ovsx 1.1.1 → 1.3.0

package/src/unpublish-options.ts

@@ -0,0 +1,35 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import { RegistryOptions } from './registry-options';
+
+export interface UnpublishOptions extends RegistryOptions {
+    /**
+     * Identifier in the form `namespace.extension` or `namespace/extension`.
+     * Read from the `package.json` in the current directory if omitted.
+     */
+    extensionId?: string;
+    /**
+     * Versions to delete. All versions are deleted if omitted.
+     */
+    versions?: string[];
+    /**
+     * Target platforms to delete. All target platforms of the selected versions
+     * are deleted if omitted. Can only be used together with `versions`.
+     */
+    targets?: string[];
+    /**
+     * Delete without asking for confirmation.
+     */
+    force?: boolean;
+}

package/src/unpublish.ts

@@ -0,0 +1,160 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import { confirm } from '@inquirer/prompts';
+// `import * as isCI from 'is-ci'` would bind to a namespace object instead of the boolean `is-ci`
+// exports whenever the importer applies ES module interop (e.g. a bundler, or vitest's own
+// transform), making the truthiness check below always true. `import = require` always binds
+// directly to the exported value, regardless of how the importing tool handles interop.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+import isCI = require('is-ci');
+import * as semver from 'semver';
+import { getPAT } from './pat';
+import { Registry, TargetPlatformVersion } from './registry';
+import { UnpublishOptions } from './unpublish-options';
+import { addEnvOptions, matchExtensionId, readManifest } from './util';
+
+/**
+ * Oldest registry version that exposes the `delete` endpoint used by this command.
+ */
+export const MIN_UNPUBLISH_REGISTRY_VERSION = '1.2.0';
+
+/**
+ * Deletes an extension or some of its versions from the registry.
+ */
+export async function unpublish(options: UnpublishOptions = {}): Promise<void> {
+    addEnvOptions(options);
+    if (options.targets && !options.versions) {
+        throw new Error("Please specify the versions to delete with '--versions' when using '--target'.");
+    }
+
+    const extensionId = options.extensionId ?? await readExtensionId();
+    const match = matchExtensionId(extensionId);
+    if (!match) {
+        throw new Error('The extension identifier must have the form `namespace.extension` or `namespace/extension`.');
+    }
+
+    const [, namespace, extension] = match;
+    const registry = new Registry(options);
+    await ensureUnpublishSupported(registry);
+
+    options.pat = await getPAT(namespace, { ...options, namespace }, false);
+
+    const targetVersions = getTargetVersions(options);
+    await confirmUnpublish(`${namespace}.${extension}`, targetVersions, registry.url, options.force);
+
+    const result = await registry.deleteExtension(namespace, extension, targetVersions, options.pat);
+    if (result.error) {
+        throw new Error(result.error);
+    }
+    // the registry reports one line per deleted version, and nothing at all if there was nothing to delete
+    console.log(`🗑  ${result.success || `Nothing to delete for ${namespace}.${extension}`}`);
+}
+
+/**
+ * Reads the extension identifier from the `package.json` in the current directory,
+ * so that `ovsx unpublish` can be run from an extension folder without arguments.
+ */
+async function readExtensionId(): Promise<string> {
+    let error;
+    try {
+        const manifest = await readManifest();
+        if (manifest.publisher && manifest.name) {
+            return `${manifest.publisher}.${manifest.name}`;
+        }
+    } catch (e) {
+        error = e;
+    }
+
+    throw new Error(
+        'Unable to read the extension identifier. Please supply it as an argument or run ovsx from the extension folder.' +
+        (error ? `\n\n${error}` : '')
+    );
+}
+
+/**
+ * Fails fast with an actionable message when the registry is known to be too old to support
+ * deleting extensions, rather than letting the delete request fail with a generic 404.
+ *
+ * The check is best-effort: registries that don't expose `/api/version` at all, or report a
+ * version that can't be parsed as semver (e.g. a build without `ovsx.registry.version` set),
+ * are assumed to support the endpoint. The delete request itself will surface any real
+ * incompatibility in that case.
+ */
+async function ensureUnpublishSupported(registry: Registry): Promise<void> {
+    let reportedVersion: string | undefined;
+    try {
+        reportedVersion = (await registry.getRegistryVersion()).version;
+    } catch {
+        return;
+    }
+
+    // `coerce` drops any prerelease/build suffix (e.g. `1.2.0-dev.0` or `1.2.0-SNAPSHOT` both
+    // become `1.2.0`), so development builds of a supported release compare as supported too.
+    const version = semver.coerce(reportedVersion);
+    if (version && semver.lt(version, MIN_UNPUBLISH_REGISTRY_VERSION)) {
+        throw new Error(
+            `The registry at ${registry.url} runs version ${reportedVersion}, but deleting extensions requires `
+            + `version ${MIN_UNPUBLISH_REGISTRY_VERSION} or later.`
+        );
+    }
+}
+
+/**
+ * Returns the versions to delete, or `undefined` to delete the extension as a whole.
+ * A version without target platform tells the registry to delete all target platforms
+ * of that version.
+ */
+function getTargetVersions(options: UnpublishOptions): TargetPlatformVersion[] | undefined {
+    if (!options.versions) {
+        return undefined;
+    }
+    if (!options.targets) {
+        return options.versions.map(version => ({ version }));
+    }
+
+    return options.versions.flatMap(
+        version => options.targets!.map(targetPlatform => ({ version, targetPlatform }))
+    );
+}
+
+async function confirmUnpublish(
+    extensionId: string,
+    targetVersions: TargetPlatformVersion[] | undefined,
+    registryUrl: string,
+    force?: boolean
+): Promise<void> {
+    if (force) {
+        return;
+    }
+    if (isCI || !process.stdin.isTTY) {
+        throw new Error("Aborted. Use '--force' to delete without confirmation.");
+    }
+
+    const what = targetVersions
+        ? targetVersions.map(target => describe(extensionId, target)).join(', ')
+        : `all versions of ${extensionId}`;
+    const confirmed = await confirm({
+        message: `Delete ${what} from ${registryUrl}? Deleted versions can never be published again.`,
+        default: false
+    });
+
+    if (!confirmed) {
+        throw new Error('Aborted.');
+    }
+}
+
+function describe(extensionId: string, target: TargetPlatformVersion): string {
+    const version = `${extensionId} v${target.version}`;
+    return target.targetPlatform ? `${version}@${target.targetPlatform}` : version;
+}

