ovsx 1.1.0 → 1.2.0

package/lib/verify-signature.js

@@ -0,0 +1,105 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignature = verifySignature;
+const crypto = require("crypto");
+const fs = require("fs");
+const zip_1 = require("./zip");
+/**
+ * Verifies a package/manifest/signature file trio entirely offline, the same way `vsce
+ * verify-signature` does - no registry involved, every input is a local file. Unlike `verify`,
+ * which fetches everything it needs from a registry for a package identified by name, this is for
+ * a signature archive you already extracted yourself (e.g. the `.sigzip` a registry serves has a
+ * `.signature.sig` and a `.signature.manifest` entry, matching `--signaturePath` and
+ * `--manifestPath` here).
+ *
+ * `vsce verify-signature` validates against Microsoft's own (closed-source) signing scheme and
+ * has no need for a public key argument - VS Code's Marketplace keys are baked into its verifier.
+ * Open VSX's registries each hold their own Ed25519 key pair instead, so `--publicKeyPath` is
+ * required here to say which registry's signature this is supposed to be.
+ */
+async function verifySignature(options) {
+    const [packageBytes, manifestJson, signature, publicKeyPem] = await Promise.all([
+        fs.promises.readFile(options.packagePath),
+        fs.promises.readFile(options.manifestPath, 'utf-8'),
+        fs.promises.readFile(options.signaturePath),
+        fs.promises.readFile(options.publicKeyPath, 'utf-8')
+    ]);
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestJson);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse the manifest file as JSON: ${err instanceof Error ? err.message : err}`);
+    }
+    const publicKey = crypto.createPublicKey({ key: publicKeyPem, format: 'pem' });
+    const signatureValid = crypto.verify(null, packageBytes, publicKey, signature);
+    if (!signatureValid) {
+        throw new Error('Signature verification failed. The package may have been tampered with.');
+    }
+    const manifestIssues = await checkManifest(options.packagePath, packageBytes, manifest);
+    if (manifestIssues.length > 0) {
+        throw new Error('The signature is valid, but the package does not match the manifest:\n'
+            + manifestIssues.map(issue => `  - ${issue}`).join('\n'));
+    }
+    console.log('✅  Signature is valid.');
+}
+function sha256Base64(content) {
+    return crypto.createHash('sha256').update(content).digest('base64');
+}
+/**
+ * The manifest itself isn't part of what the signature covers - only the raw package bytes are
+ * signed - so this can't add cryptographic trust on its own. It does confirm the manifest wasn't
+ * corrupted or is stale relative to the actual package, and unlike the signature check alone, can
+ * point at exactly which entry doesn't match.
+ */
+async function checkManifest(packagePath, packageBytes, manifest) {
+    const issues = [];
+    const packageDigest = manifest.package?.digests?.sha256;
+    if (packageDigest === undefined) {
+        issues.push('the manifest does not record a package digest');
+    }
+    else if (packageDigest !== sha256Base64(packageBytes)) {
+        issues.push('the package digest does not match the manifest');
+    }
+    const manifestEntries = manifest.entries ?? {};
+    const seenKeys = new Set();
+    // Streamed straight into a digest one entry at a time, rather than buffering every entry's
+    // full content into memory alongside the already-loaded package bytes.
+    const packageEntryDigests = await (0, zip_1.hashAllZipEntries)(packagePath);
+    for (const [name, actualDigest] of packageEntryDigests) {
+        const key = Buffer.from(name, 'utf-8').toString('base64');
+        seenKeys.add(key);
+        const entry = manifestEntries[key];
+        if (!entry) {
+            issues.push(`'${name}' is present in the package but missing from the manifest`);
+            continue;
+        }
+        const entryDigest = entry.digests?.sha256;
+        if (entryDigest === undefined) {
+            issues.push(`'${name}' has no recorded digest in the manifest`);
+        }
+        else if (entryDigest !== actualDigest) {
+            issues.push(`'${name}' does not match its digest in the manifest`);
+        }
+    }
+    for (const key of Object.keys(manifestEntries)) {
+        if (!seenKeys.has(key)) {
+            const name = Buffer.from(key, 'base64').toString('utf-8');
+            issues.push(`'${name}' is listed in the manifest but missing from the package`);
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=verify-signature.js.map

