fhirsmith 0.18.1 → 1.0.0

package/packages/packages.js

@@ -17,11 +17,16 @@ const Logger = require('../library/logger');
 const {validateParameter, Utilities} = require("../library/utilities");
 const {describeCron} = require("../library/cron-utilities");
 const {tokenMatches, tokenConfigured} = require("../library/request-token");
+const { guarded } = require('../library/sqlite-utilities');
 const pckLog = Logger.getInstance().child({ module: 'packages' });
 const packagesOpenApi = require('./openapi');
 const rateLimit = require('express-rate-limit');
 const { runNpmCheck, makeGetter } = require('./npm-check');
 const npmCheckPage = require('./npm-check-page');
+const { FeedCheck } = require('./feed-check');
+const feedCheckPage = require('./feed-check-page');
+const crypto = require('crypto');
+const { NpmSigner, integrityOf } = require('./npm-signing');
 
 // Query parameter rules for validateQueryParams. These are also the contract published in
 // openapi.yaml, and tests/packages/openapi.test.js checks that the two agree - so change
@@ -101,6 +106,25 @@ const NPM_CHECK_DEFAULTS = {
 };
 const NPM_CHECK_CONTROL_MAX_AGE = 24 * 60 * 60 * 1000;
 
+// GET /feed-check: check a package feed as the crawler reads it, storing nothing (also in openapi.yaml)
+const FEED_CHECK_PARAMS = {
+  url: { maxLength: 500, pattern: /^https?:\/\/[^\s<>"'`]+$/ },
+  // the feed's signing keys, as JSON: package-feeds.json's signing block ({required, keys}), or a
+  // whole feed entry with one. Used instead of what the registry lists for the feed
+  signing: { maxLength: 5000, pattern: /^[^<>`]*$/ }
+};
+// feed-check defaults; all can be set under modules.packages.feedCheck in the config. Only one
+// check runs at a time, across all users
+const FEED_CHECK_DEFAULTS = {
+  enabled: true,
+  maxItems: 50, // items checked per run (each one's package is downloaded)
+  maxTotalMB: 500, // downloaded per run; later items are reported but not downloaded
+  keepMinutes: 60 // how long a run's report can be fetched
+};
+const FEED_CHECK_MAX_JOBS = 100;
+const FEED_CHECK_JOB_PATTERN = /^[0-9a-f]{24}$/;
+const MASTER_LIST_MAX_AGE = 60 * 60 * 1000;
+
 // The query string of a request, for logging (the parameters were validated before the handler runs)
 function queryString(req) {
   const i = req.originalUrl.indexOf('?');
@@ -115,6 +139,60 @@ const TARBALL_HEADER = 'FHIR-Package-Download';
 // Each id#version is stored once (see PackageCrawler.checkVersion)
 const UNIQUE_ID_VERSION_INDEX = 'CREATE UNIQUE INDEX SK_PackageVersions_IdVersion ON PackageVersions (Id, Version)';
 
+// Each version's dist.integrity and npm registry signature (see npm-signing.js), kept apart
+// from PackageVersions so reading them doesn't mean reading the tarball (Content)
+const PACKAGE_DIST_TABLE = `CREATE TABLE IF NOT EXISTS PackageDist
+         (
+             PackageVersionKey INTEGER PRIMARY KEY,
+             Integrity         TEXT NOT NULL,
+             KeyId             TEXT,
+             Signature         TEXT
+         )`;
+const DEFAULT_SIGNING_KEY_FILE = 'npm-signing-key.pem';
+
+// Publishers' signatures of the packages (fhir:signature in their feeds), kept as they were when
+// the crawler checked them - valid or not - with the outcome (see PackageCrawler.signingFor)
+const PACKAGE_SIGNATURES_TABLE = `CREATE TABLE IF NOT EXISTS PackageSignatures
+         (
+             PackageVersionKey INTEGER PRIMARY KEY,
+             Url               TEXT NOT NULL,
+             KeyId             TEXT,
+             Valid             INTEGER NOT NULL,
+             Message           TEXT,
+             Checked           TEXT NOT NULL,
+             Bundle            TEXT NOT NULL
+         )`;
+
+// The signing information a user gives the feed check: package-feeds.json's signing block
+// ({required, keys: [{keyid, key, expires}]}), or a feed entry that has one. Throws if unusable.
+function parseSigningJson(text) {
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch (e) {
+    throw new Error(`it isn't JSON (${e.message})`);
+  }
+  const block = json && typeof json === 'object' && json.signing && typeof json.signing === 'object' ? json.signing : json;
+  if (!block || typeof block !== 'object' || !Array.isArray(block.keys) || block.keys.length === 0) {
+    throw new Error('it needs a keys array, as in package-feeds.json\'s signing block');
+  }
+  const keys = block.keys.map((k, i) => {
+    if (!k || typeof k.keyid !== 'string' || typeof k.key !== 'string') {
+      throw new Error(`keys[${i}] needs a keyid and a key`);
+    }
+    try {
+      crypto.createPublicKey({key: Buffer.from(k.key, 'base64'), format: 'der', type: 'spki'});
+    } catch (e) {
+      throw new Error(`keys[${i}].key isn't a base64 public key (SubjectPublicKeyInfo)`);
+    }
+    if (k.expires !== undefined && k.expires !== null && Number.isNaN(Date.parse(k.expires))) {
+      throw new Error(`keys[${i}].expires isn't a date`);
+    }
+    return {keyid: k.keyid, key: k.key, expires: k.expires || null};
+  });
+  return {required: block.required === true, keys};
+}
+
 class PackagesModule {
   constructor(stats) {
     this.router = express.Router();
@@ -126,6 +204,15 @@ class PackagesModule {
     this.totalRuns = 0;
     this.lastCrawlerLog = {};
     this.crawlerRunning = false;
+    // npm registry signatures: the key (null when this server doesn't sign), and the
+    // background job that fills in PackageDist for versions stored without it
+    this.signer = null;
+    // feed checks (/feed-check): id -> {id, url, state, report, error, started, ip}
+    this.feedCheckJobs = new Map();
+    this.feedCheckRunning = false;
+    this.distStatus = { state: 'not started', missing: null, done: 0, failed: 0 };
+    this.distBackfill = null;
+    this.stopping = false;
     this.setupSecurityMiddleware();
     this.setupRoutes();
     this.stats = stats;
@@ -365,7 +452,7 @@ class PackagesModule {
 
         const { query, params: queryParams } = this.buildSecureQuery(baseQuery, conditions);
 