package/src/util.ts

@@ -8,55 +8,106 @@
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
 
+import * as crypto from 'crypto';
 import * as fs from 'fs';
+import * as os from 'os';
 import * as path from 'path';
-import * as tmp from 'tmp';
 import * as http from 'http';
 import { RegistryOptions } from './registry-options';
-
-export { promisify } from 'util';
+import { TrustedPublishingOptions } from './trusted-publishing-options';
 
 export function addEnvOptions(options: RegistryOptions): void {
     options.registryUrl ??= process.env.OVSX_REGISTRY_URL;
     options.pat ??= process.env.OVSX_PAT;
     options.username ??= process.env.OVSX_USERNAME;
     options.password ??= process.env.OVSX_PASSWORD;
+    options.timeout ??= parseIntEnv(process.env.OVSX_TIMEOUT);
 }
 
-export function matchExtensionId(id: string): RegExpExecArray | null {
-    return /^([\w-]+)(?:\.|\/)([\w-]+)$/.exec(id);
+export function addTrustedPublishingEnvOptions(options: TrustedPublishingOptions): void {
+    options.trustedPublishing ??= parseBooleanEnv(process.env.OVSX_TRUSTED_PUBLISHING);
+    options.idToken ??= process.env.OVSX_ID_TOKEN;
+    options.oidcAudience ??= process.env.OVSX_OIDC_AUDIENCE;
 }
 
-export function optionalStat(path: fs.PathLike): Promise<fs.Stats | undefined> {
-    return new Promise((resolve, reject) => {
-        fs.stat(path, (err, stats) => resolve(stats));
-    });
+/** How long a request may make no progress before it is abandoned; see RegistryOptions.timeout. */
+export const DEFAULT_TIMEOUT = 30_000;
+
+/**
+ * The configured request timeout, for requests that have no RegistryOptions to read it from - the CI
+ * token exchange deliberately shares nothing with the registry, but there is no reason for it to be
+ * on a different clock.
+ */
+export function configuredTimeout(): number {
+    return parseIntEnv(process.env.OVSX_TIMEOUT) ?? DEFAULT_TIMEOUT;
 }
 