package/lib/verify-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature.js","sourceRoot":"","sources":["../src/verify-signature.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AA8B/E,0CA8BC;AA1DD,iCAAiC;AACjC,yBAAyB;AACzB,+BAA0C;AAa1C;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,eAAe,CAAC,OAA+B;IACjE,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5E,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QACzC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;QACnD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC;KACvD,CAAC,CAAC;IAEH,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACX,wEAAwE;cACtE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3D,CAAC;IACN,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACjC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,WAAmB,EAAE,YAAoB,EAAE,QAA2B;IAC/F,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;IACxD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,aAAa,KAAK,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,2FAA2F;IAC3F,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,MAAM,IAAA,uBAAiB,EAAC,WAAW,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1D,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,2DAA2D,CAAC,CAAC;YACjF,SAAS;QACb,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;QAC1C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,0CAA0C,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,6CAA6C,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,0DAA0D,CAAC,CAAC;QACpF,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/lib/verify.d.ts

@@ -0,0 +1,21 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { VerifyOptions } from './verify-options';
+/**
+ * Verifies a downloaded .vsix package's signature against the registry's public key, the same way
+ * VS Code itself verifies signed packages on install. Mirrors `vsce verify-signature`, except the
+ * signature and public key are fetched from the registry instead of being passed in as separate
+ * files - the registry already exposes both for any published, signed version.
+ */
+export declare function verify(options: VerifyOptions): Promise<void>;
+//# sourceMappingURL=verify.d.ts.map

package/lib/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAO/E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAsClE"}

package/lib/verify.js

@@ -0,0 +1,97 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verify = verify;
+const crypto = require("crypto");
+const fs = require("fs");
+const registry_1 = require("./registry");
+const util_1 = require("./util");
+const zip_1 = require("./zip");
+const SIGNATURE_ENTRY = '.signature.sig';
+/**
+ * Verifies a downloaded .vsix package's signature against the registry's public key, the same way
+ * VS Code itself verifies signed packages on install. Mirrors `vsce verify-signature`, except the
+ * signature and public key are fetched from the registry instead of being passed in as separate
+ * files - the registry already exposes both for any published, signed version.
+ */
+async function verify(options) {
+    (0, util_1.addEnvOptions)(options);
+    const registry = new registry_1.Registry(options);
+    const manifest = await (0, zip_1.readVSIXPackage)(options.packagePath);
+    const namespace = manifest.publisher;
+    const extensionName = manifest.name;
+    const latest = await registry.getMetadata(namespace, extensionName, options.target);
+    if (latest.error) {
+        throw new Error(latest.error);
+    }
+    const extension = await resolveVersion(registry, latest, manifest.version);
+    const description = `${namespace}.${extensionName} v${extension.version}`;
+    const signatureUrl = extension.files.signature;
+    const publicKeyUrl = extension.files.publicKey;
+    if (!signatureUrl || !publicKeyUrl) {
+        throw new Error(`${description} is not signed by the registry - there is nothing to verify.`);
+    }
+    const [signature, publicKeyPem] = await Promise.all([
+        downloadSignature(registry, signatureUrl),
+        downloadPublicKey(registry, publicKeyUrl)
+    ]);
+    const packageBytes = await fs.promises.readFile(options.packagePath);
+    const publicKey = crypto.createPublicKey({ key: publicKeyPem, format: 'pem' });
+    const verified = crypto.verify(null, packageBytes, publicKey, signature);
+    if (!verified) {
+        throw new Error(`${description} does not match the version published to ${registry.url}. `
+            + 'The package may have been tampered with, or did not come from that registry.');
+    }
+    console.log(`✅  This package is identical to ${description} as published to ${registry.url}.`);
+}
+/**
+ * `registry.getMetadata` always returns the latest version. Follow `allVersions` to the exact
+ * version recorded in the package's own manifest when it differs.
+ */
+async function resolveVersion(registry, extension, version) {
+    if (extension.version === version) {
+        return extension;
+    }
+    const versionUrl = extension.allVersions[version];
+    if (!versionUrl) {
+        throw new Error(`${extension.namespace}.${extension.name} has no published version '${version}'.`);
+    }
+    return registry.getJson(new URL(versionUrl));
+}
+async function downloadSignature(registry, url) {
+    const sigzipPath = await (0, util_1.createTempFile)({ postfix: '.sigzip' });
+    try {
+        await registry.download(sigzipPath, new URL(url));
+        const entries = await (0, zip_1.readZip)(sigzipPath, name => name === SIGNATURE_ENTRY);
+        const signature = entries.get(SIGNATURE_ENTRY);
+        if (!signature) {
+            throw new Error(`The signature archive does not contain a '${SIGNATURE_ENTRY}' entry.`);
+        }
+        return signature;
+    }
+    finally {
+        await fs.promises.rm(sigzipPath, { force: true });
+    }
+}
+async function downloadPublicKey(registry, url) {
+    const publicKeyPath = await (0, util_1.createTempFile)({ postfix: '.pem' });
+    try {
+        await registry.download(publicKeyPath, new URL(url));
+        return await fs.promises.readFile(publicKeyPath, 'utf-8');
+    }
+    finally {
+        await fs.promises.rm(publicKeyPath, { force: true });
+    }
+}
+//# sourceMappingURL=verify.js.map

