any name and location, for example `--output build/includes/signatures/checksums.json`, and missing folders are created. Tell `verify` where the shipped copy is with `--embedded <path>`, like `--embedded includes/signatures/checksums.json`. The copy and its `.sig` are then skipped when comparing files, must exist, and must be identical to the `--checksums` file and its signature. Without `--embedded`, `verify` looks for the manifest name at the root and only checks it when it's there.
+
+The public key has to come from somewhere other than the plugin that it checks, because someone who can overwrite the plugin files can also replace a key and a signature inside them. A copy of the manifest also doesn't prevent a downgrade to an older release that was signed too, so the installing side has to enforce a minimum version.
+
+### Sign
+
+`sign` writes a detached signature next to each file, `<file>.sig`, so that downloads and installed copies can be trusted. Sign both the ZIP and the checksums manifest: the ZIP signature covers installs and updates, and the manifest signature covers the contents after unpacking and copies that weren't built by you.
+
+```bash
+WP_RELEASE_SIGNING_KEY=… wp-release sign my-plugin.1.2.0.zip my-plugin.1.2.0.checksums.json
+```
+
+- The signature is the one WordPress core's `verify_file_signature()` checks: a base64 Ed25519 signature of the raw SHA-384 digest of the file. The tests check it against `sodium_crypto_sign_verify_detached()` in PHP. A `.sig` file can hold several signatures, one per line, and a file is valid when any of them match, which allows a key rotation window.
+- The key is read from the `WP_RELEASE_SIGNING_KEY` environment variable only, as a base64 32-byte Ed25519 seed or a 64-byte libsodium secret key, the formats that `sodium_crypto_sign_seed_keypair()` and the update-pilot-server package signing key take. There's no flag for it, since it would show in the process list, and it's never logged.
+- `--verbose` prints the public key of the signing key, which `--json` also returns as `publicKey`. Pass it to `verify --public-key` and to the plugin that checks the signatures.
+- An existing `.sig` file isn't overwritten without `--force`.
+
+Generating a key pair isn't part of the package yet. With PHP: `php -r 'echo base64_encode( random_bytes( 32 ) );'` gives a seed, and the public key is printed by `sign --verbose`.
 
 ### Version check
 
@@ -154,7 +198,7 @@ wp-release version-check --constant MY_PLUGIN_VERSION --git-tag v1.2.0
 |---|---|---|
 | `--trunk` | off | Sync the full source directory to `trunk/` |
 | `--readme-only` | off | Sync only the readme to `trunk/`, for updates between releases such as bumping `Tested up to`. Can't be combined with `--svn-tag`. |
-| `--svn-tag <version>` | off | Copy `trunk/` to `tags/<version>`. Without `--trunk`, the tag is copied from the repository's current `trunk/`. A leading `v` is stripped, so `v1.2.0` creates `tags/1.2.0`. |
+| `--svn-tag <version>` | off | Create `tags/<version>`. With `--trunk`, the tag is a copy of the synced `trunk/`. Without it, the tag is built directly from the source files and `trunk/` is left alone, for pre-release tags. A leading `v` is stripped, so `v1.2.0` creates `tags/1.2.0`. |
 | `--assets-dir <dir>` | not set | Sync this directory with banners, icons and screenshots to the SVN `assets/` directory. There's no default directory, so assets are only deployed when this is set, and it must exist. |
 | `--no-assets` | | Skip the `--assets-dir` sync for one run, for example when a config always passes `--assets-dir`. |
 
@@ -164,6 +208,9 @@ Typical runs:
 # Deploy 1.2.0 to trunk and the tag, and update the assets
 wp-release deploy-svn dist --trunk --svn-tag 1.2.0 --assets-dir .wordpress-org
 
+# Tag a pre-release build without touching trunk
+wp-release deploy-svn dist --svn-tag 1.2.0-rc.1
+
 # Update only the readme between releases
 wp-release deploy-svn dist --readme-only
 
@@ -177,9 +224,9 @@ wp-release deploy-svn --from-zip my-plugin.1.2.0.zip --trunk --svn-tag 1.2.0
 How a deploy works:
 