-        this.db.all(query + ' ORDER BY PubDate', queryParams, (err, rows) => {
+        this.db.all(query + ' ORDER BY PubDate', queryParams, guarded(reject, (err, rows) => {
           if (err) {
             reject(err);
             return;
@@ -399,7 +486,7 @@ class PackagesModule {
           });
 
           resolve(this.applySorting(results, sort));
-        });
+        }));
       } catch (error) {
         reject(error);
       }
@@ -503,6 +590,14 @@ class PackagesModule {
   }
 
   async gatherPackageStatistics() {
+    const stats = await this.gatherPackageCounts();
+    // the nav bar offers the feed check only where it's turned on
+    stats.feedCheckLink = this.feedCheckConfig().enabled
+      ? '<a href="/packages/feed-check" style="color: gold">Feed Check</a>  &nbsp;|&nbsp;' : '';
+    return stats;
+  }
+
+  async gatherPackageCounts() {
     try {
       // Get database age info
       const dbAge = this.getDatabaseAgeInfo();
@@ -577,7 +672,7 @@ class PackagesModule {
   }
 
   async getDatabaseTableCounts() {
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
       if (!this.db) {
         resolve({packages: 0, packageVersions: 0});
         return;
@@ -587,7 +682,7 @@ class PackagesModule {
       let completedQueries = 0;
       const totalQueries = 2;
 
-      this.db.get('SELECT COUNT(*) as count FROM Packages', [], (err, row) => {
+      this.db.get('SELECT COUNT(*) as count FROM Packages', [], guarded(reject, (err, row) => {
         if (err) {
           counts.packages = 0;
         } else {
@@ -598,9 +693,9 @@ class PackagesModule {
         if (completedQueries === totalQueries) {
           resolve(counts);
         }
-      });
+      }));
 
-      this.db.get('SELECT COUNT(*) as count FROM PackageVersions', [], (err, row) => {
+      this.db.get('SELECT COUNT(*) as count FROM PackageVersions', [], guarded(reject, (err, row) => {
         if (err) {
           counts.packageVersions = 0;
         } else {
@@ -611,7 +706,7 @@ class PackagesModule {
         if (completedQueries === totalQueries) {
           resolve(counts);
         }
-      });
+      }));
     });
   }
 
@@ -673,12 +768,25 @@ class PackagesModule {
 
     // Initialize database
     await this.initializeDatabase();
+    await this.dbRun(PACKAGE_DIST_TABLE);
+    await this.dbRun(PACKAGE_SIGNATURES_TABLE);
 
     // Ensure mirror directory exists
     await this.ensureMirrorDirectory();
 
+    // npm registry signatures: on unless turned off
+    if (this.config.npmSigning?.enabled !== false) {
+      this.signer = NpmSigner.load(this.getSigningKeyPath(), pckLog);
+      pckLog.info(`Signing packages with npm key ${this.signer.keyid}`);
+    }
+
     // Initialize the crawler
     this.crawler = new PackageCrawler(this.config, this.db, this.stats);
+    this.crawler.signer = this.signer;
+
+    // Versions stored without dist.integrity or a signature by this key get them in the
+    // background; /-/npm/v1/keys is a 404 until they all have them
+    this.startDistBackfill();
 
     // Start the hourly web crawler if enabled
     if (config.crawler.enabled) {
@@ -712,9 +820,137 @@ class PackagesModule {
       }
     } finally {
       this.crawlerRunning = false;
+      // if the backfill couldn't finish (a crawl's transaction rolled back one of its
+      // writes, say), it tries again
+      if (this.distStatus.state === 'incomplete') {
+        this.startDistBackfill();
+      }
     }
   }
 