package/lib/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AAiB/E,wBAsCC;AArDD,iCAAiC;AACjC,yBAAyB;AACzB,yCAAiD;AACjD,iCAAuD;AACvD,+BAAiD;AAGjD,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEzC;;;;;GAKG;AACI,KAAK,UAAU,MAAM,CAAC,OAAsB;IAC/C,IAAA,oBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,mBAAQ,CAAC,OAAO,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAe,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,GAAG,SAAS,IAAI,aAAa,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;IAE1E,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;IAC/C,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;IAC/C,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,8DAA8D,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC;QACzC,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC;KAC5C,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,GAAG,WAAW,4CAA4C,QAAQ,CAAC,GAAG,IAAI;cACxE,8EAA8E,CACnF,CAAC;IACN,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,mCAAmC,WAAW,oBAAoB,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;AACnG,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,SAAoB,EAAE,OAAe;IACnF,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,8BAA8B,OAAO,IAAI,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,GAAW;IAC5D,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAc,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC;QACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,IAAA,aAAO,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6CAA6C,eAAe,UAAU,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;YAAS,CAAC;QACP,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,GAAW;IAC5D,MAAM,aAAa,GAAG,MAAM,IAAA,qBAAc,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC;QACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACP,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;AACL,CAAC"}

package/lib/version.d.ts

@@ -1,2 +1,2 @@
-export declare const LIB_VERSION = "1.1.0";
+export declare const LIB_VERSION = "1.2.0";
 //# sourceMappingURL=version.d.ts.map

package/lib/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LIB_VERSION = void 0;
-exports.LIB_VERSION = "1.1.0";
+exports.LIB_VERSION = "1.2.0";
 //# sourceMappingURL=version.js.map

package/lib/zip.d.ts

@@ -1,3 +1,13 @@
 import { Manifest } from './util';
+export declare function readZip(packagePath: string, filter: (name: string) => boolean): Promise<Map<string, Buffer>>;
+/**
+ * Computes the SHA256 digest of every non-directory entry of a zip file, keyed by its exact
+ * (case-preserving) name - unlike {@link readZip}, which lowercases names for its
+ * case-insensitive-filter callers. Used where entry names and digests are compared against another
+ * source of truth, such as a signature manifest that records the original names, without also
+ * having to hold every entry's full content in memory at once alongside it - each entry's content
+ * is streamed straight into a hash and discarded, one entry at a time.
+ */
+export declare function hashAllZipEntries(packagePath: string): Promise<Map<string, string>>;
 export declare function readVSIXPackage(packagePath: string): Promise<Manifest>;
 //# sourceMappingURL=zip.d.ts.map

