@wpelevator/wp-release 0.4.0 → 0.4.1

package/README.md

@@ -134,7 +134,7 @@ wp-release verify wp-content/plugins/my-plugin --checksums my-plugin.1.2.0.check
 - Manifest paths outside the package folder (absolute or with `..`) are rejected.
 - `--zip <file|url>` checks the files of a ZIP instead of a directory. The ZIP can be a URL, such as the one that WordPress.org builds for a release, and its single root folder is found automatically (or set `--root-folder`). The ZIP is extracted to a temporary directory after the same safety checks as `deploy-svn --from-zip`.
 - The version in the manifest must match the `Version` header of the checked files, so that an older release with its own valid manifest can't pass as a newer one.
-- A manifest can't list itself. A copy of the manifest and of its `.sig` inside the checked files, at the root with the same names as the `--checksums` file or at the path of `--embedded`, is skipped when comparing files, but it must be identical to the `--checksums` file. See [Manifest inside the plugin](#manifest-inside-the-plugin).
+- A manifest can't list itself. A copy of the manifest and of its `.sig` inside the checked files, at the root with the same names as the `--checksums` file or at the path of `--embedded`, is skipped when comparing files, but it must be identical to the `--checksums` file and its `.sig`. A path that the manifest lists is never skipped, and a file that isn't a matching copy is reported as not in the checksums. See [Manifest inside the plugin](#manifest-inside-the-plugin).
 
 A checksums manifest proves only that the files match the manifest. With `--public-key <key>`, `verify` first checks `<checksums>.sig` against the base64 Ed25519 public key and fails with exit code `2` before comparing any file when the signature is missing or invalid, so that the manifest itself can be trusted. See [Sign](#sign).
 