-export function makeDirs(path: fs.PathLike): Promise<void> {
-    return new Promise((resolve, reject) => {
-        if (fs.existsSync(path)) {
-            resolve();
-        } else {
-            fs.mkdir(path, { recursive: true }, (err: NodeJS.ErrnoException | null) => {
-                if (err)
-                    reject(err);
-                else
-                    resolve();
-            });
+function parseIntEnv(value?: string): number | undefined {
+    if (value === undefined || value.trim().length === 0) {
+        return undefined;
+    }
+    const parsed = Number(value.trim());
+    // Left undefined rather than throwing, so a mistyped variable falls back to the default instead
+    // of stopping a command that would otherwise work.
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : undefined;
+}
+
+function parseBooleanEnv(value?: string): boolean | undefined {
+    if (value === undefined || value.trim().length === 0) {
+        return undefined;
+    }
+    return ['true', '1', 'yes'].includes(value.trim().toLowerCase());
+}
+
+/**
+ * Parses a commander option that must be a non-negative whole number, so a typo is reported by the
+ * CLI rather than sent to the registry as a bad request.
+ */
+export function parseNonNegativeInt(value: string): number {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        throw new Error(`Expected a non-negative whole number, got '${value}'.`);
+    }
+    return parsed;
+}
+
+export function matchExtensionId(id: string): RegExpExecArray | null {
+    return /^([\w-]+)(?:\.|\/)([\w-]+)$/.exec(id);
+}
+
+/**
+ * Levenshtein distance between `a` and `b`: the minimum number of single-character insertions,
+ * deletions or substitutions needed to turn one into the other. Used to suggest the closest known
+ * command for a typo.
+ */
+export function levenshtein(a: string, b: string): number {
+    if (a === b) {
+        return 0;
+    }
+    // The distance is symmetric, so keep the shorter string in `b` to bound the row size.
+    if (b.length > a.length) {
+        [a, b] = [b, a];
+    }
+    // A single row of the edit distance matrix, seeded with the distance between the empty prefix
+    // of `a` and every prefix of `b`.
+    const row = Array.from({ length: b.length + 1 }, (_, j) => j);
+    for (let i = 1; i <= a.length; i++) {
+        let diagonal = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const above = row[j];
+            row[j] = Math.min(row[j - 1] + 1, above + 1, diagonal + (a[i - 1] === b[j - 1] ? 0 : 1));
+            diagonal = above;
         }
-    });
+    }
+    return row[b.length];
 }
 
-export function createTempFile(options: tmp.TmpNameOptions): Promise<string> {
-    return new Promise((resolve, reject) => {
-        tmp.tmpName(options, (err: Error | null, name: string) => {
-            if (err)
-                reject(err);
-            else
-                resolve(name);
-        });
-    });
+/**
+ * Returns a random, not-yet-created file path ending in `postfix`, directly in the OS temp directory.
+ */
+export function getTempFilePath(postfix = ''): string {
+    return path.join(os.tmpdir(), `ovsx-${crypto.randomUUID()}${postfix}`);
 }
 
 export function rejectError(err: any) {
@@ -85,31 +136,65 @@ export function handleError(debug?: boolean, additionalMessage?: string, exit: b
     };
 }
 