package/lib/zip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zip.d.ts","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AA8BlC,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQ5E"}
+{"version":3,"file":"zip.d.ts","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAWlC,wBAAsB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBlH;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAkBzF;AAED,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQ5E"}

package/lib/zip.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.readZip = readZip;
+exports.hashAllZipEntries = hashAllZipEntries;
 exports.readVSIXPackage = readVSIXPackage;
 /********************************************************************************
  * Copyright (c) 2024 Precies. Software and others
@@ -10,7 +12,9 @@ exports.readVSIXPackage = readVSIXPackage;
  *
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
+const crypto = require("crypto");
 const yauzl = require("yauzl-promise");
+const promises_1 = require("stream/promises");
 async function bufferStream(stream) {
     return await new Promise((resolve, reject) => {
         const buffers = [];
@@ -37,6 +41,33 @@ async function readZip(packagePath, filter) {
     }
     return result;
 }
+/**
+ * Computes the SHA256 digest of every non-directory entry of a zip file, keyed by its exact
+ * (case-preserving) name - unlike {@link readZip}, which lowercases names for its
+ * case-insensitive-filter callers. Used where entry names and digests are compared against another
+ * source of truth, such as a signature manifest that records the original names, without also
+ * having to hold every entry's full content in memory at once alongside it - each entry's content
+ * is streamed straight into a hash and discarded, one entry at a time.
+ */
+async function hashAllZipEntries(packagePath) {
+    const result = new Map();
+    const zipfile = await yauzl.open(packagePath);
+    try {
+        for await (const entry of zipfile) {
+            if (entry.filename.endsWith('/')) {
+                continue;
+            }
+            const stream = await zipfile.openReadStream(entry);
+            const hash = crypto.createHash('sha256');
+            await (0, promises_1.pipeline)(stream, hash);
+            result.set(entry.filename, hash.digest('base64'));
+        }
+    }
+    finally {
+        await zipfile.close();
+    }
+    return result;
+}
 async function readVSIXPackage(packagePath) {
     const map = await readZip(packagePath, name => /^extension\/package\.json$/i.test(name));
     const rawManifest = map.get('extension/package.json');

package/lib/zip.js.map

@@ -1 +1 @@
-{"version":3,"file":"zip.js","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":";;AAyCA,0CAQC;AAjDD;;;;;;;;kFAQkF;AAClF,uCAAuC;AAIvC,KAAK,UAAU,YAAY,CAAC,MAAgB;IAC3C,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,MAAiC;IAC5E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC;QACJ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,WAAmB;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAa,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"zip.js","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":";;AAwBA,0BAiBC;AAUD,8CAkBC;AAED,0CAQC;AA/ED;;;;;;;;kFAQkF;AAClF,iCAAiC;AACjC,uCAAuC;AAEvC,8CAA2C;AAG3C,KAAK,UAAU,YAAY,CAAC,MAAgB;IAC3C,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,MAAiC;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC;QACJ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC;QACJ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,IAAA,mBAAQ,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,WAAmB;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAa,CAAC;AAC7D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "ovsx",
-    "version": "1.1.0",
+    "version": "1.2.0",
     "description": "Command line interface for Eclipse Open VSX",
     "keywords": [
         "cli",
@@ -31,7 +31,7 @@
     "types": "lib/index",
     "bin": "bin/ovsx",
     "engines": {
-        "node": ">= 20"
+        "node": ">=22.0.0"
     },
     "dependencies": {
         "@inquirer/prompts": "^7.10.1",
@@ -51,23 +51,27 @@
         "@stylistic/eslint-plugin": "^2.11.0",
         "@types/follow-redirects": "^1.13.1",
         "@types/is-ci": "^2.0.0",
-        "@types/node": "^20.14.8",
+        "@types/node": "^22.0.0",
         "@types/semver": "^7.5.8",
         "@types/tmp": "^0.2.2",
         "@types/yauzl-promise": "^4",
+        "@types/yazl": "^3.3.1",
         "@typescript-eslint/eslint-plugin": "^8.15.0",
         "@typescript-eslint/parser": "^8.15.0",
         "eslint": "^9.15.0",
         "limiter": "^2.1.0",
         "rimraf": "^6.0.1",
-        "typescript": "^5.6.3"
+        "typescript": "^5.6.3",
+        "vitest": "^4.1.11",
+        "yazl": "^3.3.1"
     },
     "scripts": {
         "clean": "rimraf lib",
         "prebuild": "node -p \"'export const LIB_VERSION = ' + JSON.stringify(require('./package.json').version) + ';'\" > src/version.ts",
         "build": "tsc -p ./tsconfig.json && yarn run lint",
         "watch": "tsc -w -p ./tsconfig.json",
-        "lint": "eslint -c ./configs/eslintrc.mjs src",
+        "test": "vitest run",
+        "lint": "eslint -c ./configs/eslintrc.mjs src test",
         "prepare": "yarn run clean && yarn run prebuild && yarn run build",
         "publish:next": "yarn npm publish --tag next",
         "publish:latest": "yarn npm publish --tag latest",