+  // The signing key file: npmSigning.keyFile, relative to the database's folder
+  getSigningKeyPath() {
+    const file = this.config.npmSigning?.keyFile || DEFAULT_SIGNING_KEY_FILE;
+    return path.isAbsolute(file) ? file : path.join(path.dirname(this.getDatabasePath()), file);
+  }
+
+  dbRun(sql, params = []) {
+    return new Promise((resolve, reject) => {
+      this.db.run(sql, params, guarded(reject, function (err) {
+        if (err) {
+          reject(err);
+        } else {
+          resolve(this);
+        }
+      }));
+    });
+  }
+
+  dbAll(sql, params = []) {
+    return new Promise((resolve, reject) => {
+      this.db.all(sql, params, guarded(reject, (err, rows) => err ? reject(err) : resolve(rows)));
+    });
+  }
+
+  dbGet(sql, params = []) {
+    return new Promise((resolve, reject) => {
+      this.db.get(sql, params, guarded(reject, (err, row) => err ? reject(err) : resolve(row)));
+    });
+  }
+
+  // Starts the background job that fills in PackageDist, unless it is already running.
+  // Returns its promise.
+  startDistBackfill() {
+    if (!this.distBackfill) {
+      this.distBackfill = this.runDistBackfill()
+        .catch(e => {
+          this.distStatus.state = 'incomplete';
+          pckLog.error('Adding npm integrity and signatures failed: ' + e.message);
+        })
+        .finally(() => {
+          this.distBackfill = null;
+        });
+    }
+    return this.distBackfill;
+  }
+
+  // The keys of versions with no PackageDist row, or (when signing) one not signed by this key
+  async versionsMissingDist() {
+    const sql = `SELECT v.PackageVersionKey AS k, d.Integrity AS Integrity
+                 FROM PackageVersions v LEFT JOIN PackageDist d ON d.PackageVersionKey = v.PackageVersionKey
+                 WHERE d.PackageVersionKey IS NULL` + (this.signer ? ' OR d.KeyId IS NOT ?' : '') + `
+                 ORDER BY v.PackageVersionKey`;
+    return this.dbAll(sql, this.signer ? [this.signer.keyid] : []);
+  }
+
+  // Gives every version its dist.integrity, and its signature when this server signs: the
+  // versions stored before this server did, or signed with an earlier key. A row at a time,
+  // in the background, so the server serves meanwhile; a large tarball is hashed in slices.
+  async runDistBackfill() {
+    // rows for versions that are gone (packages/utilities/dedupe-versions.js deletes versions)
+    await this.dbRun('DELETE FROM PackageDist WHERE PackageVersionKey NOT IN (SELECT PackageVersionKey FROM PackageVersions)');
+    await this.dbRun('DELETE FROM PackageSignatures WHERE PackageVersionKey NOT IN (SELECT PackageVersionKey FROM PackageVersions)');
+    const todo = await this.versionsMissingDist();
+    this.distStatus = { state: 'running', missing: todo.length, done: 0, failed: 0 };
+    const what = this.signer ? 'npm integrity and signatures' : 'npm integrity';
+    if (todo.length > 0) {
+      pckLog.info(`Adding ${what} to ${todo.length} package versions, in the background`);
+    }
+    for (const row of todo) {
+      if (this.stopping) {
+        this.distStatus.state = 'stopped';
+        return;
+      }
+      try {
+        await this.fillDist(row.k, row.Integrity);
+        this.distStatus.done++;
+      } catch (e) {
+        this.distStatus.failed++;
+        pckLog.error(`Adding ${what} to package version ${row.k} failed: ${e.message}`);
+      }
+      if (this.distStatus.done % 1000 === 0 && this.distStatus.done > 0) {
+        pckLog.info(`Added ${what} to ${this.distStatus.done} of ${todo.length} package versions`);
+      }
+      await new Promise(resolve => setImmediate(resolve));
+    }
+    // Something stored meanwhile is done by the crawler, but a write here can be lost (it
+    // joins a crawl's transaction, and that rolls back), so count again
+    const left = todo.length === 0 ? 0 : (await this.versionsMissingDist()).length;
+    this.distStatus.missing = left;
+    this.distStatus.state = left === 0 ? 'complete' : 'incomplete';
+    if (todo.length > 0) {
+      if (left === 0) {
+        pckLog.info(`Added ${what} to every package version`);
+      } else {
+        pckLog.warn(`${left} package versions still have no ${what}; trying again after the next crawl`);
+      }
+    }
+  }
+
+  // integrity is the stored one, when only the signature is missing
+  async fillDist(key, integrity) {
+    let hash = null;
+    if (!integrity) {
+      const row = await this.dbGet('SELECT Content, Hash FROM PackageVersions WHERE PackageVersionKey = ?', [key]);
+      if (!row) {
+        return; // deleted meanwhile
+      }
+      integrity = await integrityOf(row.Content);
+      hash = row.Hash;
+    }
+    const v = await this.dbGet('SELECT Id, Version, Hash FROM PackageVersions WHERE PackageVersionKey = ?', [key]);
+    if (!v) {
+      return;
+    }
+    const keyid = this.signer ? this.signer.keyid : null;
+    const sig = this.signer ? this.signer.sign(v.Id, v.Version, integrity) : null;
+    // Only if the tarball is still the one hashed: the crawler may have replaced it meanwhile
+    // (and then it wrote this row itself)
+    await this.dbRun(`INSERT OR REPLACE INTO PackageDist (PackageVersionKey, Integrity, KeyId, Signature)
+                      SELECT ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM PackageVersions WHERE PackageVersionKey = ? AND Hash = ?)`,
+      [key, integrity, keyid, sig, key, hash || v.Hash]);
+  }
+
   async initializeDatabase() {
     return new Promise((resolve, reject) => {
       // Use config path if absolute, otherwise resolve relative to data dir
@@ -744,14 +980,14 @@ class PackagesModule {
             this.db.run(`CREATE TABLE IF NOT EXISTS FeedPages (
               Url TEXT PRIMARY KEY,
               VisitedAt TEXT NOT NULL
-            )`, (err) => {
+            )`, guarded(reject, (err) => {
               if (err) pckLog.error('Failed to create FeedPages table:', err.message);
-            });
+            }));
             // Fails while the database still holds duplicate id#version rows (from before the
             // crawler checked for them): packages/utilities/dedupe-versions.js removes them
-            this.db.run(UNIQUE_ID_VERSION_INDEX.replace('CREATE UNIQUE INDEX', 'CREATE UNIQUE INDEX IF NOT EXISTS'), (err) => {
+            this.db.run(UNIQUE_ID_VERSION_INDEX.replace('CREATE UNIQUE INDEX', 'CREATE UNIQUE INDEX IF NOT EXISTS'), guarded(reject, (err) => {
               if (err) pckLog.warn('PackageVersions has duplicate id#version rows, so they are not yet unique; run packages/utilities/dedupe-versions.js: ' + err.message);
-            });
+            }));
             resolve();
           }
         }
@@ -834,7 +1070,13 @@ class PackagesModule {
          (
              Url       TEXT PRIMARY KEY,
              VisitedAt TEXT NOT NULL
-         )`
+         )`,
+
+        // PackageDist table - each version's dist.integrity and npm signature
+        PACKAGE_DIST_TABLE,
+
+        // PackageSignatures table - the publisher's signature of each version, as checked
+        PACKAGE_SIGNATURES_TABLE
       ];
 
       const indexes = [
@@ -884,13 +1126,13 @@ class PackagesModule {
 
         // Create indexes
         indexes.forEach(sql => {
-          this.db.run(sql, (err) => {
+          this.db.run(sql, guarded(reject, (err) => {
             if (err) {
               handleIndexError(err);
             } else {
               checkIndexesComplete();
             }
-          });
+          }));
         });
       };
 
@@ -901,13 +1143,13 @@ class PackagesModule {
 
       // Create tables first
       tables.forEach(sql => {
-        this.db.run(sql, (err) => {
+        this.db.run(sql, guarded(reject, (err) => {
           if (err) {
             handleTableError(err);
           } else {
             checkTablesComplete();
           }
-        });
+        }));
       });
     });
   }
@@ -1120,6 +1362,34 @@ class PackagesModule {
       }
     });
 