-export function statusError(response: http.IncomingMessage): Error {
-    if (response.statusMessage)
-        return new Error(`The server responded with status ${response.statusCode}: ${response.statusMessage}`);
-    else
-        return new Error(`The server responded with status ${response.statusCode}.`);
-}
-
-export function readFile(name: string, packagePath?: string, encoding: BufferEncoding = 'utf-8'): Promise<string> {
-    return new Promise((resolve, reject) => {
-        fs.readFile(
-            path.join(packagePath ?? process.cwd(), name),
-            { encoding },
-            (err: NodeJS.ErrnoException | null, content: string) => {
-                if (err) {
-                    reject(err);
-                } else {
-                    resolve(content);
-                }
-            }
-        );
-    });
+/**
+ * Formats a byte count for display, e.g. `1536` -> `1.5 KB`. Mirrors the registry's own
+ * `FileUtils.byteCountToDisplaySize` formatting so client- and server-side size limit messages read
+ * the same way.
+ */
+export function formatBytes(bytes: number): string {
+    const units = ['bytes', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB'];
+    let size = bytes;
+    let unit = 0;
+    while (size >= 1024 && unit < units.length - 1) {
+        size /= 1024;
+        unit++;
+    }
+    return `${Math.floor(size)} ${units[unit]}`;
+}
+
+/**
+ * An error carrying the HTTP status that produced it, so a caller can tell "the registry refused this"
+ * from "the registry could not answer right now" without matching on the message.
+ */
+export interface StatusError extends Error {
+    status?: number;
+}
+
+export function withStatus(error: Error, status?: number): StatusError {
+    const withStatusCode = error as StatusError;
+    withStatusCode.status = status;
+    return withStatusCode;
+}
+
+/**
+ * A URL in the form it can safely be printed: no user info and no query string.
+ *
+ * The personal access token travels in a header now, but `createNamespace`, `verifyPat`, `publish`
+ * and `delete` still carry it in the query string too when talking to a registry too old to resolve
+ * it from the header (see `Registry.tokenQuery`, #1344). An error message goes straight to stderr
+ * and from there into CI logs, and the query carries nothing an error needs - so it stays dropped
+ * whole rather than filtered key by key, a filter having to be kept in step with every parameter
+ * anyone ever adds.
+ */
+export function redactUrl(url: URL | string): string {
+    try {
+        const parsed = typeof url === 'string' ? new URL(url) : url;
+        return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+    } catch {
+        // Not parseable, so nothing can be assumed about what it holds.
+        return '<url>';
+    }
+}
+
+export function statusError(response: http.IncomingMessage): StatusError {
+    const message = response.statusMessage
+        ? `The server responded with status ${response.statusCode}: ${response.statusMessage}`
+        : `The server responded with status ${response.statusCode}.`;
+    return withStatus(new Error(message), response.statusCode);
 }
 
 export async function readManifest(packagePath?: string): Promise<Manifest> {
-    const content = await readFile('package.json', packagePath);
+    const content = await fs.promises.readFile(path.join(packagePath ?? process.cwd(), 'package.json'), 'utf-8');
     return JSON.parse(content);
 }
 
@@ -125,26 +210,9 @@ export function validateManifest(manifest: Manifest): void {
     }
 }
 
-export function writeFile(name: string, content: string, packagePath?: string, encoding: BufferEncoding = 'utf-8'): Promise<void> {
-    return new Promise((resolve, reject) => {
-        fs.writeFile(
-            path.join(packagePath ?? process.cwd(), name),
-            content,
-            { encoding },
-            (err: NodeJS.ErrnoException | null) => {
-                if (err) {
-                    reject(err);
-                } else {
-                    resolve();
-                }
-            }
-        );
-    });
-}
-
 export function writeManifest(manifest: Manifest, packagePath?: string): Promise<void> {
     const content = JSON.stringify(manifest, null, 4);
-    return writeFile('package.json', content, packagePath);
+    return fs.promises.writeFile(path.join(packagePath ?? process.cwd(), 'package.json'), content, 'utf-8');
 }
 
 export interface Manifest {

package/src/verify-options.ts

@@ -0,0 +1,25 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import { RegistryOptions } from './registry-options';
+
+export interface VerifyOptions extends RegistryOptions {
+    /**
+     * Path to the downloaded .vsix package to verify.
+     */
+    packagePath: string;
+    /**
+     * Target platform. Defaults to universal.
+     */
+    target?: string;
+}

package/src/verify-signature-options.ts

@@ -0,0 +1,32 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+export interface VerifySignatureOptions {
+    /**
+     * Path to the .vsix package.
+     */
+    packagePath: string;
+    /**
+     * Path to the signature manifest file (the `.signature.manifest` entry of a registry's
+     * signature archive).
+     */
+    manifestPath: string;
+    /**
+     * Path to the signature file (the `.signature.sig` entry of a registry's signature archive).
+     */
+    signaturePath: string;
+    /**
+     * Path to the registry's public key file, in PEM format.
+     */
+    publicKeyPath: string;
+}

