package-registry-manager 0.26.0 → 0.27.1

package/CHANGELOG.md

@@ -27,6 +27,13 @@ currently shares its release version with the Rust implementation.
 - An npm first publish stops before the sign-in when the packed tarball
   contains repository development directories such as `.github/` or `tests/`,
   which a package.json without a `files` allowlist lets in.
+- SwiftPM packages (`--registry swift`) are discovered from `Package.swift`
+  and `swift/VERSION` and verified by exact bare tag, commit, tagged manifest,
+  public release and consumer (#77). Kotlin Multiplatform Gradle publications
+  are discovered with their platform variants and verified by root POM,
+  `.module` metadata and every variant (#78).
+- Generated Central, Packagist and SwiftPM setup steps run their own handlers;
+  manual prerequisites stay incomplete without read-back evidence (#79).
 
 ### Changed
 
@@ -62,6 +69,9 @@ currently shares its release version with the Rust implementation.
   packages; they appear with `"steps": []` and a `skipped_reason`, and `setup`
   picks the only publishable package when a registry also has private ones
   (#4).
+- Central and Packagist steps no longer reach the crates.io session (#79).
+  Account scans fetch referenced version sidecars at the scanned commit, so
+  they agree with local inspection (#80).
 
 ## [0.19.35] - 2026-09-21
 

package/README.md

@@ -82,3 +82,11 @@ NuGet setup uses an explicit login profile, package owner and exact package IDs.
 Trusted publishing is preferred; existing provided fallback credentials are retained.
 See [audit and NuGet configuration](../docs/issue-73-requirements.md) for setup,
 identity decisions and the distinction between verified configuration and release.
+
+NuGet setup resolves reusable publishing identities and verifies saved policy
+scopes after reload. Package renames repair the oldest matching policy in place,
+preserving identity and unrelated policies; first publication requires the exact
+new ID and explicit `package:push` authorization. Maven Central setup verifies authenticated namespace
+ownership before a first release, supports explicitly authorized GnuPG signing
+bootstrap, and preserves actual token expiry metadata. Both runtimes use the same
+page adapters and GPG driver. See the [Central setup configuration](../README.md#maven-central).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.26.0",
+  "version": "0.27.1",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -40,7 +40,7 @@
     "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
-    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/0b3ceb1590be7eb0340ae088730698b5ae9bebfc",
+    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/cab12f0404d1bc90c72eacea533ce3d5ae8f4894",
     "browser-commander": "^0.34.1",
     "command-stream": "^2.6.0",
     "playwright": "^1.63.0",

