sliftutils 1.7.124 → 1.7.126

package/security/authorizedKeys/unrevoke.ts

@@ -0,0 +1,149 @@
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
+import { runPromise } from "socket-function/src/runPromise";
+import { keyFingerprint, normalizeKeys } from "./authorizedKeys";
+import { revokeRepoURL } from "./revokeSource";
+import { readRepoKeys } from "./authorizedKeys";
+import { expandHome } from "../helpers/paths";
+import { spawnPromise } from "../helpers/spawn";
+
+const UNREVOKES_DIR = "unrevoked";
+const REVOCATIONS_DIR = "revocations";
+const USAGE = `Usage: yarn unrevoke [keys-repo]
+
+Run this in a keys repo, or name one. It reads that repo's revoke repo and writes one unrevoke file
+naming every revocation in it, so the keys are accepted again once each machine's hour long wait
+passes.
+
+Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
+for a key you still want.`;
+
+export type Revocation = {
+    revocationId: string;
+    fingerprint: string;
+    key?: string;
+    revokedAt?: string;
+    revokedBy?: string;
+    attempt?: { ip?: string; user?: string; required?: string };
+};
+
+/** Every revocation the revoke repo lists. Cloned read only into a temp directory, with whatever
+    credentials this machine already has - the derived deploy key is for servers, and a person
+    running this has their own access to the repo. */
+export async function readRemoteRevocations(config: { sourceURL: string }) {
+    let { sourceURL } = config;
+    let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "unrevoke-"));
+    let repoPath = path.join(temporaryDirectory, "repo");
+    let clone = await spawnPromise({
+        command: "git",
+        args: ["clone", "--depth", "1", revokeRepoURL(sourceURL), repoPath],
+    });
+    if (clone.status !== 0) {
+        await fs.rm(temporaryDirectory, { recursive: true, force: true });
+        throw new Error(
+            `Expected to be able to read ${revokeRepoURL(sourceURL)}.\n`
+            + `${(clone.stdout + clone.stderr).trim()}`
+        );
+    }
+    let revocations: Revocation[] = [];
+    let directory = path.join(repoPath, REVOCATIONS_DIR);
+    try {
+        for (let name of (await fs.readdir(directory)).sort()) {
+            if (name.endsWith(".json")) {
+                revocations.push(JSON.parse(await fs.readFile(path.join(directory, name), "utf8")));
+            }
+        }
+    } catch (e) {
+        // No revocations directory at all just means nothing has ever been revoked.
+    }
+    await fs.rm(temporaryDirectory, { recursive: true, force: true });
+    return revocations;
+}
+
+/** Which keys in a repo are revoked. What signfiles and securessh refuse over. */
+export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: string }) {
+    let { repoPath, sourceURL } = config;
+    let revocations = await readRemoteRevocations({ sourceURL });
+    let revokedFingerprints = new Set(revocations.map(revocation => revocation.fingerprint));
+    let unrevoked = new Set<string>();
+    try {
+        let directory = path.join(repoPath, UNREVOKES_DIR);
+        for (let name of await fs.readdir(directory)) {
+            if (!name.endsWith(".json")) {
+                continue;
+            }
+            let parsed = JSON.parse(await fs.readFile(path.join(directory, name), "utf8"));
+            for (let revocationId of parsed.revocationIds || []) {
+                unrevoked.add(revocationId);
+            }
+        }
+    } catch (e) {
+        // Nothing has been unrevoked.
+    }
+    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId));
+    let keys = normalizeKeys(await fs.readFile(path.join(repoPath, "authorized_keys"), "utf8").catch(() => ""));
+    return stillRevoked
+        .filter(revocation => keys.some(key => keyFingerprint(key) === revocation.fingerprint))
+        .map(revocation => ({ revocation, key: keys.find(key => keyFingerprint(key) === revocation.fingerprint) || "" }));
+}
+
+/** The repo named, or the one we are standing in. Checked the same way securessh checks it: a git
+    repo that actually holds keys and has an origin to clone from. */
+async function resolveKeysRepo(named: string | undefined) {
+    let cwd = named && expandHome(named) || undefined;
+    let repoPath = (await runPromise("git rev-parse --show-toplevel", { quiet: true, cwd })).trim();
+    if (!repoPath) {
+        throw new Error(`Expected ${named || "the current directory"} to be inside a git repo, it is not.\n${USAGE}`);
+    }
+    try {
+        await readRepoKeys(repoPath);
+    } catch (e) {
+        throw new Error(`Expected ${repoPath} to be a keys repo, it holds no keys.\n${e}\n${USAGE}`);
+    }
+    let originURL = (await runPromise("git remote get-url origin", { quiet: true, cwd: repoPath })).trim();
+    if (!originURL) {
+        throw new Error(`Expected ${repoPath} to have an origin remote, it has none.\n${USAGE}`);
+    }
+    return { repoPath, originURL };
+}
+
+export async function main() {
+    let argv = process.argv.slice(2);
+    if (argv.length > 1) {
+        throw new Error(`Expected at most a keys repo, was ${argv.length} argument(s)\n${USAGE}`);
+    }
+    let { repoPath, originURL } = await resolveKeysRepo(argv[0]);
+
+    let revocations = await readRemoteRevocations({ sourceURL: originURL });
+    if (!revocations.length) {
+        console.log(`${revokeRepoURL(originURL)} lists no revocations, so there is nothing to undo.`);
+        return;
+    }
+
+    let directory = path.join(repoPath, UNREVOKES_DIR);
+    await fs.mkdir(directory, { recursive: true });
+    let stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    let unrevokeId = `${stamp}-unrevoke`;
+    await fs.writeFile(path.join(directory, `${unrevokeId}.json`), JSON.stringify({
+        unrevokeId,
+        createdAt: new Date().toISOString(),
+        // Named one by one rather than as a blanket "allow everything again", so this file only
+        // ever undoes the revocations that existed when it was written.
+        revocationIds: revocations.map(revocation => revocation.revocationId),
+        revocations: revocations.map(revocation => ({
+            revocationId: revocation.revocationId,
+            fingerprint: revocation.fingerprint,
+            revokedAt: revocation.revokedAt,
+            revokedBy: revocation.revokedBy,
+            attempt: revocation.attempt,
+        })),
+    }, undefined, 4) + "\n");
+
+    console.log(`Wrote ${UNREVOKES_DIR}/${unrevokeId}.json covering ${revocations.length} revocation(s):`);
+    for (let revocation of revocations) {
+        console.log(`  ${revocation.fingerprint} revoked by ${revocation.revokedBy || "?"} from ${revocation.attempt?.ip || "?"}`);
+    }
+    console.log(`Each machine waits an hour after seeing it before the keys work again.`);
+    console.log(`Sign and publish it with:\n  yarn signfiles git`);
+}