package/src/get.ts

@@ -23,7 +23,7 @@ export async function getExtension(options: GetOptions): Promise<void> {
     const registry = new Registry(options);
     const match = matchExtensionId(options.extensionId);
     if (!match) {
-        throw new Error('The extension identifier must have the form `namespace.extension`.');
+        throw new Error('The extension identifier must have the form `namespace.extension` or `namespace/extension`.');
     }
 
     const extension = await registry.getMetadata(match[1], match[2], options.target);

package/src/index.ts

@@ -19,6 +19,10 @@ export * from './publish';
 export * from './publish-options';
 export * from './registry';
 export * from './registry-options';
+export * from './trusted-publishing';
+export * from './trusted-publishing-options';
+export * from './unpublish';
+export * from './unpublish-options';
 export * from './verify-pat';
 export * from './verify-pat-options';
 export { isLicenseOk } from './check-license';

package/src/list-options.ts

@@ -0,0 +1,25 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import { RegistryOptions } from './registry-options';
+
+export interface ListOptions extends RegistryOptions {
+    /**
+     * Namespace whose extensions should be listed.
+     */
+    namespace: string;
+    /**
+     * Print the raw namespace metadata as JSON instead of a list.
+     */
+    json?: boolean;
+}

package/src/list.ts

@@ -0,0 +1,48 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import { ListOptions } from './list-options';
+import { Registry } from './registry';
+import { formatCount } from './table';
+import { addEnvOptions } from './util';
+
+/**
+ * Lists the extensions published in a namespace.
+ */
+export async function list(options: ListOptions): Promise<void> {
+    addEnvOptions(options);
+    const registry = new Registry(options);
+    const namespace = await registry.getNamespace(options.namespace);
+    if (namespace.error) {
+        throw new Error(namespace.error);
+    }
+
+    if (options.json) {
+        console.log(JSON.stringify(namespace, null, 4));
+        return;
+    }
+
+    // Sorted here rather than relying on the response's key order, so the output is stable and
+    // scriptable regardless of how the registry happens to serialise the map.
+    const names = Object.keys(namespace.extensions ?? {}).sort((a, b) => a.localeCompare(b));
+    const verified = namespace.verified ? ' (verified)' : '';
+    console.log(`${namespace.name}${verified} - ${formatCount(names.length, 'extension')}`);
+    if (names.length === 0) {
+        return;
+    }
+
+    console.log();
+    for (const name of names) {
+        console.log(`  ${namespace.name}.${name}`);
+    }
+}

