pakstr 0.28.0 → 0.29.1

package/dist/commands/artifactPublisher.js

@@ -0,0 +1,125 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stageArtifact = stageArtifact;
+exports.publishArtifact = publishArtifact;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * Copy `artifactPath` into a fresh staging directory next to `finalPath`, so
+ * publishArtifact can move it into place with a same-filesystem rename.
+ * Returns the staged path; the staging directory is removed on failure.
+ * `description` names the artifact in errors (e.g. "built APK").
+ */
+function stageArtifact(artifactPath, finalPath, description = "built APK") {
+    const parent = path_1.default.dirname(finalPath);
+    const stageDir = fs_1.default.mkdtempSync(path_1.default.join(parent, ".pakstr-stage-"));
+    const stagedPath = path_1.default.join(stageDir, "app.apk");
+    try {
+        fs_1.default.copyFileSync(artifactPath, stagedPath, fs_1.default.constants.COPYFILE_EXCL);
+        if (fs_1.default.statSync(stagedPath).size !== fs_1.default.statSync(artifactPath).size) {
+            throw new Error(`Staged copy of the ${description} is incomplete (size mismatch); ` +
+                "the existing output was left unchanged");
+        }
+    }
+    catch (error) {
+        fs_1.default.rmSync(stageDir, { recursive: true, force: true });
+        throw error;
+    }
+    return stagedPath;
+}
+/**
+ * Publish a staged APK at `finalPath` without ever leaving the user without
+ * their previous APK.
+ *
+ * The previous APK is copied into the staging directory, then the staged APK
+ * atomically replaces `finalPath` (it is never deleted first). If publication
+ * fails, the previous APK is restored from the backup. The staging directory
+ * (which holds the backup) is only removed once `finalPath` is known to hold a
+ * good APK; if restoring fails it is kept so the backup is never lost.
+ */
+function publishArtifact(stagedPath, finalPath) {
+    const stageDir = path_1.default.dirname(stagedPath);
+    const backupPath = path_1.default.join(stageDir, "previous.apk");
+    if (isInside(path_1.default.resolve(finalPath), path_1.default.resolve(stageDir))) {
+        throw new Error(`Staging directory must not contain the output APK: ${stageDir}`);
+    }
+    let hadPreviousOutput;
+    try {
+        hadPreviousOutput = existingOutputIsFile(finalPath);
+        if (hadPreviousOutput) {
+            fs_1.default.copyFileSync(finalPath, backupPath, fs_1.default.constants.COPYFILE_EXCL);
+            if (fs_1.default.statSync(backupPath).size !== fs_1.default.statSync(finalPath).size) {
+                throw new Error("Backup of the previous APK is incomplete");
+            }
+        }
+    }
+    catch (error) {
+        // `finalPath` has not been touched yet, so the staging directory holds
+        // nothing worth keeping.
+        removeStageDir(stageDir);
+        throw error;
+    }
+    let replacedOutput = false;
+    try {
+        fs_1.default.renameSync(stagedPath, finalPath);
+        replacedOutput = true;
+        const stat = fs_1.default.lstatSync(finalPath);
+        if (!stat.isFile() || stat.isSymbolicLink()) {
+            throw new Error("Final APK publication failed");
+        }
+    }
+    catch (error) {
+        try {
+            restorePreviousOutput(finalPath, backupPath, hadPreviousOutput, replacedOutput);
+        }
+        catch (restoreError) {
+            throw new Error(`Failed to publish the new APK and restore the previous APK. ` +
+                `Previous APK kept at: ${backupPath}`, { cause: new AggregateError([error, restoreError]) });
+        }
+        removeStageDir(stageDir);
+        throw error;
+    }
+    removeStageDir(stageDir);
+}
+function restorePreviousOutput(finalPath, backupPath, hadPreviousOutput, replacedOutput) {
+    if (!hadPreviousOutput) {
+        // Don't leave a rejected artifact behind at the output path.
+        if (replacedOutput && fs_1.default.lstatSync(finalPath, { throwIfNoEntry: false })?.isFile()) {
+            fs_1.default.unlinkSync(finalPath);
+        }
+        return;
+    }
+    // A failed rename leaves the destination untouched, so the previous APK is
+    // usually still in place; only restore when it was replaced or is missing.