@@ -158,7 +158,7 @@ wp-release deploy-svn build --trunk --svn-tag 1.2.0
     --checksums build/checksums.json --public-key "$PUBLIC_KEY"
   ```
 
-- The manifest can have any name and location, for example `--output build/includes/signatures/checksums.json`, and missing folders are created. Tell `verify` where the shipped copy is with `--embedded <path>`, like `--embedded includes/signatures/checksums.json`. The copy and its `.sig` are then skipped when comparing files, must exist, and must be identical to the `--checksums` file and its signature. Without `--embedded`, `verify` looks for the manifest name at the root and only checks it when it's there.
+- The manifest can have any name and location, for example `--output build/includes/signatures/checksums.json`, and missing folders are created. Tell `verify` where the shipped copy is with `--embedded <path>`, like `--embedded includes/signatures/checksums.json`. Both the `--checksums` file and its `.sig` must then exist, both copies must be shipped, and they're skipped when comparing files and must be identical to the originals. The manifest can't list the embedded path. Without `--embedded`, `verify` looks for the manifest name at the root, and skips a file only when it exists, the matching original exists and the manifest doesn't list it. Otherwise it's checked like any other file, so a listed file that has the name of the manifest can't be deleted unnoticed, and a shipped `.sig` without an original is reported as not in the checksums.
 
 The public key has to come from somewhere other than the plugin that it checks, because someone who can overwrite the plugin files can also replace a key and a signature inside them. A copy of the manifest also doesn't prevent a downgrade to an older release that was signed too, so the installing side has to enforce a minimum version.
 

package/dist/commands/verify.js

@@ -99,33 +99,20 @@ function getEmbeddedPath(checksumsPath, embedded) {
         (isAbsolute(embedded) ||
             embedded.includes('\\') ||
             path.startsWith('../') ||
-            '.' === path)) {
+            ['.', '..'].includes(path))) {
         throw new ValidationError(`--embedded must be a path inside the plugin with forward slashes, got "${embedded}".`);
     }
     return embedded || path.endsWith('.json') ? path : null;
 }
 /**
- * Compare the copies of the manifest and its signature inside the checked
- * directory with the given ones. A release that ships the manifest and its
- * signature with the plugin files must ship the same bytes that were
- * signed, otherwise a verifier on the site would check something else. The
- * copies are not part of the manifest, since a manifest can't list itself,
- * so they're skipped when comparing the files.
- *
- * Without an explicit path, the copies are expected at the root with the
- * name of the manifest, and are checked only when they exist. With an
- * explicit path they must exist.
+ * Get the manifest and signature pairs to look for inside the checked files.
  *
- * @param input               Directory, manifest and embedded path.
- * @param input.dir           Directory to check.
- * @param input.checksumsPath Manifest path.
- * @param input.embedded      Explicit path of the embedded manifest.
- * @return The copies that were found to differ or be missing, and their paths.
+ * @param checksumsPath Manifest path.
+ * @param path          Relative path of the embedded manifest, if any.
+ * @return Pairs of the originals and their copies.
  */
-async function checkEmbeddedCopies(input) {
-    const { dir, checksumsPath, embedded } = input;
-    const path = getEmbeddedPath(checksumsPath, embedded);
-    const pairs = path
+function getCopyPairs(checksumsPath, path) {
+    return path
         ? [
             { original: checksumsPath, copy: path },
             {
@@ -134,28 +121,82 @@ async function checkEmbeddedCopies(input) {
             },
         ]
         : [];
-    const results = await Promise.all(pairs.map(async ({ original, copy }) => {
-        const file = join(dir, copy);
-        const hasCopy = existsSync(file);
-        const hasOriginal = existsSync(original);
-        const isSame = !hasCopy ||
-            !hasOriginal ||
-            resolve(original) === resolve(file) ||
-            (await readFile(original)).equals(await readFile(file));
-        return {
-            copy,
-            missing: Boolean(embedded) && hasOriginal && !hasCopy,
-            differing: !isSame,
-        };
-    }));
+}
+/**
+ * Check that an explicit --embedded path can be verified: the manifest can't
+ * list its own copies, and the originals to compare with must exist.
+ *
+ * @param  pairs    Pairs of the originals and their copies.
+ * @param  manifest Checksums manifest.
+ * @throws {ValidationError} If a copy is listed or an original is missing.
+ */
+function checkExplicitPairs(pairs, manifest) {
+    pairs.forEach(({ original, copy }) => {
+        if (Object.hasOwn(manifest.files, copy)) {
+            throw new ValidationError(`The checksums list ${copy}, but a manifest can't list its own embedded copy.`);
+        }
+        if (!existsSync(original)) {
+            throw new ValidationError(`--embedded needs ${original} to compare ${copy} with, but it doesn't exist.`);
+        }
+    });
+}
+/**
+ * Check that two paths are the same file or have the same bytes.
+ *
+ * @param original Path of the original.
+ * @param file     Path of the copy.
+ * @return Whether the contents are identical.
+ */
+async function hasSameContents(original, file) {
+    return (resolve(original) === resolve(file) ||
+        (await readFile(original)).equals(await readFile(file)));
+}
+/**
+ * Compare the copies of the manifest and its signature inside the checked
+ * directory with the given ones. A release that ships the manifest and its
+ * signature with the plugin files must ship the same bytes that were
+ * signed, otherwise a verifier on the site would check something else. The
+ * copies are not part of the manifest, since a manifest can't list itself,
+ * so they're skipped when comparing the files.
+ *
+ * With an explicit path both originals and both copies must exist. Without
+ * one, the copies are expected at the root with the name of the manifest,
+ * and a file is treated as a copy only when it exists, the matching
+ * original exists and the manifest doesn't list it. Any other file is
+ * checked like the rest of the files.
+ *
+ * @param  input               Directory, manifest and embedded path.
+ * @param  input.dir           Directory to check.
+ * @param  input.manifest      Checksums manifest.
+ * @param  input.checksumsPath Manifest path.
+ * @param  input.embedded      Explicit path of the embedded manifest.
+ * @return The copies that were found to differ or be missing, and the paths of the existing copies.
+ * @throws {ValidationError} If an explicit path can't be verified.
+ */
+async function checkEmbeddedCopies(input) {
+    const { dir, manifest, checksumsPath, embedded } = input;
+    const pairs = getCopyPairs(checksumsPath, getEmbeddedPath(checksumsPath, embedded));
+    if (embedded) {
+        checkExplicitPairs(pairs, manifest);
+    }
+    const found = pairs.filter(({ original, copy }) => existsSync(join(dir, copy)) &&
+        (embedded ||
+            (existsSync(original) &&
+                !Object.hasOwn(manifest.files, copy))));
+    const results = await Promise.all(found.map(async ({ original, copy }) => ({
+        copy,
+        isSame: await hasSameContents(original, join(dir, copy)),
+    })));
     return {
-        paths: pairs.map(({ copy }) => copy),
+        paths: found.map(({ copy }) => copy),
         differing: results
-            .filter((result) => result.differing)
-            .map((result) => result.copy),
-        missing: results
-            .filter((result) => result.missing)
-            .map((result) => result.copy),
+            .filter(({ isSame }) => !isSame)
+            .map(({ copy }) => copy),
+        missing: embedded
+            ? pairs
+                .filter(({ copy }) => !existsSync(join(dir, copy)))
+                .map(({ copy }) => copy)
+            : [],
     };
 }
 /**
@@ -193,6 +234,7 @@ async function verifyTarget(input) {
     const { dir } = target;
     const copies = await checkEmbeddedCopies({
         dir,
+        manifest,
         checksumsPath,
         embedded,
     });
@@ -248,11 +290,13 @@ Options:
   --root-folder <name>    Folder in the ZIP (default: the one folder that
                           every entry is in)
   --embedded <path>       Where the manifest and its .sig are shipped inside the
-                          files, like includes/checksums.json (default: the
-                          name of the --checksums file at the root, when it
-                          exists). They're skipped when comparing files and
-                          must be identical to the --checksums file and its
-                          .sig, and with this option they must exist
+                          files, like includes/checksums.json. Both the
+                          --checksums file and its .sig must exist, both
+                          copies must be shipped, and they must be identical
+                          to them. Without this option, a file with the name
+                          of the --checksums file at the root (and its .sig)
+                          is a copy only when it exists, the matching original
+                          exists and the manifest doesn't list it
   --public-key <key>      Base64 Ed25519 public key. Checks <checksums>.sig, as
                           written by "wp-release sign", before comparing any
                           file, and fails when it's missing or invalid
@@ -270,7 +314,9 @@ ignore file inside the checked directory can't hide added files. Use
 
 A manifest can't list itself. A copy of the manifest and of its .sig inside
 the checked files is therefore skipped, but it must be identical to the
---checksums file. See --embedded for where it's looked for.`,
+--checksums file. A path that the manifest lists is never skipped, and a
+file that isn't a matching copy is reported as extra. See --embedded for
+where the copies are looked for.`,
     options: {
         checksums: { type: 'string' },
         zip: { type: 'string' },

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@wpelevator/wp-release",
-	"version": "0.4.0",
+	"version": "0.4.1",
 	"description": "Package, checksum, sign, verify and version-check WordPress plugins and themes, and deploy plugins to WordPress.org SVN",
 	"license": "MIT",
 	"repository": {