package/src/main.ts

@@ -13,8 +13,14 @@ import * as leven from 'leven';
 import { createNamespace } from './create-namespace';
 import { verifyPat } from './verify-pat';
 import { publish } from './publish';
-import { handleError } from './util';
+import { unpublish } from './unpublish';
+import { handleError, parseNonNegativeInt } from './util';
 import { getExtension } from './get';
+import { list } from './list';
+import { DEFAULT_SEARCH_SIZE, SORT_KEYS, SORT_ORDERS, search } from './search';
+import { show } from './show';
+import { verify } from './verify';
+import { verifySignature } from './verify-signature';
 import login from './login';
 import logout from './logout';
 import { LIB_VERSION } from './version';
@@ -50,12 +56,16 @@ module.exports = function (argv: string[]): void {
         .option('--baseContentUrl <url>', 'Prepend all relative links in README.md with this URL.')
         .option('--baseImagesUrl <url>', 'Prepend all relative image links in README.md with this URL.')
         .option('--yarn', 'Use yarn instead of npm while packing extension files.')
+        .option('--follow-symlinks', 'Recurse into symlinked directories instead of packing each symlink as a file.')
         .option('--pre-release', 'Mark this package as a pre-release')
         .option('--allow-missing-repository', 'Allow packaging an extension whose package.json has no repository field')
         .option('--no-dependencies', 'Disable dependency detection via npm or yarn')
         .option('--skip-duplicate', 'Fail silently if version already exists on the marketplace')
         .option('--packageVersion <version>', 'Version of the provided VSIX packages.')
-        .action((extensionFile: string, { target, packagePath, baseContentUrl, baseImagesUrl, yarn, preRelease, allowMissingRepository, dependencies, skipDuplicate, packageVersion }) => {
+        .option('--trusted-publishing', 'Exchange an OIDC ID token for a short-lived publishing token. Enabled automatically when a CI system provides an ID token and no access token is given.')
+        .option('--idToken <token>', 'The OIDC ID token to exchange. Only needed on CI systems that provide the token directly, e.g. GitLab CI.')
+        .option('--oidcAudience <audience>', 'Audience to request for the OIDC ID token. Defaults to the registry URL.')
+        .action((extensionFile: string, { target, packagePath, baseContentUrl, baseImagesUrl, yarn, followSymlinks, preRelease, allowMissingRepository, dependencies, skipDuplicate, packageVersion, trustedPublishing, idToken, oidcAudience }) => {
             if (extensionFile !== undefined && packagePath !== undefined) {
                 console.error('\u274c  Please specify either a package file or a package path, but not both.\n');
                 publishCmd.help();
@@ -70,12 +80,14 @@ module.exports = function (argv: string[]): void {
                 console.warn("Ignoring option '--baseImagesUrl' for prepackaged extension.");
             if (extensionFile !== undefined && yarn !== undefined)
                 console.warn("Ignoring option '--yarn' for prepackaged extension.");
+            if (extensionFile !== undefined && followSymlinks !== undefined)
+                console.warn("Ignoring option '--follow-symlinks' for prepackaged extension.");
             if (extensionFile !== undefined && packageVersion !== undefined)
                 console.warn("Ignoring option '--packageVersion' for prepackaged extension.");
             if (extensionFile !== undefined && allowMissingRepository !== undefined)
                 console.warn("Ignoring option '--allow-missing-repository' for prepackaged extension.");
             const { registryUrl, pat } = program.opts();
-            publish({ extensionFile, registryUrl, pat, targets: typeof target === 'string' ? [target] : target, packagePath: typeof packagePath === 'string' ? [packagePath] : packagePath, baseContentUrl, baseImagesUrl, yarn, preRelease, allowMissingRepository, dependencies, skipDuplicate, packageVersion })
+            publish({ extensionFile, registryUrl, pat, targets: typeof target === 'string' ? [target] : target, packagePath: typeof packagePath === 'string' ? [packagePath] : packagePath, baseContentUrl, baseImagesUrl, yarn, followSymlinks, preRelease, allowMissingRepository, dependencies, skipDuplicate, packageVersion, trustedPublishing, idToken, oidcAudience })
                 .then(results => {
                     const reasons = results.filter(result => result.status === 'rejected')
                         .map(rejectedResult => rejectedResult.reason);
@@ -93,6 +105,60 @@ module.exports = function (argv: string[]): void {
                 });
         });
 