+    if (!replacedOutput && existingOutputIsFile(finalPath))
+        return;
+    fs_1.default.renameSync(backupPath, finalPath);
+    if (!existingOutputIsFile(finalPath)) {
+        throw new Error("Restored APK is not a regular file");
+    }
+}
+function existingOutputIsFile(finalPath) {
+    const stat = fs_1.default.lstatSync(finalPath, { throwIfNoEntry: false });
+    if (!stat)
+        return false;
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error(`Output path must be a regular file: ${finalPath}`);
+    }
+    return true;
+}
+function removeStageDir(stageDir) {
+    try {
+        fs_1.default.rmSync(stageDir, { recursive: true, force: true });
+    }
+    catch (error) {
+        console.warn("Warning: failed to remove APK staging directory:", error instanceof Error ? error.message : "unknown cleanup error");
+    }
+}
+function isInside(child, parent) {
+    const relative = path_1.default.relative(parent, child);
+    return (relative === "" ||
+        (relative.split(path_1.default.sep)[0] !== ".." && !path_1.default.isAbsolute(relative)));
+}

package/dist/commands/build.js

@@ -11,6 +11,7 @@ const releaseWorkspace_1 = require("../android/releaseWorkspace");
 const pakstrConfig_1 = require("../core/pakstrConfig");
 const androidProject_1 = require("../core/androidProject");
 const createRunner_1 = require("../runners/createRunner");
+const artifactPublisher_1 = require("./artifactPublisher");
 /**
  * `pakstr build` — produce an UNSIGNED release APK at `build.out`.
  * Spec §5.2. No nsec required.
@@ -24,7 +25,11 @@ async function buildCommand(configPath) {
     console.log("📱 Out:", finalPath);
     console.log("🏗️  Builder:", config.build.builder);
     validateOutputParent(finalPath);
-    removeExistingOutput(finalPath);
+    // Whatever happens next, the APK at finalPath is no longer the signed output
+    // of this config: on success it is replaced by a new unsigned APK, and on
+    // failure it is kept but may be an older build (e.g. a previous versionCode).
+    // Removing its sidecars makes publish refuse it until `pakstr sign` runs.
+    removeStaleSigningSidecars(finalPath);
     const templateRoot = await (0, template_1.ensureTemplate)();
     const workspace = (0, releaseWorkspace_1.createReleaseWorkspace)(templateRoot);
     let stagedPath;
@@ -53,7 +58,7 @@ async function buildCommand(configPath) {
         if (!result.unsigned) {
             throw new Error("Build runner did not produce an unsigned release APK");
         }
-        stagedPath = stageArtifact(result.artifactPath, finalPath);
+        stagedPath = (0, artifactPublisher_1.stageArtifact)(result.artifactPath, finalPath);
     }
     catch (error) {
         primaryError = error;
@@ -67,7 +72,6 @@ async function buildCommand(configPath) {
     }
     if (primaryError || cleanupError) {
         removeStagedArtifact(stagedPath);
-        removeExistingOutput(finalPath);
         if (primaryError) {
             if (cleanupError) {
                 console.error("Workspace cleanup also failed:", safeErrorMessage(cleanupError));
@@ -79,7 +83,7 @@ async function buildCommand(configPath) {
     if (!stagedPath) {
         throw new Error("Build completed without a staged APK");
     }
-    publishArtifact(stagedPath, finalPath);
+    (0, artifactPublisher_1.publishArtifact)(stagedPath, finalPath);
     console.log("\n✅ BUILD COMPLETE (unsigned)");
     console.log("📦 Output:", finalPath);
     console.log("➡️  Next: pakstr sign");
@@ -102,33 +106,15 @@ function validateOutputParent(finalPath) {
         }
     }
 }
-function stageArtifact(artifactPath, finalPath) {
-    const parent = path_1.default.dirname(finalPath);
-    const stageDir = fs_1.default.mkdtempSync(path_1.default.join(parent, ".pakstr-stage-"));
-    const stagedPath = path_1.default.join(stageDir, "app.apk");
-    fs_1.default.copyFileSync(artifactPath, stagedPath, fs_1.default.constants.COPYFILE_EXCL);
-    if (fs_1.default.statSync(stagedPath).size !== fs_1.default.statSync(artifactPath).size) {
-        fs_1.default.rmSync(stageDir, { recursive: true, force: true });
-        throw new Error("Staged APK size does not match built artifact");
-    }
-    return stagedPath;
-}
-function publishArtifact(stagedPath, finalPath) {
-    removeExistingOutput(finalPath);
-    fs_1.default.renameSync(stagedPath, finalPath);
-    fs_1.default.rmSync(path_1.default.dirname(stagedPath), { recursive: true, force: true });
-    if (!fs_1.default.existsSync(finalPath) || !fs_1.default.lstatSync(finalPath).isFile()) {
-        throw new Error("Final APK publication failed");
-    }
-}
-function removeExistingOutput(finalPath) {
-    if (!fs_1.default.existsSync(finalPath))
