ovsx 1.1.1 → 1.3.0

package/src/verify.ts

@@ -0,0 +1,107 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import { Registry, Extension } from './registry';
+import { addEnvOptions, getTempFilePath } from './util';
+import { readVSIXPackage, readZip } from './zip';
+import { VerifyOptions } from './verify-options';
+
+const SIGNATURE_ENTRY = '.signature.sig';
+
+/**
+ * Verifies a downloaded .vsix package's signature against the registry's public key, the same way
+ * VS Code itself verifies signed packages on install. Mirrors `vsce verify-signature`, except the
+ * signature and public key are fetched from the registry instead of being passed in as separate
+ * files - the registry already exposes both for any published, signed version.
+ */
+export async function verify(options: VerifyOptions): Promise<void> {
+    addEnvOptions(options);
+    const registry = new Registry(options);
+
+    const manifest = await readVSIXPackage(options.packagePath);
+    const namespace = manifest.publisher;
+    const extensionName = manifest.name;
+
+    const latest = await registry.getMetadata(namespace, extensionName, options.target);
+    if (latest.error) {
+        throw new Error(latest.error);
+    }
+
+    const extension = await resolveVersion(registry, latest, manifest.version);
+    const description = `${namespace}.${extensionName} v${extension.version}`;
+
+    const signatureUrl = extension.files.signature;
+    const publicKeyUrl = extension.files.publicKey;
+    if (!signatureUrl || !publicKeyUrl) {
+        throw new Error(`${description} is not signed by the registry - there is nothing to verify.`);
+    }
+
+    const [signature, publicKeyPem] = await Promise.all([
+        downloadSignature(registry, signatureUrl),
+        downloadPublicKey(registry, publicKeyUrl)
+    ]);
+
+    const packageBytes = await fs.promises.readFile(options.packagePath);
+    const publicKey = crypto.createPublicKey({ key: publicKeyPem, format: 'pem' });
+    const verified = crypto.verify(null, packageBytes, publicKey, signature);
+
+    if (!verified) {
+        throw new Error(
+            `${description} does not match the version published to ${registry.url}. `
+            + 'The package may have been tampered with, or did not come from that registry.'
+        );
+    }
+    console.log(`✅  This package is identical to ${description} as published to ${registry.url}.`);
+}
+
+/**
+ * `registry.getMetadata` always returns the latest version. Follow `allVersions` to the exact
+ * version recorded in the package's own manifest when it differs.
+ */
+async function resolveVersion(registry: Registry, extension: Extension, version: string): Promise<Extension> {
+    if (extension.version === version) {
+        return extension;
+    }
+    const versionUrl = extension.allVersions[version];
+    if (!versionUrl) {
+        throw new Error(`${extension.namespace}.${extension.name} has no published version '${version}'.`);
+    }
+    return registry.getJson(new URL(versionUrl));
+}
+
+async function downloadSignature(registry: Registry, url: string): Promise<Buffer> {
+    const sigzipPath = getTempFilePath('.sigzip');
+    try {
+        await registry.download(sigzipPath, new URL(url));
+        const entries = await readZip(sigzipPath, name => name === SIGNATURE_ENTRY);
+        const signature = entries.get(SIGNATURE_ENTRY);
+        if (!signature) {
+            throw new Error(`The signature archive does not contain a '${SIGNATURE_ENTRY}' entry.`);
+        }
+        return signature;
+    } finally {
+        await fs.promises.rm(sigzipPath, { force: true });
+    }
+}
+
+async function downloadPublicKey(registry: Registry, url: string): Promise<string> {
+    const publicKeyPath = getTempFilePath('.pem');
+    try {
+        await registry.download(publicKeyPath, new URL(url));
+        return await fs.promises.readFile(publicKeyPath, 'utf-8');
+    } finally {
+        await fs.promises.rm(publicKeyPath, { force: true });
+    }
+}

package/src/zip.ts

@@ -7,20 +7,13 @@
  *
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
+import * as crypto from 'crypto';
 import * as yauzl from 'yauzl-promise';
-import { Readable } from 'stream';
+import { buffer } from 'stream/consumers';
+import { pipeline } from 'stream/promises';
 import { Manifest } from './util';
 
-async function bufferStream(stream: Readable): Promise<Buffer> {
-	return await new Promise((resolve, reject) => {
-		const buffers: Buffer[] = [];
-		stream.on('data', buffer => buffers.push(buffer));
-		stream.once('error', reject);
-		stream.once('end', () => resolve(Buffer.concat(buffers)));
-	});
-}
-
-async function readZip(packagePath: string, filter: (name: string) => boolean): Promise<Map<string, Buffer>> {
+export async function readZip(packagePath: string, filter: (name: string) => boolean): Promise<Map<string, Buffer>> {
 	const result = new Map<string, Buffer>();
 	const zipfile = await yauzl.open(packagePath);
 	try {
@@ -28,9 +21,36 @@ async function readZip(packagePath: string, filter: (name: string) => boolean):
 			const name = entry.filename.toLowerCase();
 			if (filter(name)) {
 				const stream = await zipfile.openReadStream(entry);
-				const buffer = await bufferStream(stream);
-				result.set(name, buffer);
+				result.set(name, await buffer(stream));
+			}
+		}
+	} finally {
+		await zipfile.close();
+	}
+
+	return result;
+}
+
+/**
+ * Computes the SHA256 digest of every non-directory entry of a zip file, keyed by its exact
+ * (case-preserving) name - unlike {@link readZip}, which lowercases names for its
+ * case-insensitive-filter callers. Used where entry names and digests are compared against another
+ * source of truth, such as a signature manifest that records the original names, without also
+ * having to hold every entry's full content in memory at once alongside it - each entry's content
+ * is streamed straight into a hash and discarded, one entry at a time.
+ */
+export async function hashAllZipEntries(packagePath: string): Promise<Map<string, string>> {
+	const result = new Map<string, string>();
+	const zipfile = await yauzl.open(packagePath);
+	try {
+		for await (const entry of zipfile) {
+			if (entry.filename.endsWith('/')) {
+				continue;
 			}
+			const stream = await zipfile.openReadStream(entry);
+			const hash = crypto.createHash('sha256');
+			await pipeline(stream, hash);
+			result.set(entry.filename, hash.digest('base64'));
 		}
 	} finally {
 		await zipfile.close();

package/lib/version.d.ts

@@ -1,2 +0,0 @@
-export declare const LIB_VERSION = "1.1.1";
-//# sourceMappingURL=version.d.ts.map

package/lib/version.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,UAAU,CAAC"}

package/lib/version.js

@@ -1,5 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LIB_VERSION = void 0;
-exports.LIB_VERSION = "1.1.1";
-//# sourceMappingURL=version.js.map

package/lib/version.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":";;;AAAa,QAAA,WAAW,GAAG,OAAO,CAAC"}

package/src/version.ts

@@ -1 +0,0 @@
-export const LIB_VERSION = "1.1.1";