+    // GET /packages/feed-check - check a package feed as the crawler reads it, storing nothing.
+    // With url, starts a check and redirects to its report; the report page reloads until done.
+    // One check at a time, across all users.
+    this.router.get('/feed-check', this.validateQueryParams(FEED_CHECK_PARAMS), async (req, res) => {
+      const start = Date.now();
+      try {
+        await this.serveFeedCheck(req, res);
+      } catch (error) {
+        pckLog.error('Error in /packages/feed-check:', error);
+        res.status(500).json({error: 'Internal server error'});
+      } finally {
+        this.stats.countRequest('feed-check', Date.now() - start);
+      }
+    });
+
+    // GET /packages/feed-check/{run} - a feed check's report (while it runs, what it has so far)
+    this.router.get('/feed-check/:run', async (req, res) => {
+      const start = Date.now();
+      try {
+        await this.serveFeedCheckRun(req, res);
+      } catch (error) {
+        pckLog.error('Error in /packages/feed-check/{run}:', error);
+        res.status(500).json({error: 'Internal server error'});
+      } finally {
+        this.stats.countRequest('feed-check', Date.now() - start);
+      }
+    });
+
     // GET /packages/catalog - Search packages or get updates
     this.router.get('/catalog', this.validateQueryParams(searchParams), async (req, res) => {
       const start = Date.now();
@@ -1136,6 +1406,56 @@ class PackagesModule {
       }
     });
 
+    // GET /packages/-/npm/v1/keys - the key the registry signs packages with, as npm's
+    // registry does (npm audit signatures). A 404 says this registry doesn't sign, which is
+    // also the answer while versions are still being signed: once there are keys, npm reports
+    // a version with no signature as an error.
+    this.router.get('/-/npm/v1/keys', (req, res) => {
+      const start = Date.now();
+      try {
+        if (!this.signer) {
+          res.status(404).json({error: 'This registry does not sign packages'});
+        } else if (this.distStatus.state !== 'complete') {
+          res.status(404).json({error: 'This registry is still signing the packages it holds; try again later'});
+        } else {
+          res.json(this.signer.keysDocument());
+        }
+      } finally {
+        this.stats.countRequest('keys', Date.now() - start);
+      }
+    });
+
+    // GET /packages/-/fhir/v1/signatures/{name}@{version} - the publisher's signature of a
+    // package version (its {package}.tgz.sigstore.json), exactly as the crawler fetched and
+    // checked it. dist['fhir-signature'] in the package document links it, with the outcome.
+    this.router.get('/-/fhir/v1/signatures/:spec', async (req, res) => {
+      const start = Date.now();
+      try {
+        const spec = req.params.spec || '';
+        const at = spec.lastIndexOf('@');
+        const id = at > 0 ? spec.substring(0, at) : '';
+        const version = at > 0 ? spec.substring(at + 1) : '';
+        if (!PACKAGE_ID_PATTERN.test(id) || !PACKAGE_VERSION_PATTERN.test(version) ||
+          id.length > PACKAGE_ID_MAX_LENGTH || version.length > PACKAGE_VERSION_MAX_LENGTH) {
+          res.status(400).json({error: 'Expected {name}@{version}'});
+          return;
+        }
+        const row = await this.dbGet(`SELECT s.Bundle FROM PackageSignatures s
+                                      JOIN PackageVersions v ON v.PackageVersionKey = s.PackageVersionKey
+                                      WHERE v.Id = ? AND v.Version = ?`, [id, version]);
+        if (!row) {
+          res.status(404).json({error: `No signature is held for ${id}#${version}`});
+          return;
+        }
+        res.type('application/json').send(row.Bundle);
+      } catch (error) {
+        pckLog.error('Error in /packages/-/fhir/v1/signatures:', error);
+        res.status(500).json({error: 'Internal server error'});
+      } finally {
+        this.stats.countRequest('signature', Date.now() - start);
+      }
+    });
+
     // GET /packages/-/v1/search - Search packages (v1 API)
     this.router.get('/-/v1/search', this.validateQueryParams(V1_SEARCH_PARAMS), async (req, res) => {
       const start = Date.now();
@@ -1359,7 +1679,7 @@ class PackagesModule {
           // Don't process routes that are handled elsewhere. These must call next():
           // returning without responding leaves the request hanging, which is what
           // /status, /stats and /search (registered after this route) used to do.
-          if (['catalog', 'log', 'broken', 'stats', 'status', 'search', 'updates', 'npm-check'].includes(id) ||
+          if (['catalog', 'log', 'broken', 'stats', 'status', 'search', 'updates', 'npm-check', 'feed-check'].includes(id) ||
             id.endsWith('.html') || id === '-') {
             next();
             return;
@@ -1617,6 +1937,8 @@ class PackagesModule {
         htmlServer.loadTemplate('packages', templatePath);
       }
 
+      await this.annotateSignatures(updates, u => u.name, u => u.version);
+
       // Build template variables
       const vars = {
         fromDate: fromDate.split('T')[0], // Just the date part
@@ -1644,6 +1966,37 @@ class PackagesModule {
     }
   }
 
+  // Sets signatureState on each item of a list for an HTML page: its PackageSignatures row (the
+  // publisher's signature, as the crawler checked it), or null when there is none
+  async annotateSignatures(list, idOf, versionOf) {
+    const ids = [...new Set(list.map(idOf).filter(Boolean))];
+    const found = new Map();
+    for (let i = 0; i < ids.length; i += 500) {
+      const chunk = ids.slice(i, i + 500);
+      const rows = await this.dbAll(`SELECT v.Id, v.Version, s.Valid, s.KeyId, s.Message, s.Checked
+                                     FROM PackageSignatures s JOIN PackageVersions v ON v.PackageVersionKey = s.PackageVersionKey
+                                     WHERE v.Id IN (${chunk.map(() => '?').join(',')})`, chunk);
+      for (const r of rows) {
+        found.set(`${r.Id}#${r.Version}`, r);
+      }
+    }
+    for (const item of list) {
+      item.signatureState = found.get(`${idOf(item)}#${versionOf(item)}`) || null;
+    }
+  }
+
+  // The Signature column: confirmed (the publisher's signature checked out), rejected (it didn't),
+  // or absent (unsigned, or not checked: the feed lists no keys, or signatures are ignored)
+  signatureCell(sig) {
+    if (!sig) {
+      return '<td class="text-muted">absent</td>';
+    }
+    if (sig.Valid) {
+      return `<td title="${escape(`Signed with ${sig.KeyId}; checked ${sig.Checked} UTC`)}"><span class="text-success">confirmed</span></td>`;
+    }
+    return `<td title="${escape(`${sig.Message || 'The signature is not valid'}; checked ${sig.Checked} UTC`)}"><span class="text-danger">rejected</span></td>`;
+  }
+
   generateUpdatesTable(updates) {
     if (updates.length === 0) {
       return '<div class="alert alert-info">No package updates found for the specified time period.</div>';
@@ -1657,6 +2010,7 @@ class PackagesModule {
     table += '<th>Type</th>';
     table += '<th>Published</th>';
     table += '<th>Canonical</th>';
+    table += '<th>Signature</th>';
     table += '</tr></thead><tbody>';
 