 1. The options are validated, including the slug, version and readme name, before they're used in URLs or paths.
-2. With `--trunk`, the files must be a plugin whose `Version` header matches the version, and with `--svn-tag` the readme `Stable tag` must match too. A tag-only run doesn't check the files, since it tags whatever is in `trunk/`. `--readme-only` needs the readme. Nothing is checked out when a check fails.
+2. With `--trunk` or `--svn-tag`, the files must be a plugin whose `Version` header matches the version. When `--trunk` and `--svn-tag` are combined, the readme `Stable tag` must match too; a tag-only run skips that, since a pre-release tag doesn't change the stable tag. `--readme-only` needs the readme. Nothing is checked out when a check fails.
 3. The repository is checked out sparsely into a new temporary directory, with only the directories that the flags write to. A missing `assets/` (or `trunk/`, `tags/`) directory is created. The deploy stops when `tags/<version>` exists, unless `--force` replaces it.
-4. The files are synced in Node.js, without `rsync`: new and changed files are copied, files that are no longer selected are deleted, and `svn add` and `svn delete` stage them, including files that svn ignores by default. `trunk/` is then copied to the tag with `svn copy`, from the working copy when trunk was written and from the repository otherwise.
+4. The files are synced in Node.js, without `rsync`: new and changed files are copied, files that are no longer selected are deleted, and `svn add` and `svn delete` stage them, including files that svn ignores by default. With `--trunk`, `trunk/` is then copied to the tag with `svn copy`. Without it, the same selected files are synced into `tags/<version>` instead, and with `--force` an existing tag is updated to match, deleting files that are no longer in the build.
 5. Asset images get `svn:mime-type` set for PNG, JPEG, GIF and SVG, the formats that WordPress.org documents for plugin assets. Other formats keep the type that svn assigns.
 6. When `svn status` is empty, the deploy ends without a commit. A dry run logs the status and stops before the commit. Otherwise the changes are committed, and the temporary directory is always removed.
 

package/dist/checksums.js

@@ -1,7 +1,7 @@
 import { createReadStream } from 'node:fs';
-import { readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { ValidationError } from "./errors.js";
 import { isErrorCode, selectFiles } from "./file-selection.js";
 export const CHECKSUMS_EXTENSION = '.checksums.json';
@@ -81,6 +81,7 @@ function isPackageType(type) {
  * @throws {ValidationError} If the file exists and force isn't set.
  */
 export async function writeChecksums(path, manifest, force = false) {
+    await mkdir(dirname(path), { recursive: true });
     try {
         await writeFile(path, JSON.stringify(manifest, null, '\t') + '\n', {
             flag: force ? 'w' : 'wx',

package/dist/cli.d.ts

@@ -1,5 +1,9 @@
+import type { ChecksumsResult } from './commands/checksums.ts';
+import type { SignResult } from './commands/sign.ts';
+import type { ZipResult } from './commands/zip.ts';
+import { Logger } from './logger.ts';
 import type { OutputStream } from './logger.ts';
-import type { Command } from './commands/command.ts';
+import type { Command, CommandOutcome } from './commands/command.ts';
 export interface CliIo {
     /** Stream for regular output. */
     stdout?: OutputStream;
@@ -32,6 +36,31 @@ export declare function getCommandHelp(command: Command): string;
  * @return Command definition.
  */
 export declare function findCommand(args: string[]): Command | undefined;
+/**
+ * Results of the commands that can be run with execute(), by command name.
+ */
+export interface CommandResults {
+    zip: ZipResult;
+    checksums: ChecksumsResult;
+    sign: SignResult;
+}
+/**
+ * Run a command by name with the given arguments, for wrappers like the
+ * GitHub Actions that need the result and the thrown errors instead of an
+ * exit code.
+ *
+ * @param  name           Command name, such as zip.
+ * @param  args           Arguments after the command name.
+ * @param  context        Working directory and logger.
+ * @param  context.cwd    Working directory that relative paths resolve against.
+ * @param  context.logger Logger for the command output.
+ * @return Exit code and result of the command.
+ * @throws {Error} If the command is unknown, the arguments are invalid or the command fails.
+ */
+export declare function execute<Name extends keyof CommandResults>(name: Name, args: string[], context: {
+    cwd: string;
+    logger: Logger;
+}): Promise<CommandOutcome<CommandResults[Name]>>;
 /**
  * Run the CLI.
  *