+    const unpublishCmd = program.command('unpublish [namespace.extension]');
+    unpublishCmd.description('Delete an extension or some of its versions from the registry.')
+        .option('-v, --versions <versions...>', 'Only delete the given versions.')
+        .option('-t, --target <targets...>', 'Only delete the given target architectures of the given versions.')
+        .option('-f, --force', 'Skip the confirmation prompt.')
+        .action((extensionId: string | undefined, { versions, target, force }) => {
+            const { registryUrl, pat } = program.opts();
+            unpublish({
+                extensionId,
+                versions: typeof versions === 'string' ? [versions] : versions,
+                targets: typeof target === 'string' ? [target] : target,
+                force,
+                registryUrl,
+                pat
+            }).catch(handleError(program.debug));
+        });
+
+    const searchCmd = program.command('search [text]');
+    searchCmd.description('Search the registry for extensions.')
+        .option('-c, --category <category>', 'Only return extensions in this category.')
+        .option('-t, --target <target>', 'Only return extensions built for this target architecture.')
+        .option(
+            '-s, --size <size>',
+            `Number of results to return (default ${DEFAULT_SEARCH_SIZE}).`,
+            parseNonNegativeInt
+        )
+        .option('-o, --offset <offset>', 'Index of the first result, for paging.', parseNonNegativeInt)
+        .option('--sort-by <key>', `Sort key: ${SORT_KEYS.join(', ')}.`)
+        .option('--sort-order <order>', `Sort order: ${SORT_ORDERS.join(', ')}.`)
+        .option('--json', 'Print the raw results as JSON.')
+        .action((text: string | undefined, { category, target, size, offset, sortBy, sortOrder, json }) => {
+            const { registryUrl } = program.opts();
+            search({ text, category, target, size, offset, sortBy, sortOrder, json, registryUrl })
+                .catch(handleError(program.debug));
+        });
+
+    const listCmd = program.command('list <namespace>');
+    listCmd.description('List the extensions published in a namespace.')
+        .option('--json', 'Print the raw namespace metadata as JSON.')
+        .action((namespace: string, { json }) => {
+            const { registryUrl } = program.opts();
+            list({ namespace, json, registryUrl }).catch(handleError(program.debug));
+        });
+
+    const showCmd = program.command('show <namespace.extension[@version]>');
+    showCmd.description('Show an extension\'s metadata.')
+        .option('-t, --target <target>', 'Only report on the given target architecture.')
+        .option('--all-versions', 'List every published version instead of the most recent few.')
+        .option('--json', 'Print the raw metadata as JSON.')
+        .action((extensionId: string, { target, allVersions, json }) => {
+            const { registryUrl } = program.opts();
+            show({ extensionId, target, allVersions, json, registryUrl }).catch(handleError(program.debug));
+        });
+
     const getCmd = program.command('get <namespace.extension>');
     getCmd.description('Download an extension or its metadata.')
         .option('-t, --target <target>', 'Target architecture')
@@ -105,6 +171,26 @@ module.exports = function (argv: string[]): void {
                 .catch(handleError(program.debug));
         });
 
+    const verifyCmd = program.command('verify <extension.vsix>');
+    verifyCmd.description('Verify a downloaded package\'s signature against the registry\'s public key.')
+        .option('-t, --target <target>', 'Target architecture')
+        .action((packagePath: string, { target }) => {
+            const { registryUrl } = program.opts();
+            verify({ packagePath, target, registryUrl })
+                .catch(handleError(program.debug));
+        });
+
+    const verifySignatureCmd = program.command('verify-signature');
+    verifySignatureCmd.description('Verify a signature file against a package and manifest, entirely offline - like `vsce verify-signature`.')
+        .requiredOption('-i, --packagePath <path>', 'Path to the .vsix package.')
+        .requiredOption('-m, --manifestPath <path>', 'Path to the signature manifest file.')
+        .requiredOption('-s, --signaturePath <path>', 'Path to the signature file.')
+        .requiredOption('-k, --publicKeyPath <path>', 'Path to the registry\'s public key file.')
+        .action(({ packagePath, manifestPath, signaturePath, publicKeyPath }) => {
+            verifySignature({ packagePath, manifestPath, signaturePath, publicKeyPath })
+                .catch(handleError(program.debug));
+        });
+
     const loginCmd = program.command('login <namespace>');
     loginCmd.description('Adds a namespace to the list of known namespaces')
         .action((namespace: string) => {