-        return;
-    const stat = fs_1.default.lstatSync(finalPath);
-    if (!stat.isFile() || stat.isSymbolicLink()) {
-        throw new Error(`Refusing to remove non-regular output path: ${finalPath}`);
+function removeStaleSigningSidecars(apkPath) {
+    for (const sidecar of [`${apkPath}.signer-sha256`, `${apkPath}.identity-proof`]) {
+        try {
+            fs_1.default.rmSync(sidecar, { force: true });
+        }
+        catch (error) {
+            console.warn(`Warning: could not remove stale signing sidecar ${sidecar}:`, safeErrorMessage(error));
+        }
     }
-    fs_1.default.unlinkSync(finalPath);
 }
 function removeStagedArtifact(stagedPath) {
     if (!stagedPath)

package/dist/commands/publish.js

@@ -10,6 +10,7 @@ const artifactUpload_1 = require("../core/artifactUpload");
 const blossom_1 = require("../core/blossom");
 const giteaRelease_1 = require("../core/giteaRelease");
 const identityProof_1 = require("../core/identityProof");
+const apkSignature_1 = require("../core/apkSignature");
 const nostr_1 = require("../core/nostr");
 const pakstrConfig_1 = require("../core/pakstrConfig");
 const nsite_1 = require("../core/nsite");
@@ -56,6 +57,9 @@ async function publishCommand(configPath, options = {}) {
             dryRun: options.dryRun,
             fetchImpl,
         });
+        reportNsitePartialFailures(nsite);
+        if (options.verify && !options.dryRun)
+            await (0, nsite_1.verifyNsite)(nsite, transport, fetchImpl);
         const result = { artifactUrl: "", uploadProvider: null, nsite };
         if (options.outJson) {
             fs_1.default.writeFileSync(options.outJson, JSON.stringify({
@@ -95,6 +99,10 @@ async function publishCommand(configPath, options = {}) {
             throw new Error(`Signer certificate sidecar not found: ${certShaPath}. Run \`pakstr sign\` first.`);
         }
         signerCertificateSha256 = fs_1.default.readFileSync(certShaPath, "utf8").trim();
+        // The sidecar must describe the APK actually being published: a rebuilt or
+        // failed-sign APK left next to sidecars from an earlier sign is refused.
+        // The identity proof is bound to this certificate by parseIdentityProofSidecar.
+        assertApkSignedWith(apkPath, signerCertificateSha256, certShaPath);
         const proofPath = `${apkPath}.identity-proof`;
         if (zapstoreEnabled && fs_1.default.existsSync(proofPath)) {
             identityProof = (0, identityProof_1.parseIdentityProofSidecar)(fs_1.default.readFileSync(proofPath, "utf8").trim(), proofPath, signerCertificateSha256);
@@ -300,9 +308,9 @@ async function publishCommand(configPath, options = {}) {
             dryRun: options.dryRun,
             fetchImpl,
         });
-        if (nsiteResult.partialFailures > 0) {
-            console.log(`⚠️  Nsite published with ${nsiteResult.partialFailures} target failure(s)`);
-        }
+        reportNsitePartialFailures(nsiteResult);
+        if (options.verify && !options.dryRun)
+            await (0, nsite_1.verifyNsite)(nsiteResult, transport, fetchImpl);
     }
     const result = {
         artifactUrl,
@@ -343,3 +351,29 @@ async function publishCommand(configPath, options = {}) {
     }
     return result;
 }
+function reportNsitePartialFailures(result) {
+    if (result.partialFailures > 0) {
+        console.log(`⚠️  Nsite published with ${result.partialFailures} target failure(s)`);
+    }
+}
+function assertApkSignedWith(apkPath, expectedSha256, certShaPath) {
+    if (!/^[0-9a-f]{64}$/.test(expectedSha256)) {
+        throw new Error(`Signer certificate sidecar ${certShaPath} is not a lowercase SHA-256. Run \`pakstr sign\` again.`);
+    }
+    let actual;
+    try {
+        actual = (0, apkSignature_1.readApkSignerCertificateSha256)(apkPath);
+    }
+    catch (error) {
+        if (!(error instanceof apkSignature_1.ApkSignatureError))
+            throw error;
+        if (error.reason === "unsigned") {
+            throw new Error(`APK at ${apkPath} is not signed (${error.message}). Run \`pakstr sign\` first.`);
+        }
+        throw new Error(`Cannot use the APK at ${apkPath}: ${error.message}. Rebuild and sign it with \`pakstr run\`.`);
+    }
+    if (actual !== expectedSha256) {
+        throw new Error(`APK at ${apkPath} is signed with certificate ${actual}, but ${certShaPath} expects ${expectedSha256}. ` +
+            "The sidecar is stale or the APK was replaced; run `pakstr sign` to sign the current APK.");
+    }
+}

package/dist/commands/run.js

@@ -25,19 +25,31 @@ const publish_1 = require("./publish");
 async function runCommand(configPath, options = {}) {
     // Step 1: load & validate config, pre-validate nsecs.