package/src/verify-signature.ts

@@ -0,0 +1,124 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import { hashAllZipEntries } from './zip';
+import { VerifySignatureOptions } from './verify-signature-options';
+
+interface DigestEntry {
+    size?: number;
+    digests?: { sha256?: string };
+}
+
+interface SignatureManifest {
+    package?: DigestEntry;
+    entries?: { [base64Name: string]: DigestEntry };
+}
+
+/**
+ * Verifies a package/manifest/signature file trio entirely offline, the same way `vsce
+ * verify-signature` does - no registry involved, every input is a local file. Unlike `verify`,
+ * which fetches everything it needs from a registry for a package identified by name, this is for
+ * a signature archive you already extracted yourself (e.g. the `.sigzip` a registry serves has a
+ * `.signature.sig` and a `.signature.manifest` entry, matching `--signaturePath` and
+ * `--manifestPath` here).
+ *
+ * `vsce verify-signature` validates against Microsoft's own (closed-source) signing scheme and
+ * has no need for a public key argument - VS Code's Marketplace keys are baked into its verifier.
+ * Open VSX's registries each hold their own Ed25519 key pair instead, so `--publicKeyPath` is
+ * required here to say which registry's signature this is supposed to be.
+ */
+export async function verifySignature(options: VerifySignatureOptions): Promise<void> {
+    const [packageBytes, manifestJson, signature, publicKeyPem] = await Promise.all([
+        fs.promises.readFile(options.packagePath),
+        fs.promises.readFile(options.manifestPath, 'utf-8'),
+        fs.promises.readFile(options.signaturePath),
+        fs.promises.readFile(options.publicKeyPath, 'utf-8')
+    ]);
+
+    let manifest: SignatureManifest;
+    try {
+        manifest = JSON.parse(manifestJson);
+    } catch (err) {
+        throw new Error(`Failed to parse the manifest file as JSON: ${err instanceof Error ? err.message : err}`);
+    }
+
+    const publicKey = crypto.createPublicKey({ key: publicKeyPem, format: 'pem' });
+    const signatureValid = crypto.verify(null, packageBytes, publicKey, signature);
+    if (!signatureValid) {
+        throw new Error('Signature verification failed. The package may have been tampered with.');
+    }
+
+    const manifestIssues = await checkManifest(options.packagePath, packageBytes, manifest);
+    if (manifestIssues.length > 0) {
+        throw new Error(
+            'The signature is valid, but the package does not match the manifest:\n'
+            + manifestIssues.map(issue => `  - ${issue}`).join('\n')
+        );
+    }
+
+    console.log('✅  Signature is valid.');
+}
+
+function sha256Base64(content: Buffer): string {
+    return crypto.createHash('sha256').update(content).digest('base64');
+}
+
+/**
+ * The manifest itself isn't part of what the signature covers - only the raw package bytes are
+ * signed - so this can't add cryptographic trust on its own. It does confirm the manifest wasn't
+ * corrupted or is stale relative to the actual package, and unlike the signature check alone, can
+ * point at exactly which entry doesn't match.
+ */
+async function checkManifest(packagePath: string, packageBytes: Buffer, manifest: SignatureManifest): Promise<string[]> {
+    const issues: string[] = [];
+
+    const packageDigest = manifest.package?.digests?.sha256;
+    if (packageDigest === undefined) {
+        issues.push('the manifest does not record a package digest');
+    } else if (packageDigest !== sha256Base64(packageBytes)) {
+        issues.push('the package digest does not match the manifest');
+    }
+
+    const manifestEntries = manifest.entries ?? {};
+    const seenKeys = new Set<string>();
+
+    // Streamed straight into a digest one entry at a time, rather than buffering every entry's
+    // full content into memory alongside the already-loaded package bytes.
+    const packageEntryDigests = await hashAllZipEntries(packagePath);
+    for (const [name, actualDigest] of packageEntryDigests) {
+        const key = Buffer.from(name, 'utf-8').toString('base64');
+        seenKeys.add(key);
+        const entry = manifestEntries[key];
+        if (!entry) {
+            issues.push(`'${name}' is present in the package but missing from the manifest`);
+            continue;
+        }
+        const entryDigest = entry.digests?.sha256;
+        if (entryDigest === undefined) {
+            issues.push(`'${name}' has no recorded digest in the manifest`);
+        } else if (entryDigest !== actualDigest) {
+            issues.push(`'${name}' does not match its digest in the manifest`);
+        }
+    }
+
+    for (const key of Object.keys(manifestEntries)) {
+        if (!seenKeys.has(key)) {
+            const name = Buffer.from(key, 'base64').toString('utf-8');
+            issues.push(`'${name}' is listed in the manifest but missing from the package`);
+        }
+    }
+
+    return issues;
+}