package/src/central-gpg.mjs

@@ -0,0 +1,278 @@
+import { spawn } from "node:child_process";
+import { mkdtemp, readFile, writeFile, rm, mkdir } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+
+/** Run exact GPG arguments; private input/output and diagnostics are never logged. */
+async function command(program, args, input = "", options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(program, args, {
+      ...options,
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    const output = [];
+    let length = 0;
+    child.stdout.on("data", (chunk) => {
+      length += chunk.length;
+      if (length > 2 * 1024 * 1024) {
+        child.kill();
+      } else {
+        output.push(chunk);
+      }
+    });
+    child.stderr.resume();
+    child.on("error", () =>
+      reject(new Error("GnuPG is unavailable; no signing values were logged")),
+    );
+    child.on("close", (code) =>
+      code === 0
+        ? resolve(Buffer.concat(output).toString())
+        : reject(
+            new Error("GnuPG operation failed; private diagnostics withheld"),
+          ),
+    );
+    child.stdin.on("error", () => {});
+    child.stdin.end(input);
+  });
+}
+
+/** Isolated GPG signing round trip and independent public-key verification. */
+export async function provisionSigning(
+  settings,
+  slug,
+  priorProof,
+  run = command,
+) {
+  // macOS's per-user temp path can exceed the Unix-domain socket path limit
+  // once gpg-agent appends its socket name. /tmp keeps isolated homes short.
+  const directory = await mkdtemp(
+    path.join(
+      process.platform === "darwin" ? "/tmp" : tmpdir(),
+      "prm-central-gpg-",
+    ),
+  );
+  const signer = path.join(directory, "signer");
+  const verifier = path.join(directory, "verifier");
+  await mkdir(signer, { mode: 0o700 });
+  await mkdir(verifier, { mode: 0o700 });
+  const keyserver =
+    settings.keyserver ??
+    priorProof?.keyserver ??
+    "hkps://keyserver.ubuntu.com";
+  if (
+    keyserver !== "hkps://keyserver.ubuntu.com" &&
+    keyserver !== "hkps://keys.openpgp.org"
+  ) {
+    await rm(directory, { recursive: true, force: true });
+    throw new Error("use a supported Central public keyserver");
+  }
+  // Native Windows and MSYS GPG share relative paths but disagree on drive paths.
+  // Working inside the keyring avoids conversion and works across temp drives.
+  const gpg = (home, args, input) =>
+    run("gpg", ["--homedir", ".", "--batch", "--no-tty", ...args], input, {
+      cwd: home,
+    });
+  const listing = async (home, fingerprint) => {
+    const result = await gpg(home, [
+      "--with-colons",
+      "--list-keys",
+      fingerprint,
+    ]);
+    const records = result.split("\n").map((line) => line.split(":"));
+    const primary = records.find((row) => row[0] === "pub");
+    const actual = records.find((row) => row[0] === "fpr")?.[9];
+    const expires = primary?.[6] ? Number(primary[6]) * 1000 : null;
+    if (
+      actual !== fingerprint ||
+      !primary ||
+      /[red]/.test(primary[1]) ||
+      !primary[11]?.includes("s") ||
+      !expires ||
+      expires <= Date.now()
+    ) {
+      throw new Error(
+        "signing primary fingerprint, capability or expiry is invalid",
+      );
+    }
+    return new Date(expires).toISOString();
+  };
+  try {
+    let fingerprint =
+      settings.fingerprint?.toUpperCase() ?? priorProof?.fingerprint;
+    let privateKey;
+    let passphrase;
+    let proof = priorProof;
+    if (!proof) {
+      passphrase = settings.passphrase_env
+        ? process.env[settings.passphrase_env]
+        : undefined;
+      if (settings.private_key_file || fingerprint) {
+        if (passphrase === undefined) {
+          throw new Error(
+            "reuse requires passphrase_env for the existing signing material",
+          );
+        }
+        if (settings.private_key_file) {
+          privateKey = await readFile(settings.private_key_file, "utf8");
+        } else {
+          const args = [
+            "--batch",
+            "--no-tty",
+            ...(settings.key_home ? ["--homedir", "."] : []),
+            "--pinentry-mode",
+            "loopback",
+            "--passphrase-fd",
+            "0",
+            "--armor",
+            "--export-secret-keys",
+            fingerprint,
+          ];
+          privateKey = await run("gpg", args, `${passphrase}\n`, {
+            cwd: settings.key_home,
+          });
+        }
+        await gpg(signer, ["--import"], privateKey);