     const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
-    // Verify PAKSTR_NSEC present (fail fast before any work).
-    (0, nostr_1.requireSigningNsec)(process.env);
+    // Verify PAKSTR_NSEC (fail fast before any work). A dry run skips build and
+    // sign, so it only needs the publish key checked below — which is
+    // PAKSTR_NSEC itself unless publish.publishKey names a separate one.
+    if (!options.dryRun)
+        (0, nostr_1.requireSigningNsec)(process.env);
     // Pre-validate the Nostr publish nsec when Zapstore, Blossom, or nsite needs it.
     if (config.publish.zapstoreEnabled || config.publish.nsite.enabled || (config.publish.upload.enabled && config.publish.upload.provider === "blossom")) {
+        const envVar = config.publish.publishKey === undefined
+            ? "PAKSTR_NSEC"
+            : config.publish.publishKey === null
+                ? "PAKSTR_PUBLISH_NSEC"
+                : config.publish.publishKey;
         if (!(0, nostr_1.isPublishNsecPresent)(config.publish.publishKey, process.env)) {
-            const envVar = config.publish.publishKey === undefined
-                ? "PAKSTR_NSEC"
-                : config.publish.publishKey === null
-                    ? "PAKSTR_PUBLISH_NSEC"
-                    : config.publish.publishKey;
             throw new Error(`${envVar} is required for publishing and must not be empty. ` +
                 `Pre-validation failed before any build work.`);
         }
+        // Decode it too, so a malformed key fails here rather than after build
+        // and sign (where sign would also silently skip the identity proof).
+        try {
+            (0, nostr_1.resolvePublishNsec)(config.publish.publishKey, process.env);
+        }
+        catch (error) {
+            throw new Error(`${envVar} is not a valid nsec: ${error instanceof Error ? error.message : String(error)}. ` +
+                `Pre-validation failed before any build work.`);
+        }
     }
     console.log("\n🚀 pakstr run");
     console.log("App:", config.app.appName, `(${config.app.appId})`);
@@ -62,6 +74,9 @@ async function runCommand(configPath, options = {}) {
         console.log("\n✅ pakstr run complete (dry-run)");
         return;
     }
+    // Keystores already on disk belong to the user (pakstr never writes one), so
+    // only files that appear or change during this run are treated as leaks.
+    const keystoresBefore = findKeystores(config);
     // Step 3: build the unsigned APK.
     console.log("\n— Step 1/3: build —");
     await (0, build_1.buildCommand)(config.configPath || undefined);
@@ -81,36 +96,52 @@ async function runCommand(configPath, options = {}) {
     }
     // Step 6: cleanup. The signed APK at build.out is the artifact and is kept.
     // Derived signing material is cleaned up inside the sign runner (tmpfs).
-    verifyNoLeakedKeystores(config);
+    verifyNoLeakedKeystores(config, keystoresBefore);
     console.log("\n✅ pakstr run complete");
     console.log("Signed APK:", path_1.default.resolve(config.build.out));
 }
-/** Best-effort: ensure no derived .p12 keystore leaked onto disk (§7). */
-function verifyNoLeakedKeystores(config) {
-    const buildDir = path_1.default.join(config.configDir, "build");
-    if (!fs_1.default.existsSync(buildDir))
-        return;
+/**
+ * Keystore files under `<configDir>/build`, mapped to a fingerprint that
+ * changes when a file is replaced (inode) or written in place (size, mtime,
+ * and ctime, which also changes if mtime is reset afterwards).