     for (const pkg of updates) {
@@ -1667,6 +2021,7 @@ class PackagesModule {
       table += `<td>${escape(pkg.kind)}</td>`;
       table += `<td>${new Date(pkg.date).toLocaleDateString()} ${new Date(pkg.date).toLocaleTimeString()}</td>`;
       table += `<td>${escape(pkg.canonical || '')}</td>`;
+      table += this.signatureCell(pkg.signatureState);
       table += '</tr>';
     }
 
@@ -1683,14 +2038,14 @@ class PackagesModule {
 
     content += '<form method="GET" action="/packages/updates">';
 
-    content += `<input type="radio" name="dateType" id="dateType" value="relative" ${formData.dt == 'relative' ? 'checked' : ''}> `;
-    content += '<label for="relativeDays">Last</label> ';
-    content += `<input type="number" name="daysValue" value="${formData.days}" min="1" max="365" style="width: 80px; margin: 0 5px;"> `;
+    content += `<input type="radio" aria-label="Is Relative?" name="dateType" id="dateType" value="relative" ${formData.dt == 'relative' ? 'checked' : ''}> `;
+    content += '<label for="daysValue">Last</label> ';
+    content += `<input type="number" id="daysValue" aria-label="Number of Days" name="daysValue" value="${formData.days}" min="1" max="365" style="width: 80px; margin: 0 5px;"> `;
     content += '<label>days</label> &nbsp;&nbsp;';
 
-    content += `<input type="radio" name="dateType" id="dateType" value="absolute" ${formData.dt != 'relative' ? 'checked' : ''}> `;
-    content += '<label for="specificDate">Since date:</label> ';
-    content += `<input type="date" name="dateValue" value="${formData.date}" style="margin-left: 5px;"> `;
+    content += `<input type="radio" name="dateType" aria-label="Is Date?" id="dateType" value="absolute" ${formData.dt != 'relative' ? 'checked' : ''}> `;
+    content += '<label for="dateValue">Since date:</label> ';
+    content += `<input type="date" name="dateValue" id="dateValue" aria-label="Date" value="${formData.date}" style="margin-left: 5px;"> `;
     content += '<button type="submit" class="btn btn-primary btn-sm" style="margin-left: 10px;">Update Results</button>';
 
     content += '</form>';
@@ -1718,13 +2073,13 @@ class PackagesModule {
                    WHERE PubDate >= ?
                    ORDER BY PubDate DESC`;
 
-      this.db.all(sql, [date], (err, rows) => {
+      this.db.all(sql, [date], guarded(reject, (err, rows) => {
         if (err) {
           reject(err);
         } else {
           resolve(rows);
         }
-      });
+      }));
     });
   }
 