+      } else if (settings.generate === true) {
+        if (
+          !settings.identity ||
+          /[\r\n]/.test(settings.identity) ||
+          !settings.identity.includes(slug)
+        ) {
+          throw new Error("a repository-specific signing identity is required");
+        }
+        passphrase = randomBytes(32).toString("base64url");
+        await gpg(
+          signer,
+          [
+            "--pinentry-mode",
+            "loopback",
+            "--passphrase-fd",
+            "0",
+            "--quick-generate-key",
+            settings.identity,
+            "rsa4096",
+            "sign",
+            "1y",
+          ],
+          `${passphrase}\n`,
+        );
+      } else {
+        throw new Error(
+          "explicit signing reuse or authorized generation settings are required",
+        );
+      }
+      const keys = await gpg(signer, ["--with-colons", "--list-secret-keys"]);
+      const fingerprints = keys
+        .split("\n")
+        .filter((line) => line.startsWith("fpr:"))
+        .map((line) => line.split(":")[9]);
+      fingerprint ??= fingerprints[0];
+      if (
+        !/^[A-F0-9]{40,64}$/.test(fingerprint ?? "") ||
+        !fingerprints.includes(fingerprint)
+      ) {
+        throw new Error(
+          "selected private signing fingerprint was not imported",
+        );
+      }
+      const expiresAt = await listing(signer, fingerprint);
+      const payload = `package-registry-manager Central signing proof for ${slug}\n${randomBytes(32).toString("hex")}\n`;
+      const dataFile = path.join(directory, "proof.txt");
+      const signatureFile = path.join(directory, "proof.asc");
+      await writeFile(dataFile, payload, { mode: 0o600 });
+      await gpg(
+        signer,
+        [
+          "--pinentry-mode",
+          "loopback",
+          "--passphrase-fd",
+          "0",
+          "--local-user",
+          `${fingerprint}!`,
+          "--armor",
+          "--detach-sign",
+          "--output",
+          "../proof.asc",
+          "../proof.txt",
+        ],
+        `${passphrase}\n`,
+      );
+      await gpg(signer, ["--verify", "../proof.asc", "../proof.txt"]);
+      // send-keys exports public packets only; never upload the private armor.
+      await gpg(signer, [
+        "--keyserver",
+        keyserver,
+        "--keyserver-options",
+        "timeout=15",
+        "--send-keys",
+        fingerprint,
+      ]);
+      privateKey ??= await gpg(
+        signer,
+        [
+          "--pinentry-mode",
+          "loopback",
+          "--passphrase-fd",
+          "0",
+          "--armor",
+          "--export-secret-keys",
+          fingerprint,
+        ],
+        `${passphrase}\n`,
+      );
+      proof = {
+        repository: slug,
+        fingerprint,
+        expires_at: expiresAt,
+        payload,
+        signature: await readFile(signatureFile, "utf8"),
+        keyserver,
+      };
+    }
+    if (
+      proof.repository !== slug ||
+      fingerprint !== proof.fingerprint ||
+      !proof.payload.startsWith(
+        `package-registry-manager Central signing proof for ${slug}\n`,
+      ) ||
+      !/^[A-F0-9]{40,64}$/.test(fingerprint ?? "")
+    ) {
+      throw new Error("signing proof identity mismatch");
+    }
+    await gpg(verifier, [
+      "--keyserver",
+      keyserver,
+      "--keyserver-options",
+      "timeout=15",
+      "--recv-keys",
+      fingerprint,
+    ]);
+    const expiresAt = await listing(verifier, fingerprint);
+    if (expiresAt !== proof.expires_at) {
+      throw new Error("public key expiry changed; review signing settings");
+    }
+    const dataFile = path.join(directory, "verify.txt");
+    const signatureFile = path.join(directory, "verify.asc");
+    await writeFile(dataFile, proof.payload, { mode: 0o600 });
+    await writeFile(signatureFile, proof.signature, { mode: 0o600 });
+    const status = await gpg(verifier, [
+      "--status-fd",
+      "1",
+      "--verify",
+      "../verify.asc",
+      "../verify.txt",
+    ]);
+    if (!status.includes(`[GNUPG:] VALIDSIG ${fingerprint} `)) {
+      throw new Error("independent signature fingerprint verification failed");
+    }
+    return { proof, private_key: privateKey, passphrase };
+  } finally {
+    for (const home of [signer, verifier]) {
+      await run("gpgconf", ["--homedir", ".", "--kill", "gpg-agent"], "", {
+        cwd: home,
+      }).catch(() => {});
+    }
+    await rm(directory, { recursive: true, force: true });
+  }
+}