+ */
+function findKeystores(config) {
+    const found = new Map();
     const walk = (dir) => {
-        const found = [];
-        for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        let entries;
+        try {
+            entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
             const p = path_1.default.join(dir, entry.name);
             if (entry.isDirectory())
-                found.push(...walk(p));
-            else if (entry.name.endsWith(".p12") || entry.name.endsWith(".keystore"))
-                found.push(p);
+                walk(p);
+            else if (entry.name.endsWith(".p12") || entry.name.endsWith(".keystore")) {
+                const stat = fs_1.default.lstatSync(p, { throwIfNoEntry: false });
+                if (stat) {
+                    found.set(p, [stat.dev, stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs].join(":"));
+                }
+            }
         }
-        return found;
     };
-    const leaked = walk(buildDir);
+    walk(path_1.default.join(config.configDir, "build"));
+    return found;
+}
+/**
+ * Ensure no derived keystore leaked onto disk during this run (§7). Never
+ * deletes anything: a keystore may be the user's own (customer-keystore flow,
+ * exported derived keys), and pakstr cannot tell the two apart reliably.
+ */
+function verifyNoLeakedKeystores(config, before) {
+    const leaked = [...findKeystores(config)]
+        .filter(([file, fingerprint]) => before.get(file) !== fingerprint)
+        .map(([file]) => file);
     if (leaked.length > 0) {
-        for (const f of leaked) {
-            try {
-                fs_1.default.rmSync(f, { force: true });
-            }
-            catch {
-                /* ignore */
-            }
-        }
-        throw new Error(`Derived keystore material leaked onto disk: ${leaked.join(", ")}`);
+        throw new Error(`Keystore files appeared or changed during this run: ${leaked.join(", ")}. ` +
+            "pakstr never writes signing keys to disk, so these may be leaked key material; " +
+            "they were left in place. Inspect them and delete any you did not create.");
     }
 }

package/dist/core/apkSignature.js

@@ -0,0 +1,197 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApkSignatureError = void 0;
+exports.readApkSignerCertificateSha256 = readApkSignerCertificateSha256;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+/**
+ * Reads the signing certificate of an APK from its APK Signing Block (APK
+ * Signature Scheme v2/v3, which `pakstr sign` always produces: min SDK 28).
+ *
+ * This identifies the certificate the APK claims to be signed with; it does not
+ * cryptographically verify the signature (Android and apksigner do that on
+ * install). It lets `pakstr publish` refuse an APK whose signer does not match
+ * the `.signer-sha256` sidecar, e.g. an unsigned rebuild next to stale sidecars.
+ *
+ * Format: https://source.android.com/docs/security/features/apksigning/v2
+ */
+const EOCD_SIGNATURE = 0x06054b50;
+const EOCD_MIN_SIZE = 22;
+const MAX_ZIP_COMMENT = 0xffff;
+const SIGNING_BLOCK_MAGIC = "APK Sig Block 42";
+// Signing blocks are a few KB; refuse absurd sizes from a corrupt file.
+const MAX_SIGNING_BLOCK_SIZE = 64 * 1024 * 1024;
+const SCHEMES = [
+    ["v3.1", 0x1b93ad61],
+    ["v3", 0xf05368c0],
+    ["v2", 0x7109871a],
+];
+class ApkSignatureError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "ApkSignatureError";
+    }
+}
+exports.ApkSignatureError = ApkSignatureError;
+/** Lowercase hex SHA-256 of the APK's signing certificate (DER), as apksigner prints it. */
+function readApkSignerCertificateSha256(apkPath) {
+    const fd = fs_1.default.openSync(apkPath, "r");
+    try {
+        const block = readSigningBlock(fd, fs_1.default.fstatSync(fd).size);
+        if (!block) {
+            throw new ApkSignatureError("unsigned", "it has no APK Signature Scheme v2/v3 signing block");
+        }
+        const certificates = new Set();
+        for (const [scheme, id] of SCHEMES) {
+            const value = block.get(id);
+            if (value) {
+                for (const der of signerCertificates(value, scheme))
+                    certificates.add(certificateSha256(der, scheme));
+            }
+        }
+        if (certificates.size === 0) {
+            throw new ApkSignatureError("unsigned", "its signing block has no v2/v3 signature");
+        }
+        if (certificates.size > 1) {
+            throw new ApkSignatureError("multiple-certificates", `it is signed with ${certificates.size} different certificates (multiple signers or key rotation are not supported)`);
+        }
+        return [...certificates][0];
+    }
+    finally {
+        fs_1.default.closeSync(fd);
+    }
+}
+/** The signing block's ID → value pairs, or undefined if the APK has none. */
+function readSigningBlock(fd, fileSize) {
+    const eocd = findEndOfCentralDirectory(fd, fileSize);
+    const centralDirectorySize = eocd.record.readUInt32LE(12);
+    const centralDirectoryOffset = eocd.record.readUInt32LE(16);
+    if (centralDirectoryOffset === 0xffffffff || centralDirectorySize === 0xffffffff) {
+        throw malformed("ZIP64 archives are not supported");
+    }
+    // APK signing requires the central directory to sit directly before the EOCD.