@@ -1831,6 +2186,140 @@ class PackagesModule {
     res.json(report);
   }
 
+  feedCheckConfig() {
+    return {...FEED_CHECK_DEFAULTS, ...(this.config?.feedCheck || {})};
+  }
+
+  // The registry's feed list (package-feeds.json), for the feed check; fetched at most hourly
+  async feedCheckMasterList() {
+    if (this.masterListCache && Date.now() - this.masterListCache.at < MASTER_LIST_MAX_AGE) {
+      return this.masterListCache.data;
+    }
+    const reader = Object.create(PackageCrawler.prototype);
+    reader.config = this.config;
+    const data = await reader.fetchJson(this.config.masterUrl);
+    this.masterListCache = {at: Date.now(), data};
+    return data;
+  }
+
+  // Forgets runs older than keepMinutes, and the oldest beyond FEED_CHECK_MAX_JOBS
+  pruneFeedCheckJobs() {
+    const keep = this.feedCheckConfig().keepMinutes * 60 * 1000;
+    for (const [id, job] of this.feedCheckJobs) {
+      if (job.state !== 'running' && Date.now() - job.started > keep) {
+        this.feedCheckJobs.delete(id);
+      }
+    }
+    while (this.feedCheckJobs.size > FEED_CHECK_MAX_JOBS) {
+      this.feedCheckJobs.delete(this.feedCheckJobs.keys().next().value);
+    }
+  }
+
+  async serveFeedCheck(req, res) {
+    const acceptsHtml = req.headers.accept && req.headers.accept.includes('text/html');
+    const cfg = this.feedCheckConfig();
+    const fail = (status, message) => acceptsHtml
+      ? this.sendFeedCheckPage(res, status, `<div class="alert alert-danger">${escape(message)}</div>` + feedCheckPage.renderForm(req.query))
+      : res.status(status).json({error: message});
+
+    if (!cfg.enabled) {
+      return fail(404, 'The feed check is not enabled on this server');
+    }
+    const target = req.query.url;
+    if (!target) {
+      if (acceptsHtml) {
+        return this.sendFeedCheckPage(res, 200, feedCheckPage.renderForm({}));
+      }
+      return res.status(400).json({error: 'Parameter url is required'});
+    }
+    if (typeof target !== 'string') {
+      return fail(400, 'Give the feed URL once');
+    }
+    let url;
+    try {
+      url = new URL(target);
+    } catch (e) {
+      return fail(400, `The URL isn't valid: ${target}`);
+    }
+    // http(s) only: the crawler also reads local files, which a user must never reach
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) {
+      return fail(400, 'The feed URL must be http(s), with no user name or password');
+    }
+    let signing = null;
+    if (req.query.signing && String(req.query.signing).trim()) {
+      try {
+        signing = parseSigningJson(String(req.query.signing));
+      } catch (e) {
+        return fail(400, `The signing information isn't usable: ${e.message}`);
+      }
+    }
+    if (this.feedCheckRunning) {
+      res.setHeader('Retry-After', '60');
+      return fail(503, 'A feed check is already running (only one runs at a time); try again in a minute');
+    }
+
+    this.pruneFeedCheckJobs();
+    const job = {id: crypto.randomBytes(12).toString('hex'), url: target, state: 'running', report: null, error: null, started: Date.now()};
+    this.feedCheckJobs.set(job.id, job);
+    this.feedCheckRunning = true;
+    const check = new FeedCheck(this.config, {
+      master: () => this.feedCheckMasterList(),
+      held: (id, version) => this.dbGet('SELECT Hash AS hash FROM PackageVersions WHERE Id = ? AND Version = ?', [id, version]),
+      signing,
+      maxItems: cfg.maxItems,
+      maxTotalMB: cfg.maxTotalMB
+    });
+    check.run(target, report => {
+      job.report = report;
+    }).then(report => {
+      job.report = report;
+      job.state = 'done';
+      const errors = report.items.filter(i => i.status === 'error').length;
+      pckLog.info(`feed-check ${target}: ${report.items.length} items, ${errors} with errors, ${report.errors.length} feed errors`);
+    }).catch(e => {
+      job.state = 'failed';
+      job.error = e.message;
+      pckLog.error(`feed-check ${target} failed: ${e.message}`);
+    }).finally(() => {
+      this.feedCheckRunning = false;
+    });
+
+    const where = `/packages/feed-check/${job.id}`;
+    if (acceptsHtml) {
+      return res.redirect(303, where);
+    }
+    res.status(202).setHeader('Location', where);
+    return res.json({id: job.id, state: job.state, report: where});
+  }
+
+  async serveFeedCheckRun(req, res) {
+    const acceptsHtml = req.headers.accept && req.headers.accept.includes('text/html');
+    const id = req.params.run;
+    const job = FEED_CHECK_JOB_PATTERN.test(id || '') ? this.feedCheckJobs.get(id) : null;
+    if (!job) {
+      const message = 'There is no feed check with that id (reports are kept for a while after the check)';
+      return acceptsHtml
+        ? this.sendFeedCheckPage(res, 404, `<div class="alert alert-info">${escape(message)}</div>` + feedCheckPage.renderForm({}))
+        : res.status(404).json({error: message});
+    }
+    if (acceptsHtml) {
+      if (job.state === 'running') {
+        res.setHeader('Refresh', '5');
+      }
+      return this.sendFeedCheckPage(res, 200, feedCheckPage.renderJob(job));
+    }
+    return res.json({id: job.id, url: job.url, state: job.state, error: job.error || undefined, report: job.report});
+  }
+
+  async sendFeedCheckPage(res, status, content) {
+    if (!htmlServer.hasTemplate('packages')) {
+      htmlServer.loadTemplate('packages', path.join(__dirname, 'packages-template.html'));
+    }
+    const stats = await this.gatherPackageStatistics();
+    res.status(status).setHeader('Content-Type', 'text/html');
+    res.send(htmlServer.renderPage('packages', 'Package Feed Check', content, stats));
+  }
+
   async sendNpmCheckPage(res, status, content) {
     if (!htmlServer.hasTemplate('packages')) {
       htmlServer.loadTemplate('packages', path.join(__dirname, 'packages-template.html'));
@@ -1964,13 +2453,13 @@ class PackagesModule {
         ? [id, version]
         : [id, `${version}-%`];
 
-      this.db.get(sql, params, (err, row) => {
+      this.db.get(sql, params, guarded(reject, (err, row) => {
         if (err) {
           reject(err);
         } else {
           resolve(row || null);
         }
-      });
+      }));
     });
   }
 
@@ -2012,10 +2501,10 @@ class PackagesModule {
         this.db.run(
           'UPDATE PackageVersions SET DownloadCount = DownloadCount + 1 WHERE PackageVersionKey = ?',
           [packageVersionKey],
-          (err) => {
+          guarded(reject, (err) => {
             if (err) reject(err);
             else resolve();
-          }
+          })
         );
       });
 
@@ -2024,10 +2513,10 @@ class PackagesModule {
         this.db.run(
           'UPDATE Packages SET DownloadCount = DownloadCount + 1 WHERE Id = ?',
           [packageId],
-          (err) => {
+          guarded(reject, (err) => {
             if (err) reject(err);
             else resolve();
-          }
+          })
         );
       });
 
@@ -2075,7 +2564,7 @@ class PackagesModule {
 
   async getPackageVersions(id) {
     return new Promise((resolve, reject) => {
-      const sql = `SELECT PackageVersionKey,
+      const sql = `SELECT v.PackageVersionKey,
                           Version,
                           PubDate,
                           FhirVersions,
@@ -2087,18 +2576,24 @@ class PackagesModule {
                           License,
                           Hash,
                           GUID,
-                          Description
-                   FROM PackageVersions
+                          Description,
+                          d.Integrity,
+                          d.KeyId,
+                          d.Signature,
+                          s.Valid AS PublisherSigValid,
+                          s.KeyId AS PublisherSigKeyId
+                   FROM PackageVersions v LEFT JOIN PackageDist d ON d.PackageVersionKey = v.PackageVersionKey
+                     LEFT JOIN PackageSignatures s ON s.PackageVersionKey = v.PackageVersionKey
                    WHERE Id = ?
                    ORDER BY PubDate DESC`;  // Changed from ASC to DESC for most recent first
 
-      this.db.all(sql, [id], (err, rows) => {
+      this.db.all(sql, [id], guarded(reject, (err, rows) => {
         if (err) {
           reject(err);
         } else {
           resolve(rows);
         }
-      });
+      }));
     });
   }
 
