ovsx 1.1.0 → 1.2.0

package/src/unpublish.ts

@@ -0,0 +1,160 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import { confirm } from '@inquirer/prompts';
+// `import * as isCI from 'is-ci'` would bind to a namespace object instead of the boolean `is-ci`
+// exports whenever the importer applies ES module interop (e.g. a bundler, or vitest's own
+// transform), making the truthiness check below always true. `import = require` always binds
+// directly to the exported value, regardless of how the importing tool handles interop.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+import isCI = require('is-ci');
+import * as semver from 'semver';
+import { getPAT } from './pat';
+import { Registry, TargetPlatformVersion } from './registry';
+import { UnpublishOptions } from './unpublish-options';
+import { addEnvOptions, matchExtensionId, readManifest } from './util';
+
+/**
+ * Oldest registry version that exposes the `delete` endpoint used by this command.
+ */
+export const MIN_UNPUBLISH_REGISTRY_VERSION = '1.2.0';
+
+/**
+ * Deletes an extension or some of its versions from the registry.
+ */
+export async function unpublish(options: UnpublishOptions = {}): Promise<void> {
+    addEnvOptions(options);
+    if (options.targets && !options.versions) {
+        throw new Error("Please specify the versions to delete with '--versions' when using '--target'.");
+    }
+
+    const extensionId = options.extensionId ?? await readExtensionId();
+    const match = matchExtensionId(extensionId);
+    if (!match) {
+        throw new Error('The extension identifier must have the form `namespace.extension` or `namespace/extension`.');
+    }
+
+    const [, namespace, extension] = match;
+    const registry = new Registry(options);
+    await ensureUnpublishSupported(registry);
+
+    options.pat = await getPAT(namespace, { ...options, namespace }, false);
+
+    const targetVersions = getTargetVersions(options);
+    await confirmUnpublish(`${namespace}.${extension}`, targetVersions, registry.url, options.force);
+
+    const result = await registry.deleteExtension(namespace, extension, targetVersions, options.pat);
+    if (result.error) {
+        throw new Error(result.error);
+    }
+    // the registry reports one line per deleted version, and nothing at all if there was nothing to delete
+    console.log(`🗑  ${result.success || `Nothing to delete for ${namespace}.${extension}`}`);
+}
+
+/**
+ * Reads the extension identifier from the `package.json` in the current directory,
+ * so that `ovsx unpublish` can be run from an extension folder without arguments.
+ */
+async function readExtensionId(): Promise<string> {
+    let error;
+    try {
+        const manifest = await readManifest();
+        if (manifest.publisher && manifest.name) {
+            return `${manifest.publisher}.${manifest.name}`;
+        }
+    } catch (e) {
+        error = e;
+    }
+
+    throw new Error(
+        'Unable to read the extension identifier. Please supply it as an argument or run ovsx from the extension folder.' +
+        (error ? `\n\n${error}` : '')
+    );
+}
+
+/**
+ * Fails fast with an actionable message when the registry is known to be too old to support
+ * deleting extensions, rather than letting the delete request fail with a generic 404.
+ *
+ * The check is best-effort: registries that don't expose `/api/version` at all, or report a
+ * version that can't be parsed as semver (e.g. a build without `ovsx.registry.version` set),
+ * are assumed to support the endpoint. The delete request itself will surface any real
+ * incompatibility in that case.
+ */
+async function ensureUnpublishSupported(registry: Registry): Promise<void> {
+    let reportedVersion: string | undefined;
+    try {
+        reportedVersion = (await registry.getRegistryVersion()).version;
+    } catch {
+        return;
+    }
+
+    // `coerce` drops any prerelease/build suffix (e.g. `1.2.0-dev.0` or `1.2.0-SNAPSHOT` both
+    // become `1.2.0`), so development builds of a supported release compare as supported too.
+    const version = semver.coerce(reportedVersion);
+    if (version && semver.lt(version, MIN_UNPUBLISH_REGISTRY_VERSION)) {
+        throw new Error(
+            `The registry at ${registry.url} runs version ${reportedVersion}, but deleting extensions requires `
+            + `version ${MIN_UNPUBLISH_REGISTRY_VERSION} or later.`
+        );
+    }
+}
+
+/**
+ * Returns the versions to delete, or `undefined` to delete the extension as a whole.
+ * A version without target platform tells the registry to delete all target platforms
+ * of that version.
+ */
+function getTargetVersions(options: UnpublishOptions): TargetPlatformVersion[] | undefined {
+    if (!options.versions) {
+        return undefined;
+    }
+    if (!options.targets) {
+        return options.versions.map(version => ({ version }));
+    }
+
+    return options.versions.flatMap(
+        version => options.targets!.map(targetPlatform => ({ version, targetPlatform }))
+    );
+}
+
+async function confirmUnpublish(
+    extensionId: string,
+    targetVersions: TargetPlatformVersion[] | undefined,
+    registryUrl: string,
+    force?: boolean
+): Promise<void> {
+    if (force) {
+        return;
+    }
+    if (isCI || !process.stdin.isTTY) {
+        throw new Error("Aborted. Use '--force' to delete without confirmation.");
+    }
+
+    const what = targetVersions
+        ? targetVersions.map(target => describe(extensionId, target)).join(', ')
+        : `all versions of ${extensionId}`;
+    const confirmed = await confirm({
+        message: `Delete ${what} from ${registryUrl}? Deleted versions can never be published again.`,
+        default: false
+    });
+
+    if (!confirmed) {
+        throw new Error('Aborted.');
+    }
+}
+
+function describe(extensionId: string, target: TargetPlatformVersion): string {
+    const version = `${extensionId} v${target.version}`;
+    return target.targetPlatform ? `${version}@${target.targetPlatform}` : version;
+}