+    if (centralDirectoryOffset + centralDirectorySize !== eocd.offset) {
+        throw malformed("the ZIP central directory is not where the end record says");
+    }
+    const footerSize = 8 + SIGNING_BLOCK_MAGIC.length;
+    if (centralDirectoryOffset < footerSize + 8)
+        return undefined;
+    const footer = read(fd, centralDirectoryOffset - footerSize, footerSize);
+    if (footer.toString("latin1", 8) !== SIGNING_BLOCK_MAGIC)
+        return undefined;
+    const blockSize = toSafeLength(footer.readBigUInt64LE(0));
+    if (blockSize < footerSize || blockSize > MAX_SIGNING_BLOCK_SIZE || blockSize + 8 > centralDirectoryOffset) {
+        throw malformed("the signing block size is invalid");
+    }
+    const blockStart = centralDirectoryOffset - blockSize - 8;
+    const block = read(fd, blockStart, blockSize + 8);
+    if (toSafeLength(block.readBigUInt64LE(0)) !== blockSize) {
+        throw malformed("the signing block header and footer sizes differ");
+    }
+    const pairs = new Map();
+    const end = block.length - footerSize;
+    for (let offset = 8; offset < end;) {
+        if (end - offset < 12)
+            throw malformed("a signing block entry is truncated");
+        const length = toSafeLength(block.readBigUInt64LE(offset));
+        if (length < 4 || length > end - offset - 8)
+            throw malformed("a signing block entry has an invalid length");
+        const id = block.readUInt32LE(offset + 8);
+        if (pairs.has(id))
+            throw malformed(`the signing block repeats entry 0x${id.toString(16)}`);
+        pairs.set(id, block.subarray(offset + 12, offset + 8 + length));
+        offset += 8 + length;
+    }
+    return pairs;
+}
+function findEndOfCentralDirectory(fd, fileSize) {
+    if (fileSize < EOCD_MIN_SIZE)
+        throw malformed("it is too small to be a ZIP archive");
+    const tailSize = Math.min(fileSize, EOCD_MIN_SIZE + MAX_ZIP_COMMENT);
+    const tail = read(fd, fileSize - tailSize, tailSize);
+    // Search backwards; the record's comment must run exactly to the end of file.