package/dist/cli.js

@@ -1,6 +1,7 @@
 import { parseArgs } from 'node:util';
 import zip from "./commands/zip.js";
 import checksums from "./commands/checksums.js";
+import sign from "./commands/sign.js";
 import verify from "./commands/verify.js";
 import versionCheck from "./commands/version-check.js";
 import deploySvn from "./commands/deploy-svn.js";
@@ -12,6 +13,7 @@ export const EXIT_INVALID = 2;
 export const commands = [
     zip,
     checksums,
+    sign,
     verify,
     versionCheck,
     deploySvn,
@@ -135,6 +137,36 @@ async function runCommand(command, args, io) {
         return getErrorExitCode(error);
     }
 }
+/**
+ * Run a command by name with the given arguments, for wrappers like the
+ * GitHub Actions that need the result and the thrown errors instead of an
+ * exit code.
+ *
+ * @param  name           Command name, such as zip.
+ * @param  args           Arguments after the command name.
+ * @param  context        Working directory and logger.
+ * @param  context.cwd    Working directory that relative paths resolve against.
+ * @param  context.logger Logger for the command output.
+ * @return Exit code and result of the command.
+ * @throws {Error} If the command is unknown, the arguments are invalid or the command fails.
+ */
+export async function execute(name, args, context) {
+    const command = commands.find(({ name: commandName }) => name === commandName);
+    if (!command) {
+        throw new Error(`Unknown command "${name}".`);
+    }
+    const { values, positionals } = parseArgs({
+        args,
+        options: command.options,
+        allowPositionals: true,
+    });
+    // The command table is keyed by name, so the result matches CommandResults.
+    return command.run({
+        values,
+        positionals,
+        ...context,
+    });
+}
 /**
  * Run the CLI.
  *

package/dist/commands/args.d.ts

@@ -49,6 +49,16 @@ export declare function isDirectory(path: string): Promise<boolean>;
  * @return The same matcher.
  */
 export declare function ignoreOwnFile(rules: FileRules, sourceDir: string, path: string): FileRules;
+/**
+ * Ignore the signature file that "wp-release sign" writes next to a file the
+ * command writes, when it's inside the selected directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute path of the signed file.
+ * @return The same matcher.
+ */
+export declare function ignoreOwnSignature(rules: FileRules, sourceDir: string, path: string): FileRules;
 /**
  * Option for the source directory, which can also be the first positional
  * argument.

package/dist/commands/args.js

@@ -1,6 +1,7 @@
 import { stat } from 'node:fs/promises';
 import { isAbsolute, relative, resolve } from 'node:path';
 import { ValidationError } from "../errors.js";
+import { SIGNATURE_EXTENSION } from "../signing.js";
 import { getBoolean, getString, getStrings } from "./command.js";
 /**
  * Options shared by the commands that select files with .distignore and
@@ -81,6 +82,18 @@ export function ignoreOwnFile(rules, sourceDir, path) {
     }
     return rules;
 }
+/**
+ * Ignore the signature file that "wp-release sign" writes next to a file the
+ * command writes, when it's inside the selected directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute path of the signed file.
+ * @return The same matcher.
+ */
+export function ignoreOwnSignature(rules, sourceDir, path) {
+    return ignoreOwnFile(rules, sourceDir, path + SIGNATURE_EXTENSION);
+}
 /**
  * Option for the source directory, which can also be the first positional
  * argument.