package/src/util.ts

@@ -13,6 +13,7 @@ import * as path from 'path';
 import * as tmp from 'tmp';
 import * as http from 'http';
 import { RegistryOptions } from './registry-options';
+import { TrustedPublishingOptions } from './trusted-publishing-options';
 
 export { promisify } from 'util';
 
@@ -21,6 +22,54 @@ export function addEnvOptions(options: RegistryOptions): void {
     options.pat ??= process.env.OVSX_PAT;
     options.username ??= process.env.OVSX_USERNAME;
     options.password ??= process.env.OVSX_PASSWORD;
+    options.timeout ??= parseIntEnv(process.env.OVSX_TIMEOUT);
+}
+
+export function addTrustedPublishingEnvOptions(options: TrustedPublishingOptions): void {
+    options.trustedPublishing ??= parseBooleanEnv(process.env.OVSX_TRUSTED_PUBLISHING);
+    options.idToken ??= process.env.OVSX_ID_TOKEN;
+    options.oidcAudience ??= process.env.OVSX_OIDC_AUDIENCE;
+}
+
+/** How long a request may make no progress before it is abandoned; see RegistryOptions.timeout. */
+export const DEFAULT_TIMEOUT = 30_000;
+
+/**
+ * The configured request timeout, for requests that have no RegistryOptions to read it from - the CI
+ * token exchange deliberately shares nothing with the registry, but there is no reason for it to be
+ * on a different clock.
+ */
+export function configuredTimeout(): number {
+    return parseIntEnv(process.env.OVSX_TIMEOUT) ?? DEFAULT_TIMEOUT;
+}
+
+function parseIntEnv(value?: string): number | undefined {
+    if (value === undefined || value.trim().length === 0) {
+        return undefined;
+    }
+    const parsed = Number(value.trim());
+    // Left undefined rather than throwing, so a mistyped variable falls back to the default instead
+    // of stopping a command that would otherwise work.
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : undefined;
+}
+
+function parseBooleanEnv(value?: string): boolean | undefined {
+    if (value === undefined || value.trim().length === 0) {
+        return undefined;
+    }
+    return ['true', '1', 'yes'].includes(value.trim().toLowerCase());
+}
+
+/**
+ * Parses a commander option that must be a non-negative whole number, so a typo is reported by the
+ * CLI rather than sent to the registry as a bad request.
+ */
+export function parseNonNegativeInt(value: string): number {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        throw new Error(`Expected a non-negative whole number, got '${value}'.`);
+    }
+    return parsed;
 }
 
 export function matchExtensionId(id: string): RegExpExecArray | null {
@@ -85,11 +134,59 @@ export function handleError(debug?: boolean, additionalMessage?: string, exit: b
     };
 }
 
