repofence 0.1.7 → 0.1.8

package/dist/core/pack-manager.js

@@ -142,6 +142,19 @@ const installPack = async (pack, options = {}, baseDir) => {
 exports.installPack = installPack;
 const manifestFilePath = (baseDir) => manifestPath(baseDir);
 exports.manifestFilePath = manifestFilePath;
+/** Standard base64 or base64url (some APIs / env pastes). */
+const decodeBase64Flexible = (input) => {
+    const trimmed = input.trim().replace(/\s/g, '');
+    if (!trimmed) {
+        throw new Error('Cadena vacía.');
+    }
+    const b64 = trimmed.includes('-') || trimmed.includes('_')
+        ? trimmed.replace(/-/g, '+').replace(/_/g, '/')
+        : trimmed;
+    const pad = b64.length % 4;
+    const padded = pad ? b64 + '='.repeat(4 - pad) : b64;
+    return Buffer.from(padded, 'base64');
+};
 const validateSignature = async (_pack) => {
     const pack = _pack;
     // Si no hay firma ni hashes, no validamos (modo demo/mock).
@@ -158,7 +171,24 @@ const validateSignature = async (_pack) => {
         : Buffer.from(rawKey, 'base64').toString('utf8');
     try {
         const keyObject = crypto_1.default.createPublicKey(publicKeyPem);
-        const isValid = crypto_1.default.verify(null, Buffer.from(payloadToVerify), keyObject, Buffer.from(pack.signature, 'base64'));
+        const sigBuf = decodeBase64Flexible(pack.signature);
+        const dataBuf = Buffer.from(payloadToVerify, 'utf8');
+        const keyType = keyObject.asymmetricKeyType;
+        let isValid;
+        if (keyType === 'ed25519') {
+            if (sigBuf.length !== 64) {
+                throw new Error(`Firma Ed25519: tras decodificar se esperaban 64 bytes, hay ${sigBuf.length}. ` +
+                    'Suele indicar que el API firmó con otro algoritmo (p. ej. RSA) o la firma está corrupta. ' +
+                    'El servidor debe usar el par Ed25519 que corresponde a la clave pública del CLI.');
+            }
+            isValid = crypto_1.default.verify(null, dataBuf, keyObject, sigBuf);
+        }
+        else if (keyType === 'rsa') {
+            isValid = crypto_1.default.verify('sha256', dataBuf, keyObject, sigBuf);
+        }
+        else {
+            throw new Error(`Tipo de clave pública no soportado: ${String(keyType)}`);
+        }
         if (!isValid) {
             throw new Error('Firma de pack inválida.');
         }
@@ -166,6 +196,10 @@ const validateSignature = async (_pack) => {
     }
     catch (error) {
         const msg = error instanceof Error ? error.message : 'error_validando_firma';
+        if (msg.includes('asn1') || msg.includes('DECODER') || msg.includes('wrong tag')) {
+            throw new Error(`${msg}. Comprueba que REPOFENCE_SIGNING_KEY en el API sea el par Ed25519 de public_key.pem ` +
+                '(o que REPOFENCE_PUBLIC_KEY en el cliente sea la clave pública que corresponde a la privada del servidor).');
+        }
         throw new Error(msg);
     }
 };

package/dist/core/pack-public-key.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EMBEDDED_PACK_PUBLIC_KEY_PEM = void 0;
 /**
  * Default Ed25519 public key for verifying signed packs from the Repofence API.
- * Keep in sync with `public_key.pem` at the repo root (pair to backend REPOFENCE_SIGNING_KEY).
+ * Must match `public_key.pem` in the repo (copy PEM lines verbatim from that file).
  * Override with env REPOFENCE_PUBLIC_KEY for testing or key rotation.
  */
 exports.EMBEDDED_PACK_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
-LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQUpUZnhjN2JhVzg1dzdyM3V4YllOdWFaUk1vZTFlMmxjdmEybDdNTzBpYWs9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=
+MCowBQYDK2VwAyEAJTfxc7baW85w7r3uxbYNuaZRMoe1e2lcva2l7MO0iak=
 -----END PUBLIC KEY-----
 `;
 //# sourceMappingURL=pack-public-key.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repofence",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Repofence CLI (packs + backend auth)",
   "main": "dist/cli.js",
   "bin": {
@@ -20,7 +20,9 @@
     "start:cli": "node dist/cli.js",
     "dev": "ts-node src/cli.ts",
     "backend": "ts-node backend/server.ts",
-    "backend:start": "node backend-dist/server.js"
+    "backend:start": "node backend-dist/server.js",
+    "inspect:signing": "ts-node scripts/inspect-signing-key.ts",
+    "verify:pack-sig": "ts-node scripts/verify-pack-signature-files.ts"
   },
   "keywords": [
     "sdd",