package/dist/commands/checksums.d.ts

@@ -1,3 +1,11 @@
+import type { CommandOutcome } from './command.ts';
+/** Result of the checksums command. */
+export interface ChecksumsResult {
+    /** Absolute path of the manifest. */
+    checksumsPath: string;
+    /** Number of hashed files. */
+    files: number;
+}
 declare const _default: {
     name: string;
     usage: string;
@@ -23,12 +31,6 @@ declare const _default: {
             type: "string";
         };
     };
-    run({ values, positionals, cwd, logger }: import("./command.ts").CommandContext): Promise<{
-        exitCode: number;
-        result: {
-            checksumsPath: string;
-            files: number;
-        };
-    }>;
+    run({ values, positionals, cwd, logger, }: import("./command.ts").CommandContext): Promise<CommandOutcome<ChecksumsResult>>;
 };
 export default _default;

package/dist/commands/checksums.js

@@ -3,7 +3,7 @@ import { CHECKSUMS_EXTENSION, createChecksums, writeChecksums, } from "../checks
 import { loadFileRules, resolveFileSelection } from "../file-selection.js";
 import { FILENAME_FORMAT, formatFilename } from "../filename.js";
 import { readPackageMeta } from "../package-meta.js";
-import { checkDirectory, fileSelectionArgs, getFileSelectionInput, getSourceDirArg, ignoreOwnFile, resolveOutput, sourceDirArgs, } from "./args.js";
+import { checkDirectory, fileSelectionArgs, getFileSelectionInput, getSourceDirArg, ignoreOwnFile, ignoreOwnSignature, resolveOutput, sourceDirArgs, } from "./args.js";
 import { getBoolean, getString } from "./command.js";
 export default {
     name: 'checksums',
@@ -42,7 +42,7 @@ matches the ZIP contents.`,
         ...fileSelectionArgs,
         force: { type: 'boolean' },
     },
-    async run({ values, positionals, cwd, logger }) {
+    async run({ values, positionals, cwd, logger, }) {
         const sourceDir = resolve(cwd, getSourceDirArg(values, positionals));
         const slug = getString(values, 'slug') ?? basename(cwd);
         await checkDirectory(sourceDir);
@@ -59,7 +59,7 @@ matches the ZIP contents.`,
             sourceDir,
             ...getFileSelectionInput(values),
         });
-        const rules = ignoreOwnFile(await loadFileRules(selection), sourceDir, checksumsPath);
+        const rules = ignoreOwnSignature(ignoreOwnFile(await loadFileRules(selection), sourceDir, checksumsPath), sourceDir, checksumsPath);
         const manifest = await createChecksums({
             sourceDir,
             rules,

package/dist/commands/command.d.ts

@@ -14,11 +14,11 @@ export interface CommandContext {
     /** Logger for the command output. */
     logger: Logger;
 }
-export interface CommandOutcome {
+export interface CommandOutcome<Result = unknown> {
     /** Process exit code. */
     exitCode: number;
     /** Result printed with --json. */
-    result: unknown;
+    result: Result;
 }
 /**
  * CLI command definition.

package/dist/commands/deploy-svn.js

@@ -44,8 +44,9 @@ export default {
 Writes (none by default, assets only with --assets-dir):
   --trunk                 Sync the full source directory to trunk/
   --readme-only           Sync only the readme to trunk/ (not with --svn-tag)
-  --svn-tag <version>     Copy trunk/ to tags/<version>, with or without
-                          --trunk. A leading "v" is stripped.
+  --svn-tag <version>     Create tags/<version>: a copy of trunk/ with --trunk,
+                          otherwise from the source files, leaving trunk/
+                          alone. A leading "v" is stripped.
   --assets-dir <dir>      Sync this directory with banners, icons and
                           screenshots to assets/
   --no-assets             Don't sync --assets-dir for this run
@@ -72,6 +73,8 @@ or rejected.
 Examples:
   wp-release deploy-svn dist --trunk --svn-tag 1.2.0 --assets-dir .wordpress-org
       Deploy 1.2.0 to trunk and the tag, and update the assets
+  wp-release deploy-svn dist --svn-tag 1.2.0-rc.1
+      Tag a pre-release build without touching trunk
   wp-release deploy-svn dist --readme-only
       Update only the readme
   wp-release deploy-svn --assets-dir .wordpress-org