-export function statusError(response: http.IncomingMessage): Error {
-    if (response.statusMessage)
-        return new Error(`The server responded with status ${response.statusCode}: ${response.statusMessage}`);
-    else
-        return new Error(`The server responded with status ${response.statusCode}.`);
+/**
+ * Formats a byte count for display, e.g. `1536` -> `1.5 KB`. Mirrors the registry's own
+ * `FileUtils.byteCountToDisplaySize` formatting so client- and server-side size limit messages read
+ * the same way.
+ */
+export function formatBytes(bytes: number): string {
+    const units = ['bytes', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB'];
+    let size = bytes;
+    let unit = 0;
+    while (size >= 1024 && unit < units.length - 1) {
+        size /= 1024;
+        unit++;
+    }
+    return `${Math.floor(size)} ${units[unit]}`;
+}
+
+/**
+ * An error carrying the HTTP status that produced it, so a caller can tell "the registry refused this"
+ * from "the registry could not answer right now" without matching on the message.
+ */
+export interface StatusError extends Error {
+    status?: number;
+}
+
+export function withStatus(error: Error, status?: number): StatusError {
+    const withStatusCode = error as StatusError;
+    withStatusCode.status = status;
+    return withStatusCode;
+}
+
+/**
+ * A URL in the form it can safely be printed: no user info and no query string.
+ *
+ * `createNamespace`, `verifyPat`, `publish` and `delete` all put the personal access token in a
+ * `token` query parameter, and an error message goes straight to stderr and from there into CI logs.
+ * The query carries nothing an error needs, so it is dropped whole rather than filtered key by key -
+ * a filter has to be kept in step with every parameter anyone ever adds.
+ */
+export function redactUrl(url: URL | string): string {
+    try {
+        const parsed = typeof url === 'string' ? new URL(url) : url;
+        return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+    } catch {
+        // Not parseable, so nothing can be assumed about what it holds.
+        return '<url>';
+    }
+}
+
+export function statusError(response: http.IncomingMessage): StatusError {
+    const message = response.statusMessage
+        ? `The server responded with status ${response.statusCode}: ${response.statusMessage}`
+        : `The server responded with status ${response.statusCode}.`;
+    return withStatus(new Error(message), response.statusCode);
 }
 
 export function readFile(name: string, packagePath?: string, encoding: BufferEncoding = 'utf-8'): Promise<string> {

package/src/verify-options.ts

@@ -0,0 +1,25 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import { RegistryOptions } from './registry-options';
+
+export interface VerifyOptions extends RegistryOptions {
+    /**
+     * Path to the downloaded .vsix package to verify.
+     */
+    packagePath: string;
+    /**
+     * Target platform. Defaults to universal.
+     */
+    target?: string;
+}

package/src/verify-signature-options.ts

@@ -0,0 +1,32 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+export interface VerifySignatureOptions {
+    /**
+     * Path to the .vsix package.
+     */
+    packagePath: string;
+    /**
+     * Path to the signature manifest file (the `.signature.manifest` entry of a registry's
+     * signature archive).
+     */
+    manifestPath: string;
+    /**
+     * Path to the signature file (the `.signature.sig` entry of a registry's signature archive).
+     */
+    signaturePath: string;
+    /**
+     * Path to the registry's public key file, in PEM format.
+     */
+    publicKeyPath: string;
+}