package/security/helpers/dist/paths.ts.cache

@@ -0,0 +1,28 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.expandHome = void 0;
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+/** Windows shells do not expand ~ themselves, and hunting down your home folder by hand is
+    annoying, so we expand it on every platform. Both separators are accepted, because a Windows
+    user may type either one. */
+function expandHome(filePath) {
+    if (filePath === "~") {
+        return os_1.default.homedir();
+    }
+    if (filePath.startsWith("~/") || filePath.startsWith("~\\")) {
+        return path_1.default.join(os_1.default.homedir(), filePath.slice(2));
+    }
+    if (filePath.startsWith("~")) {
+        // ~otheruser needs an account database we cannot read portably, and quietly resolving it
+        // to the wrong home would be worse than refusing.
+        throw new Error(`Expected ~ or an ordinary path, was ${filePath}. Referring to another user's home with ~name is not supported.`);
+    }
+    return path_1.default.resolve(filePath);
+}
+exports.expandHome = expandHome;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGF0aHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwYXRocy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSw0Q0FBb0I7QUFDcEIsZ0RBQXdCO0FBRXhCOztnQ0FFZ0M7QUFDaEMsU0FBZ0IsVUFBVSxDQUFDLFFBQWdCO0lBQ3ZDLElBQUksUUFBUSxLQUFLLEdBQUcsRUFBRSxDQUFDO1FBQ25CLE9BQU8sWUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ3hCLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzFELE9BQU8sY0FBSSxDQUFDLElBQUksQ0FBQyxZQUFFLENBQUMsT0FBTyxFQUFFLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMzQix5RkFBeUY7UUFDekYsa0RBQWtEO1FBQ2xELE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLFFBQVEsaUVBQWlFLENBQUMsQ0FBQztJQUN0SSxDQUFDO0lBQ0QsT0FBTyxjQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2xDLENBQUM7QUFiRCxnQ0FhQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBvcyBmcm9tIFwib3NcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5cbi8qKiBXaW5kb3dzIHNoZWxscyBkbyBub3QgZXhwYW5kIH4gdGhlbXNlbHZlcywgYW5kIGh1bnRpbmcgZG93biB5b3VyIGhvbWUgZm9sZGVyIGJ5IGhhbmQgaXNcbiAgICBhbm5veWluZywgc28gd2UgZXhwYW5kIGl0IG9uIGV2ZXJ5IHBsYXRmb3JtLiBCb3RoIHNlcGFyYXRvcnMgYXJlIGFjY2VwdGVkLCBiZWNhdXNlIGEgV2luZG93c1xuICAgIHVzZXIgbWF5IHR5cGUgZWl0aGVyIG9uZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBleHBhbmRIb21lKGZpbGVQYXRoOiBzdHJpbmcpIHtcbiAgICBpZiAoZmlsZVBhdGggPT09IFwiflwiKSB7XG4gICAgICAgIHJldHVybiBvcy5ob21lZGlyKCk7XG4gICAgfVxuICAgIGlmIChmaWxlUGF0aC5zdGFydHNXaXRoKFwifi9cIikgfHwgZmlsZVBhdGguc3RhcnRzV2l0aChcIn5cXFxcXCIpKSB7XG4gICAgICAgIHJldHVybiBwYXRoLmpvaW4ob3MuaG9tZWRpcigpLCBmaWxlUGF0aC5zbGljZSgyKSk7XG4gICAgfVxuICAgIGlmIChmaWxlUGF0aC5zdGFydHNXaXRoKFwiflwiKSkge1xuICAgICAgICAvLyB+b3RoZXJ1c2VyIG5lZWRzIGFuIGFjY291bnQgZGF0YWJhc2Ugd2UgY2Fubm90IHJlYWQgcG9ydGFibHksIGFuZCBxdWlldGx5IHJlc29sdmluZyBpdFxuICAgICAgICAvLyB0byB0aGUgd3JvbmcgaG9tZSB3b3VsZCBiZSB3b3JzZSB0aGFuIHJlZnVzaW5nLlxuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIH4gb3IgYW4gb3JkaW5hcnkgcGF0aCwgd2FzICR7ZmlsZVBhdGh9LiBSZWZlcnJpbmcgdG8gYW5vdGhlciB1c2VyJ3MgaG9tZSB3aXRoIH5uYW1lIGlzIG5vdCBzdXBwb3J0ZWQuYCk7XG4gICAgfVxuICAgIHJldHVybiBwYXRoLnJlc29sdmUoZmlsZVBhdGgpO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "aa5698729d5def416d177e211ac514eed7d8c8fcb796c68dcc520ddf0d83526b"; */