package/src/central-namespace.mjs

@@ -0,0 +1,258 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import centralPage from "./central-page.mjs";
+import { githubServices } from "./github.mjs";
+import { repositorySlug } from "./repository-identity.mjs";
+
+/** Namespace ownership comes from the authenticated Portal, never public search. */
+export async function verifyNamespace(session, step) {
+  const namespace = step.namespace;
+  if (!namespace) {
+    return {
+      status: "manual-prerequisite",
+      reason: "the package coordinates name no namespace",
+    };
+  }
+  if (
+    session.options.noBrowser ||
+    session.options.browserOptions?.attach ||
+    session.options.browserOptions?.importScope === "full"
+  ) {
+    return {
+      status: "manual-prerequisite",
+      namespace,
+      reason:
+        "authenticated Central ownership read-back requires the dedicated browser",
+    };
+  }
+  const config = JSON.parse(
+    await readFile(
+      path.join(
+        session.options.repository ?? ".",
+        ".package-registry-manager.json",
+      ),
+      "utf8",
+    ).catch((e) => {
+      if (e.code === "ENOENT") {
+        return "{}";
+      }
+      throw e;
+    }),
+  );
+  const expected = {
+    namespace,
+    account: config.central?.account,
+    organization: config.central?.organization,
+  };
+  const page = await session.automatedPage(
+    { ...session.options.browserOptions, importScope: "domains" },
+    true,
+  );
+  await page.goto("https://central.sonatype.com/publishing/namespaces");
+  const inspect = async (action = "read") =>
+    page.evaluate(
+      `(${centralPage})(${JSON.stringify(expected)},${JSON.stringify(action)})`,
+    );
+  let state = await inspect();
+  const directory = path.join(
+    session.options.repository ?? ".",
+    ".package-registry-manager",
+  );
+  const obligation = path.join(directory, "central-namespace-proof.json");
+  const save = async (value) => {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const temporary = `${obligation}.tmp`;
+    await writeFile(temporary, JSON.stringify(value), { mode: 0o600 });
+    await rename(temporary, obligation);
+  };
+  const pending = JSON.parse(
+    await readFile(obligation, "utf8").catch((e) => {
+      if (e.code === "ENOENT") {
+        return "null";
+      }
+      throw e;
+    }),
+  );
+  const github = session.options.github ?? githubServices(session.options);
+  const cleanup = async (proof) => {
+    if (
+      !proof ||
+      proof.namespace !== namespace ||
+      proof.account !== state.account
+    ) {
+      return;
+    }
+    try {
+      const repo = await github.rest.request(`/repos/${proof.slug}`, {
+        allowNotFound: true,
+      });
+      if (!repo) {
+        await save(null);
+        state.cleanup = { status: "complete", repository: proof.slug };
+        return;
+      }
+      if (
+        repo.id !== proof.id ||
+        repo.owner.id !== proof.owner_id ||
+        repo.size !== 0 ||
+        repo.default_branch !== proof.default_branch
+      ) {
+        throw new Error("proof repository changed");
+      }
+      const branches = await github.rest.request(
+        `/repos/${proof.slug}/branches`,
+      );
+      if (!Array.isArray(branches) || branches.length) {
+        throw new Error("proof repository is no longer empty");
+      }
+      await github.rest.request(`/repos/${proof.slug}`, { method: "DELETE" });
+      const gone = await github.rest.request(`/repos/${proof.slug}`, {
+        allowNotFound: true,
+      });
+      if (gone) {
+        throw new Error("proof repository deletion unverified");
+      }
+      await save(null);
+      state.cleanup = { status: "complete", repository: proof.slug };
+    } catch {
+      state.cleanup = {
+        status: "pending",
+        repository: proof.slug,
+        reason:
+          "delete the recorded empty proof repository through an authorized GitHub UI or existing permissions; no token scopes were expanded",