package/src/verify-signature.ts

@@ -0,0 +1,124 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import { hashAllZipEntries } from './zip';
+import { VerifySignatureOptions } from './verify-signature-options';
+
+interface DigestEntry {
+    size?: number;
+    digests?: { sha256?: string };
+}
+
+interface SignatureManifest {
+    package?: DigestEntry;
+    entries?: { [base64Name: string]: DigestEntry };
+}
+
+/**
+ * Verifies a package/manifest/signature file trio entirely offline, the same way `vsce
+ * verify-signature` does - no registry involved, every input is a local file. Unlike `verify`,
+ * which fetches everything it needs from a registry for a package identified by name, this is for
+ * a signature archive you already extracted yourself (e.g. the `.sigzip` a registry serves has a
+ * `.signature.sig` and a `.signature.manifest` entry, matching `--signaturePath` and
+ * `--manifestPath` here).
+ *
+ * `vsce verify-signature` validates against Microsoft's own (closed-source) signing scheme and
+ * has no need for a public key argument - VS Code's Marketplace keys are baked into its verifier.
+ * Open VSX's registries each hold their own Ed25519 key pair instead, so `--publicKeyPath` is
+ * required here to say which registry's signature this is supposed to be.
+ */
+export async function verifySignature(options: VerifySignatureOptions): Promise<void> {
+    const [packageBytes, manifestJson, signature, publicKeyPem] = await Promise.all([
+        fs.promises.readFile(options.packagePath),
+        fs.promises.readFile(options.manifestPath, 'utf-8'),
+        fs.promises.readFile(options.signaturePath),
+        fs.promises.readFile(options.publicKeyPath, 'utf-8')
+    ]);
+
+    let manifest: SignatureManifest;
+    try {
+        manifest = JSON.parse(manifestJson);
+    } catch (err) {
+        throw new Error(`Failed to parse the manifest file as JSON: ${err instanceof Error ? err.message : err}`);
+    }
+
+    const publicKey = crypto.createPublicKey({ key: publicKeyPem, format: 'pem' });
+    const signatureValid = crypto.verify(null, packageBytes, publicKey, signature);
+    if (!signatureValid) {
+        throw new Error('Signature verification failed. The package may have been tampered with.');
+    }
+
+    const manifestIssues = await checkManifest(options.packagePath, packageBytes, manifest);
+    if (manifestIssues.length > 0) {
+        throw new Error(
+            'The signature is valid, but the package does not match the manifest:\n'
+            + manifestIssues.map(issue => `  - ${issue}`).join('\n')
+        );
+    }
+
+    console.log('✅  Signature is valid.');
+}
+
+function sha256Base64(content: Buffer): string {
+    return crypto.createHash('sha256').update(content).digest('base64');
+}
+
+/**
+ * The manifest itself isn't part of what the signature covers - only the raw package bytes are
+ * signed - so this can't add cryptographic trust on its own. It does confirm the manifest wasn't
+ * corrupted or is stale relative to the actual package, and unlike the signature check alone, can
+ * point at exactly which entry doesn't match.
+ */
+async function checkManifest(packagePath: string, packageBytes: Buffer, manifest: SignatureManifest): Promise<string[]> {
+    const issues: string[] = [];
+
+    const packageDigest = manifest.package?.digests?.sha256;
+    if (packageDigest === undefined) {
+        issues.push('the manifest does not record a package digest');
+    } else if (packageDigest !== sha256Base64(packageBytes)) {
+        issues.push('the package digest does not match the manifest');
+    }
+
+    const manifestEntries = manifest.entries ?? {};
+    const seenKeys = new Set<string>();
+
+    // Streamed straight into a digest one entry at a time, rather than buffering every entry's
+    // full content into memory alongside the already-loaded package bytes.
+    const packageEntryDigests = await hashAllZipEntries(packagePath);
+    for (const [name, actualDigest] of packageEntryDigests) {
+        const key = Buffer.from(name, 'utf-8').toString('base64');
+        seenKeys.add(key);
+        const entry = manifestEntries[key];
+        if (!entry) {
+            issues.push(`'${name}' is present in the package but missing from the manifest`);
+            continue;
+        }
+        const entryDigest = entry.digests?.sha256;
+        if (entryDigest === undefined) {
+            issues.push(`'${name}' has no recorded digest in the manifest`);
+        } else if (entryDigest !== actualDigest) {
+            issues.push(`'${name}' does not match its digest in the manifest`);
+        }
+    }
+
+    for (const key of Object.keys(manifestEntries)) {
+        if (!seenKeys.has(key)) {
+            const name = Buffer.from(key, 'base64').toString('utf-8');
+            issues.push(`'${name}' is listed in the manifest but missing from the package`);
+        }
+    }
+
+    return issues;
+}