@@ -2111,7 +2606,7 @@ class PackagesModule {
                    FROM PackageDependencies
                    WHERE PackageVersionKey IN (${placeholders})`;
 
-      this.db.all(sql, packageVersionKeys, (err, rows) => {
+      this.db.all(sql, packageVersionKeys, guarded(reject, (err, rows) => {
         if (err) {
           reject(err);
         } else {
@@ -2132,7 +2627,7 @@ class PackagesModule {
           }
           resolve(deps);
         }
-      });
+      }));
     });
   }
 
@@ -2179,6 +2674,23 @@ class PackagesModule {
           tarball: this.buildTarballUrl(id, pv.Version, secure, req)
         }
       };
+      if (pv.Integrity) {
+        versionObj.dist.integrity = pv.Integrity;
+      }
+      if (this.signer && pv.Signature && pv.KeyId === this.signer.keyid) {
+        versionObj.dist.signatures = [{keyid: pv.KeyId, sig: pv.Signature}];
+      }
+      // The publisher's signature, as the crawler checked it. Not dist.attestations: npm would
+      // try to verify these as Sigstore attestations, and can't (see readme)
+      if (pv.PublisherSigValid !== null && pv.PublisherSigValid !== undefined) {
+        versionObj.dist['fhir-signature'] = {
+          url: this.buildSignatureUrl(id, pv.Version, secure, req),
+          status: pv.PublisherSigValid ? 'confirmed' : 'rejected'
+        };
+        if (pv.PublisherSigKeyId) {
+          versionObj.dist['fhir-signature'].keyid = pv.PublisherSigKeyId;
+        }
+      }
 
       // Add optional fields
       if (pv.HomePage) {
@@ -2221,6 +2733,14 @@ class PackagesModule {
     return registry;
   }
 
+  // Where the publisher's signature of a version is served: npm's form of name@version
+  buildSignatureUrl(id, version, secure, req) {
+    const spec = encodeURIComponent(id).replace(/^%40/, '@') + '@' + encodeURIComponent(version);
+    const base = this.config.baseUrl ? this.config.baseUrl.replace(/\/+$/, '')
+      : `${secure ? 'https' : 'http'}://${(req && req.get && req.get('host')) || 'localhost:3000'}`;
+    return `${base}/packages/-/fhir/v1/signatures/${spec}`;
+  }
+
   buildTarballUrl(id, version, secure, req) {
     if (this.config.bucketPath) {
       let bucketUrl = this.getBucketUrl(secure);
@@ -2243,6 +2763,8 @@ class PackagesModule {
         htmlServer.loadTemplate('packages', templatePath);
       }
 
+      await this.annotateSignatures(packageVersions, () => id, pv => pv.Version);
+
       // Get package counts
       const versionCount = packageVersions.length;
       const totalDownloads = packageVersions.reduce((sum, pv) => sum + (pv.DownloadCount || 0), 0);
@@ -2288,6 +2810,7 @@ class PackagesModule {
     table += '<th>Type</th>';
     table += '<th>Published</th>';
     table += '<th>Downloads</th>';
+    table += '<th>Signature</th>';
     table += '<th>Actions</th>';
     table += '</tr></thead><tbody>';
 
@@ -2298,6 +2821,7 @@ class PackagesModule {
       table += `<td>${escape(this.codeForKind(pv.Kind))}</td>`;
       table += `<td>${new Date(pv.PubDate).toLocaleDateString()}</td>`;
       table += `<td>${(pv.DownloadCount || 0).toLocaleString()}</td>`;
+      table += this.signatureCell(pv.signatureState);
       table += `<td><a href="/packages/${encodeURIComponent(id)}/${escape(pv.Version)}" class="btn btn-sm btn-primary">Download</a></td>`;
       table += '</tr>';
     }
@@ -2495,6 +3019,7 @@ class PackagesModule {
       // Get total package count
       const packageCount = await this.getTotalPackageCount();
       const downloadCount = await this.getTotalDownloadCount();
+      await this.annotateSignatures(results, r => r.name, r => r.version);
 
       // Build template variables
       const vars = {
@@ -2532,25 +3057,25 @@ class PackagesModule {
 
   async getTotalPackageCount() {
     return new Promise((resolve, reject) => {
-      this.db.get('SELECT COUNT(*) as count FROM PackageVersions', [], (err, row) => {
+      this.db.get('SELECT COUNT(*) as count FROM PackageVersions', [], guarded(reject, (err, row) => {
         if (err) {
           reject(err);
         } else {
           resolve(row ? row.count : 0);
         }
-      });
+      }));
     });
   }
 
   async getTotalDownloadCount() {
     return new Promise((resolve, reject) => {
-      this.db.get('SELECT SUM(DownloadCount) as total FROM PackageVersions', [], (err, row) => {
+      this.db.get('SELECT SUM(DownloadCount) as total FROM PackageVersions', [], guarded(reject, (err, row) => {
         if (err) {
           reject(err);
         } else {
           resolve(row ? row.total || 0 : 0);
         }
-      });
+      }));
     });
   }
 
@@ -2588,6 +3113,7 @@ class PackagesModule {
     table += `<th>${this.generateSortHeader('Published', 'date', baseUrl, currentSort)}</th>`;
     table += `<th>${this.generateSortHeader('Downloads', 'count', baseUrl, currentSort)}</th>`;
     table += `<th>${this.generateSortHeader('Canonical', 'canonical', baseUrl, currentSort)}</th>`;
+    table += '<th>Signature</th>';
     table += '</tr></thead><tbody>';
 
     for (const pkg of results) {
@@ -2599,6 +3125,7 @@ class PackagesModule {
       table += `<td>${pkg.date ? new Date(pkg.date).toLocaleDateString() : 'N/A'}</td>`;
       table += `<td>${pkg.count ? pkg.count.toLocaleString() : 'N/A'}</td>`;
       table += `<td>${escape(pkg.canonical || '')}</td>`;
+      table += this.signatureCell(pkg.signatureState);
       table += '</tr>';
     }
 