+      };
+    }
+  };
+  if (state.status === "verified") {
+    await cleanup(pending);
+    return state;
+  }
+  if (!["missing", "unverified"].includes(state.status)) {
+    return state;
+  }
+  expected.account = state.account;
+  if (
+    !session.options.yes &&
+    !/^y(?:es)?$/i.test(
+      await session.prompt(
+        `Register/verify ${namespace} for the signed-in Central account and create its temporary public GitHub proof repository? [y/N] `,
+      ),
+    )
+  ) {
+    return {
+      status: "interrupted",
+      namespace,
+      reason: "namespace setup declined",
+    };
+  }
+  if (state.status === "missing") {
+    state = await inspect("register");
+  }
+  const owner = /^io\.github\.([\w-]+)$/.exec(namespace)?.[1];
+  const slug = repositorySlug(session.plan.repository);
+  const key = state.verification_key;
+  if (state.status === "verified") {
+    return state;
+  }
+  if (
+    !owner ||
+    !slug ||
+    owner.toLowerCase() !== slug.split("/")[0].toLowerCase() ||
+    !/^[\w-]+$/.test(key ?? "")
+  ) {
+    return {
+      ...state,
+      status: "manual-prerequisite",
+      reason:
+        "the exact namespace GitHub owner or proof challenge is unresolved; complete verification in the official portal",
+    };
+  }
+  const repository = await github.rest.request(`/repos/${slug}`);
+  if (
+    !Number.isSafeInteger(repository.owner?.id) ||
+    repository.owner.id <= 0 ||
+    repository.owner.login?.toLowerCase() !== owner.toLowerCase()
+  ) {
+    return {
+      status: "wrong-identity",
+      reason: "immutable GitHub namespace owner is unverified",
+    };
+  }
+  const proofSlug = `${repository.owner.login}/${key}`;
+  let proof =
+    pending?.slug === proofSlug &&
+    pending.account === state.account &&
+    pending.namespace === namespace
+      ? pending
+      : null;
+  const existing = await github.rest.request(`/repos/${proofSlug}`, {
+    allowNotFound: true,
+  });
+  if (existing && (!proof || proof.id !== existing.id)) {
+    return {
+      ...state,
+      status: "manual-prerequisite",
+      reason:
+        "proof repository already exists without a matching cleanup obligation; it was not changed",
+    };
+  }
+  if (!existing) {
+    // Write the intent first, so an interruption never loses the cleanup obligation.
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    proof = {
+      namespace,
+      account: expected.account,
+      slug: proofSlug,
+      owner_id: repository.owner.id,
+      status: "creation-pending",
+    };
+    await save(proof);
+    const created = await github.rest.request(
+      repository.owner.type === "Organization"
+        ? `/orgs/${repository.owner.login}/repos`
+        : "/user/repos",
+      {
+        method: "POST",
+        body: {
+          name: key,
+          private: false,
+          auto_init: false,
+          description: "Temporary Maven Central namespace ownership proof",
+        },
+      },
+    );
+    proof = {
+      ...proof,
+      id: created.id,
+      default_branch: created.default_branch,
+      status: "cleanup-pending",
+    };
+    await save(proof);
+    if (
+      created.owner.id !== repository.owner.id ||
+      created.private ||
+      created.full_name.toLowerCase() !== proofSlug.toLowerCase()
+    ) {
+      return { status: "wrong-identity", cleanup: proof };
+    }
+  }
+  state = await inspect("verify");
+  const deadline = Date.now() + (session.options.waitTimeoutMs ?? 600000);
+  while (
+    state.status === "unverified" &&
+    state.state === "VERIFYING" &&
+    Date.now() < deadline
+  ) {
+    await new Promise((resolve) =>
+      setTimeout(resolve, session.options.pollIntervalMs ?? 1000),
+    );
+    await page.goto("https://central.sonatype.com/publishing/namespaces");
+    state = await inspect();
+  }
+  if (state.status === "verified") {
+    await cleanup(proof);
+  } else {
+    state.cleanup = { status: "pending", repository: proofSlug };
+  }
+  return state;
+}