package/dist/commands/sign.d.ts

@@ -0,0 +1,21 @@
+import type { CommandOutcome } from './command.ts';
+/** Result of the sign command. */
+export interface SignResult {
+    /** Absolute paths of the written .sig files. */
+    signatures: string[];
+    /** Base64 public key of the signing key. */
+    publicKey: string;
+}
+declare const _default: {
+    name: string;
+    usage: string;
+    summary: string;
+    help: string;
+    options: {
+        force: {
+            type: "boolean";
+        };
+    };
+    run({ values, positionals, cwd, logger, }: import("./command.ts").CommandContext): Promise<CommandOutcome<SignResult>>;
+};
+export default _default;

package/dist/commands/sign.js

@@ -0,0 +1,55 @@
+import { resolve } from 'node:path';
+import { stat } from 'node:fs/promises';
+import { ValidationError } from "../errors.js";
+import { SIGNING_KEY_ENV, getPublicKey, parseSigningKey, writeSignature, } from "../signing.js";
+import { getBoolean } from "./command.js";
+export default {
+    name: 'sign',
+    usage: 'sign <file>... [options]',
+    summary: 'Sign files with Ed25519, writing a detached <file>.sig next to each.',
+    help: `Arguments:
+  <file>...               Files to sign, such as the ZIP and the checksums
+                          manifest
+
+Options:
+  --force                 Overwrite existing .sig files
+
+The signing key is read from the ${SIGNING_KEY_ENV} environment variable, as a
+base64 32-byte Ed25519 seed or 64-byte libsodium secret key. There's no flag
+for it, since it would show in the process list.
+
+The signature is the one WordPress core's verify_file_signature() checks: a
+base64 Ed25519 signature of the raw SHA-384 digest of the file. Sign both
+the ZIP and the checksums manifest. Use --verbose to print the public key
+that belongs to the signing key.`,
+    options: {
+        force: { type: 'boolean' },
+    },
+    async run({ values, positionals, cwd, logger, }) {
+        const encoded = process.env[SIGNING_KEY_ENV];
+        if (!positionals.length) {
+            throw new ValidationError('Pass the files to sign.');
+        }
+        if (!encoded?.trim()) {
+            throw new ValidationError(`Set the ${SIGNING_KEY_ENV} environment variable to the base64 Ed25519 signing key.`);
+        }
+        const privateKey = parseSigningKey(encoded);
+        const publicKey = getPublicKey(privateKey);
+        const paths = positionals.map((file) => resolve(cwd, file));
+        await Promise.all(paths.map(async (path) => {
+            if (!(await stat(path).catch(() => null))?.isFile()) {
+                throw new ValidationError(`${path} is not a file.`);
+            }
+        }));
+        logger.debug(`Signing with the public key ${publicKey}.`);
+        const signatures = [];
+        const force = getBoolean(values, 'force');
+        // Sign in order, so that a failure leaves a predictable set of files.
+        for (const path of paths) {
+            const signaturePath = await writeSignature(path, privateKey, force);
+            logger.info(signaturePath);
+            signatures.push(signaturePath);
+        }
+        return { exitCode: 0, result: { signatures, publicKey } };
+    },
+};

package/dist/commands/verify.d.ts

@@ -1,3 +1,4 @@
+import type { CommandOutcome } from './command.ts';
 declare const _default: {
     name: string;
     usage: string;
@@ -11,17 +12,19 @@ declare const _default: {
         checksums: {
             type: "string";
         };
-    };
-    run({ values, positionals, cwd, logger }: import("./command.ts").CommandContext): Promise<{
-        exitCode: number;
-        result: {
-            valid: boolean;
-            checksumsPath: string;
-            matched: number;
-            changed: string[];
-            missing: string[];
-            extra: string[];
+        zip: {
+            type: "string";
         };
-    }>;
+        'root-folder': {
+            type: "string";
+        };
+        embedded: {
+            type: "string";
+        };
+        'public-key': {
+            type: "string";
+        };
+    };
+    run({ values, positionals, cwd, logger }: import("./command.ts").CommandContext): Promise<CommandOutcome<unknown>>;
 };
 export default _default;