package/src/verify.ts

@@ -0,0 +1,107 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import { Registry, Extension } from './registry';
+import { addEnvOptions, createTempFile } from './util';
+import { readVSIXPackage, readZip } from './zip';
+import { VerifyOptions } from './verify-options';
+
+const SIGNATURE_ENTRY = '.signature.sig';
+
+/**
+ * Verifies a downloaded .vsix package's signature against the registry's public key, the same way
+ * VS Code itself verifies signed packages on install. Mirrors `vsce verify-signature`, except the
+ * signature and public key are fetched from the registry instead of being passed in as separate
+ * files - the registry already exposes both for any published, signed version.
+ */
+export async function verify(options: VerifyOptions): Promise<void> {
+    addEnvOptions(options);
+    const registry = new Registry(options);
+
+    const manifest = await readVSIXPackage(options.packagePath);
+    const namespace = manifest.publisher;
+    const extensionName = manifest.name;
+
+    const latest = await registry.getMetadata(namespace, extensionName, options.target);
+    if (latest.error) {
+        throw new Error(latest.error);
+    }
+
+    const extension = await resolveVersion(registry, latest, manifest.version);
+    const description = `${namespace}.${extensionName} v${extension.version}`;
+
+    const signatureUrl = extension.files.signature;
+    const publicKeyUrl = extension.files.publicKey;
+    if (!signatureUrl || !publicKeyUrl) {
+        throw new Error(`${description} is not signed by the registry - there is nothing to verify.`);
+    }
+
+    const [signature, publicKeyPem] = await Promise.all([
+        downloadSignature(registry, signatureUrl),
+        downloadPublicKey(registry, publicKeyUrl)
+    ]);
+
+    const packageBytes = await fs.promises.readFile(options.packagePath);
+    const publicKey = crypto.createPublicKey({ key: publicKeyPem, format: 'pem' });
+    const verified = crypto.verify(null, packageBytes, publicKey, signature);
+
+    if (!verified) {
+        throw new Error(
+            `${description} does not match the version published to ${registry.url}. `
+            + 'The package may have been tampered with, or did not come from that registry.'
+        );
+    }
+    console.log(`✅  This package is identical to ${description} as published to ${registry.url}.`);
+}
+
+/**
+ * `registry.getMetadata` always returns the latest version. Follow `allVersions` to the exact
+ * version recorded in the package's own manifest when it differs.
+ */
+async function resolveVersion(registry: Registry, extension: Extension, version: string): Promise<Extension> {
+    if (extension.version === version) {
+        return extension;
+    }
+    const versionUrl = extension.allVersions[version];
+    if (!versionUrl) {
+        throw new Error(`${extension.namespace}.${extension.name} has no published version '${version}'.`);
+    }
+    return registry.getJson(new URL(versionUrl));
+}
+
+async function downloadSignature(registry: Registry, url: string): Promise<Buffer> {
+    const sigzipPath = await createTempFile({ postfix: '.sigzip' });
+    try {
+        await registry.download(sigzipPath, new URL(url));
+        const entries = await readZip(sigzipPath, name => name === SIGNATURE_ENTRY);
+        const signature = entries.get(SIGNATURE_ENTRY);
+        if (!signature) {
+            throw new Error(`The signature archive does not contain a '${SIGNATURE_ENTRY}' entry.`);
+        }
+        return signature;
+    } finally {
+        await fs.promises.rm(sigzipPath, { force: true });
+    }
+}
+
+async function downloadPublicKey(registry: Registry, url: string): Promise<string> {
+    const publicKeyPath = await createTempFile({ postfix: '.pem' });
+    try {
+        await registry.download(publicKeyPath, new URL(url));
+        return await fs.promises.readFile(publicKeyPath, 'utf-8');
+    } finally {
+        await fs.promises.rm(publicKeyPath, { force: true });
+    }
+}

package/src/version.ts

@@ -1 +1 @@
-export const LIB_VERSION = "1.1.0";
+export const LIB_VERSION = "1.2.0";

package/src/zip.ts

@@ -7,8 +7,10 @@
  *
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
+import * as crypto from 'crypto';
 import * as yauzl from 'yauzl-promise';
 import { Readable } from 'stream';
+import { pipeline } from 'stream/promises';
 import { Manifest } from './util';
 
 async function bufferStream(stream: Readable): Promise<Buffer> {
@@ -20,7 +22,7 @@ async function bufferStream(stream: Readable): Promise<Buffer> {
 	});
 }
 
-async function readZip(packagePath: string, filter: (name: string) => boolean): Promise<Map<string, Buffer>> {
+export async function readZip(packagePath: string, filter: (name: string) => boolean): Promise<Map<string, Buffer>> {
 	const result = new Map<string, Buffer>();
 	const zipfile = await yauzl.open(packagePath);
 	try {
@@ -39,6 +41,34 @@ async function readZip(packagePath: string, filter: (name: string) => boolean):
 	return result;
 }
 
+/**
+ * Computes the SHA256 digest of every non-directory entry of a zip file, keyed by its exact
+ * (case-preserving) name - unlike {@link readZip}, which lowercases names for its
+ * case-insensitive-filter callers. Used where entry names and digests are compared against another
+ * source of truth, such as a signature manifest that records the original names, without also
+ * having to hold every entry's full content in memory at once alongside it - each entry's content
+ * is streamed straight into a hash and discarded, one entry at a time.
+ */
+export async function hashAllZipEntries(packagePath: string): Promise<Map<string, string>> {
+	const result = new Map<string, string>();
+	const zipfile = await yauzl.open(packagePath);
+	try {
+		for await (const entry of zipfile) {
+			if (entry.filename.endsWith('/')) {
+				continue;
+			}
+			const stream = await zipfile.openReadStream(entry);
+			const hash = crypto.createHash('sha256');
+			await pipeline(stream, hash);
+			result.set(entry.filename, hash.digest('base64'));
+		}
+	} finally {
+		await zipfile.close();
+	}
+
+	return result;
+}
+
 export async function readVSIXPackage(packagePath: string): Promise<Manifest> {
 	const map = await readZip(packagePath, name => /^extension\/package\.json$/i.test(name));
 	const rawManifest = map.get('extension/package.json');