repofence 0.1.6 → 0.1.8

package/README.md

@@ -151,6 +151,7 @@ Step-by-step: **[docs/RELEASE.md](docs/RELEASE.md)** (`npm version`, `npm publis
 | `REPOFENCE_API_BASE_URL` | API host for the CLI (`auth`, `init`). Default normalizes to `…/api`. |
 | `REPOFENCE_MOCK` | Set to `1` for mock API responses (no network). |
 | `REPOFENCE_PACK_ID` | Pack id for `repofence init` (default: `core`). |
+| `REPOFENCE_PUBLIC_KEY` | Optional. PEM or base64 public key to verify signed packs. If unset, the CLI uses its built-in public key. |
 
 ## Requirements
 

package/dist/core/pack-manager.js

@@ -9,6 +9,7 @@ const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const crypto_1 = __importDefault(require("crypto"));
 const tar_1 = __importDefault(require("tar"));
+const pack_public_key_1 = require("./pack-public-key");
 const defaultCommandsDir = () => process.env.REPOFENCE_COMMANDS_DIR || path_1.default.join(os_1.default.homedir(), '.cursor', 'commands');
 const commandsDir = (baseDir) => baseDir || defaultCommandsDir();
 const manifestPath = (baseDir) => path_1.default.join(commandsDir(baseDir), '.repofence-manifest.json');
@@ -141,6 +142,19 @@ const installPack = async (pack, options = {}, baseDir) => {
 exports.installPack = installPack;
 const manifestFilePath = (baseDir) => manifestPath(baseDir);
 exports.manifestFilePath = manifestFilePath;
+/** Standard base64 or base64url (some APIs / env pastes). */
+const decodeBase64Flexible = (input) => {
+    const trimmed = input.trim().replace(/\s/g, '');
+    if (!trimmed) {
+        throw new Error('Cadena vacía.');
+    }
+    const b64 = trimmed.includes('-') || trimmed.includes('_')
+        ? trimmed.replace(/-/g, '+').replace(/_/g, '/')
+        : trimmed;
+    const pad = b64.length % 4;
+    const padded = pad ? b64 + '='.repeat(4 - pad) : b64;
+    return Buffer.from(padded, 'base64');
+};
 const validateSignature = async (_pack) => {
     const pack = _pack;
     // Si no hay firma ni hashes, no validamos (modo demo/mock).
@@ -151,16 +165,30 @@ const validateSignature = async (_pack) => {
     const payloadToVerify = pack.archiveHash
         ? `${pack.manifestHash}:${pack.archiveHash}`
         : pack.manifestHash;
-    const publicKeyEnv = process.env.REPOFENCE_PUBLIC_KEY;
-    if (!publicKeyEnv) {
-        throw new Error('Falta REPOFENCE_PUBLIC_KEY para validar la firma del pack.');
-    }
-    const publicKeyPem = publicKeyEnv.includes('BEGIN')
-        ? publicKeyEnv
-        : Buffer.from(publicKeyEnv, 'base64').toString('utf8');
+    const rawKey = process.env.REPOFENCE_PUBLIC_KEY?.trim() || pack_public_key_1.EMBEDDED_PACK_PUBLIC_KEY_PEM;
+    const publicKeyPem = rawKey.includes('BEGIN')
+        ? rawKey
+        : Buffer.from(rawKey, 'base64').toString('utf8');
     try {
         const keyObject = crypto_1.default.createPublicKey(publicKeyPem);
-        const isValid = crypto_1.default.verify(null, Buffer.from(payloadToVerify), keyObject, Buffer.from(pack.signature, 'base64'));
+        const sigBuf = decodeBase64Flexible(pack.signature);
+        const dataBuf = Buffer.from(payloadToVerify, 'utf8');
+        const keyType = keyObject.asymmetricKeyType;
+        let isValid;
+        if (keyType === 'ed25519') {
+            if (sigBuf.length !== 64) {
+                throw new Error(`Firma Ed25519: tras decodificar se esperaban 64 bytes, hay ${sigBuf.length}. ` +
+                    'Suele indicar que el API firmó con otro algoritmo (p. ej. RSA) o la firma está corrupta. ' +
+                    'El servidor debe usar el par Ed25519 que corresponde a la clave pública del CLI.');
+            }
+            isValid = crypto_1.default.verify(null, dataBuf, keyObject, sigBuf);
+        }
+        else if (keyType === 'rsa') {
+            isValid = crypto_1.default.verify('sha256', dataBuf, keyObject, sigBuf);
+        }
+        else {
+            throw new Error(`Tipo de clave pública no soportado: ${String(keyType)}`);
+        }
         if (!isValid) {
             throw new Error('Firma de pack inválida.');
         }
@@ -168,6 +196,10 @@ const validateSignature = async (_pack) => {
     }
     catch (error) {
         const msg = error instanceof Error ? error.message : 'error_validando_firma';
+        if (msg.includes('asn1') || msg.includes('DECODER') || msg.includes('wrong tag')) {
+            throw new Error(`${msg}. Comprueba que REPOFENCE_SIGNING_KEY en el API sea el par Ed25519 de public_key.pem ` +
+                '(o que REPOFENCE_PUBLIC_KEY en el cliente sea la clave pública que corresponde a la privada del servidor).');
+        }
         throw new Error(msg);
     }
 };

package/dist/core/pack-public-key.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMBEDDED_PACK_PUBLIC_KEY_PEM = void 0;
+/**
+ * Default Ed25519 public key for verifying signed packs from the Repofence API.
+ * Must match `public_key.pem` in the repo (copy PEM lines verbatim from that file).
+ * Override with env REPOFENCE_PUBLIC_KEY for testing or key rotation.
+ */
+exports.EMBEDDED_PACK_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAJTfxc7baW85w7r3uxbYNuaZRMoe1e2lcva2l7MO0iak=
+-----END PUBLIC KEY-----
+`;
+//# sourceMappingURL=pack-public-key.js.map

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "repofence",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Repofence CLI (packs + backend auth)",
   "main": "dist/cli.js",
   "bin": {
-    "repofence": "dist/cli.js"
+    "repofence": "./dist/cli.js"
   },
   "files": [
     "dist/**/*.js",
@@ -20,7 +20,9 @@
     "start:cli": "node dist/cli.js",
     "dev": "ts-node src/cli.ts",
     "backend": "ts-node backend/server.ts",
-    "backend:start": "node backend-dist/server.js"
+    "backend:start": "node backend-dist/server.js",
+    "inspect:signing": "ts-node scripts/inspect-signing-key.ts",
+    "verify:pack-sig": "ts-node scripts/verify-pack-signature-files.ts"
   },
   "keywords": [
     "sdd",