+    for (let i = tail.length - EOCD_MIN_SIZE; i >= 0; i--) {
+        if (tail.readUInt32LE(i) !== EOCD_SIGNATURE)
+            continue;
+        if (i + EOCD_MIN_SIZE + tail.readUInt16LE(i + 20) !== tail.length)
+            continue;
+        return { record: tail.subarray(i, i + EOCD_MIN_SIZE), offset: fileSize - tailSize + i };
+    }
+    throw malformed("it is not a ZIP archive (no end of central directory record)");
+}
+/** First certificate (DER) of every signer in a v2/v3 signature scheme block. */
+function signerCertificates(value, scheme) {
+    const signers = new Reader(value, `${scheme} block`).lengthPrefixed();
+    const certificates = [];
+    while (!signers.done()) {
+        const signer = signers.lengthPrefixed();
+        const signedData = signer.lengthPrefixed();
+        signedData.lengthPrefixed(); // digests
+        const certs = signedData.lengthPrefixed();
+        if (certs.done())
+            throw malformed(`a ${scheme} signer has no certificate`);
+        certificates.push(certs.lengthPrefixed().rest());
+    }
+    if (certificates.length === 0)
+        throw malformed(`the ${scheme} block has no signers`);
+    return certificates;
+}
+function certificateSha256(der, scheme) {
+    try {
+        new crypto_1.X509Certificate(der);
+    }
+    catch {
+        throw malformed(`a ${scheme} signer certificate is not valid X.509`);
+    }
+    return (0, crypto_1.createHash)("sha256").update(der).digest("hex");
+}
+/** Bounds-checked reader of uint32 length-prefixed values. */
+class Reader {
+    buffer;
+    what;
+    offset = 0;
+    constructor(buffer, what) {
+        this.buffer = buffer;
+        this.what = what;
+    }
+    done() {
+        return this.offset >= this.buffer.length;
+    }
+    lengthPrefixed() {
+        if (this.buffer.length - this.offset < 4)
+            throw malformed(`the ${this.what} is truncated`);
+        const length = this.buffer.readUInt32LE(this.offset);
+        const start = this.offset + 4;
+        if (length > this.buffer.length - start)
+            throw malformed(`the ${this.what} has an invalid length`);
+        this.offset = start + length;
+        return new Reader(this.buffer.subarray(start, start + length), this.what);
+    }
+    rest() {
+        return this.buffer.subarray(this.offset);
+    }
+}
+function read(fd, position, length) {
+    const buffer = Buffer.alloc(length);
+    let total = 0;
+    while (total < length) {
+        const bytes = fs_1.default.readSync(fd, buffer, total, length - total, position + total);
+        if (bytes === 0)
+            throw malformed("it ends unexpectedly");
+        total += bytes;
+    }
+    return buffer;
+}
+function toSafeLength(value) {
+    if (value > BigInt(Number.MAX_SAFE_INTEGER))
+        throw malformed("a length field is out of range");
+    return Number(value);
+}
+function malformed(detail) {
+    return new ApkSignatureError("malformed", detail);
+}

package/dist/core/nsite.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NSITE_MANIFEST_KIND = void 0;
 exports.publishNsite = publishNsite;
+exports.verifyNsite = verifyNsite;
 exports.inspectNsiteDirectory = inspectNsiteDirectory;
 exports.buildNsiteEventTemplates = buildNsiteEventTemplates;
 const crypto_1 = require("crypto");
@@ -90,6 +91,54 @@ async function publishNsite(options) {
         partialFailures,
     };
 }
+/**
+ * `--verify` for nsite: the manifest must be readable back from a relay that
+ * accepted it, and every file downloadable from a server that accepted its
+ * upload. Throws listing what could not be verified.
+ */
+async function verifyNsite(result, transport, fetchImpl = fetch) {
+    if (!transport.query) {
+        throw new Error("Nsite verification is not supported by this relay transport (it cannot query events)");
+    }
+    const query = transport.query.bind(transport);
+    const accepted = (targets) => targets.filter(t => t.success && !t.skipped);
+    const problems = [];
+    for (const { event, relays } of result.events.filter(e => e.event.kind === exports.NSITE_MANIFEST_KIND)) {
+        let found = false;
+        for (const relay of accepted(relays)) {
+            try {
+                found = (await query({ ids: [event.id], limit: 1 }, relay.target))?.id === event.id;
+            }
+            catch {
+                // Try the next relay.
+            }
+            if (found)
+                break;
+        }
+        if (!found)
+            problems.push(`manifest ${event.id} was not found on any relay that accepted it`);
+    }
+    for (const file of result.files) {
+        let found = false;
+        for (const server of accepted(file.servers)) {
+            try {
+                found = (await fetchImpl(`${server.target}/${file.sha256}`, { method: "HEAD" })).ok;
+            }
+            catch {
+                // Try the next server.
+            }
+            if (found)
+                break;
+        }
+        if (!found)
+            problems.push(`${file.path} is not downloadable from any server that accepted it`);
+    }
+    if (problems.length > 0) {
+        const shown = problems.slice(0, 5).join("; ");
+        const more = problems.length > 5 ? `; and ${problems.length - 5} more` : "";
+        throw new Error(`Nsite verification failed: ${shown}${more}`);
+    }
+}
 function inspectNsiteDirectory(directory) {
     const root = path_1.default.resolve(directory);
     if (!fs_1.default.existsSync(root) || !fs_1.default.lstatSync(root).isDirectory()) {