@@ -2652,27 +3179,27 @@ class PackagesModule {
 
     content += '<tr>';
     content += '<td>Id</td>';
-    content += `<td><input type="text" name="name" value="${escape(vars.name)}"></td>`;
+    content += `<td><input type="text" aria-label="Id" name="name" value="${escape(vars.name)}"></td>`;
     content += '</tr>';
 
     content += '<tr>';
     content += '<td>Depends On</td>';
-    content += `<td><input type="text" name="dependson" value="${escape(vars.dependson)}"> <i>includes both direct and indirect dependencies</i></td>`;
+    content += `<td><input type="text" aria-label="Depends On" name="dependson" value="${escape(vars.dependson)}"> <i>includes both direct and indirect dependencies</i></td>`;
     content += '</tr>';
 
     content += '<tr>';
     content += '<td>Canonical (Package)</td>';
-    content += `<td><input type="text" name="pkgcanonical" value="${escape(vars.canonicalPkg)}"></td>`;
+    content += `<td><input type="text" aria-label="Canonical (Package)" name="pkgcanonical" value="${escape(vars.canonicalPkg)}"></td>`;
     content += '</tr>';
 
     content += '<tr>';
     content += '<td>Canonical (Resource)</td>';
-    content += `<td><input type="text" name="canonical" value="${escape(vars.canonicalUrl)}"></td>`;
+    content += `<td><input type="text" aria-label="Canonical (Resource)" name="canonical" value="${escape(vars.canonicalUrl)}"></td>`;
     content += '</tr>';
 
     content += '<tr>';
     content += '<td>FHIR Version</td>';
-    content += '<td><select name="fhirversion">';
+    content += '<td><select name="fhirversion" aria-label="FHIR Version">';
     content += '<option value=""></option>';
     content += `<option value="R2" ${vars.r2selected}>R2</option>`;
     content += `<option value="R3" ${vars.r3selected}>R3</option>`;
@@ -2825,7 +3352,7 @@ class PackagesModule {
         const row = await new Promise((resolve, reject) => this.db.get(
           'SELECT COUNT(*) AS n, COUNT(DISTINCT Id) AS ids FROM PackageVersions WHERE Indexed > ?',
           [new Date(since).toISOString().replace('T', ' ').substring(0, 19)],
-          (err, row) => err ? reject(err) : resolve(row)));
+          guarded(reject, (err, row) => err ? reject(err) : resolve(row))));
         sentences.push(row.n === 0
           ? 'No new package versions were found.'
           : `${plural(row.n, 'new package version')} ${row.n === 1 ? 'was' : 'were'} found, of ${plural(row.ids, 'package')}.`);
@@ -2841,17 +3368,22 @@ class PackagesModule {
 
     await this.stopCrawlerJob();
 
+    this.stopping = true;
+    if (this.distBackfill) {
+      await this.distBackfill;
+    }
+
     // Close database connection
     if (this.db) {
-      return new Promise((resolve) => {
-        this.db.close((err) => {
+      return new Promise((resolve, reject) => {
+        this.db.close(guarded(reject, (err) => {
           if (err) {
             pckLog.error('Error closing packages database:', err.message);
           } else {
             pckLog.info('Packages database connection closed');
           }
           resolve();
-        });
+        }));
       });
     }
 
@@ -2896,7 +3428,7 @@ class PackagesModule {
     return new Promise((resolve, reject) => {
       const sql = 'SELECT Id, Version FROM PackageVersions';
 
-      this.db.all(sql, [], (err, rows) => {
+      this.db.all(sql, [], guarded(reject, (err, rows) => {
         if (err) {
           reject(err);
         } else {
@@ -2911,7 +3443,7 @@ class PackagesModule {
 
           resolve(validPackages);
         }
-      });
+      }));
     });
   }
 
@@ -2923,7 +3455,7 @@ class PackagesModule {
                         PackageVersions
                    WHERE PackageDependencies.PackageVersionKey = PackageVersions.PackageVersionKey`;
 
-      this.db.all(sql, [], (err, rows) => {
+      this.db.all(sql, [], guarded(reject, (err, rows) => {
         if (err) {
           reject(err);
         } else {
@@ -2959,7 +3491,7 @@ class PackagesModule {
 
           resolve(brokenDeps);
         }
-      });
+      }));
     });
   }
 
@@ -3058,7 +3590,7 @@ class PackagesModule {
     content += '</table>';
 
     // Help info
-    content += '<h5>About This Report</h5>';
+    content += '<h3>About This Report</h3>';
     content += '<p>This report shows packages that have dependencies which cannot be resolved. A dependency is considered broken if:</p>';
     content += '<ul>';
     content += '<li>The referenced package does not exist</li>';
@@ -3178,7 +3710,9 @@ class PackagesModule {
 
     if (logData.feeds && logData.feeds.length > 0) {
       for (const feed of logData.feeds) {
-        if (feed.exception || feed.rateLimited) {
+        if (feed.skipped) {
+          output += `Feed: ${feed.url}: skipped - ${feed.skipped}\n`;
+        } else if (feed.exception || feed.rateLimited) {
           // Feed itself had an error
           const error = feed.rateLimited ? feed.rateLimitMessage : feed.exception;
           output += `Feed: ${feed.url}: ${error}\n`;
@@ -3193,6 +3727,9 @@ class PackagesModule {
                 const guid = item.guid || 'unknown';
                 output += `  error: ${guid}: ${item.error}\n`;
               }
+              if (item.signature && !item.signature.startsWith('valid') && item.signature !== 'unsigned') {
+                output += `  signature: ${item.guid || 'unknown'}: ${item.signature}\n`;
+              }
             }
           }
         }
@@ -3222,6 +3759,16 @@ class PackagesModule {
         schedule: this.config.crawler.schedule,
         lastRun: this.lastRunTime,
         totalRuns: this.totalRuns
+      },
+      npmSigning: {
+        enabled: this.signer ? true : false,
+        keyid: this.signer ? this.signer.keyid : undefined,
+        // complete: every version has its integrity (and signature); running, incomplete
+        // (tried again after the next crawl), stopped
+        state: this.distStatus.state,
+        missing: this.distStatus.missing,
+        done: this.distStatus.done,
+        failed: this.distStatus.failed
       }
     };
   }