package/security/helpers/dist/remoteSSH.ts.cache

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.remoteCommandExists = exports.writeRemoteFile = exports.readRemoteFile = exports.runOverSSH = exports.SUDO_PREAMBLE = void 0;
+const spawn_1 = require("./spawn");
+const SSH_CONNECT_TIMEOUT = 10;
+const EXISTS_MARKER = "__PORTSECURE_EXISTS__";
+const MISSING_MARKER = "__PORTSECURE_MISSING__";
+const MAX_ERROR_BODY_LENGTH = 500;
+// /etc is root owned, so fall back to sudo whenever the SSH user is not root.
+exports.SUDO_PREAMBLE = `SUDO=""; if [ "$(id -u)" -ne 0 ]; then SUDO="sudo -n"; fi`;
+/** The host string is handed to ssh untouched. Users, keys and ports belong in the caller's ssh
+    config, so BatchMode makes a missing setup fail immediately instead of prompting. */
+async function runOverSSH(config) {
+    let { host, script, input, allowFailure } = config;
+    let result = await (0, spawn_1.spawnPromise)({
+        command: "ssh",
+        args: [
+            "-o", "BatchMode=yes",
+            "-o", `ConnectTimeout=${SSH_CONNECT_TIMEOUT}`,
+            host,
+            script,
+        ],
+        input,
+        inheritStderr: !allowFailure,
+    });
+    if (result.error) {
+        throw new Error(`Expected ssh to run against ${host}, failed with ${result.error.message}`);
+    }
+    if (result.status !== 0 && !allowFailure) {
+        throw new Error(`Expected ssh to ${host} to exit 0, was ${result.status}.`
+            + ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.\n`
+            + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`);
+    }
+    return { stdout: result.stdout || "", stderr: result.stderr || "", status: result.status };
+}
+exports.runOverSSH = runOverSSH;
+/** Returns undefined when the file does not exist, so a missing file reads differently from an
+    empty one. */
+async function readRemoteFile(config) {
+    let { host, filePath } = config;
+    let output = (await runOverSSH({
+        host,
+        script: `${exports.SUDO_PREAMBLE}
+if $SUDO test -f "${filePath}"; then
+    echo "${EXISTS_MARKER}"
+    $SUDO cat "${filePath}"
+else
+    echo "${MISSING_MARKER}"
+fi`,
+    })).stdout;
+    let newlineIndex = output.indexOf("\n");
+    let marker = output.slice(0, newlineIndex).trim();
+    if (marker === MISSING_MARKER) {
+        return undefined;
+    }
+    if (marker !== EXISTS_MARKER) {
+        throw new Error(`Expected ${EXISTS_MARKER} or ${MISSING_MARKER} from ${host}, was ${output.slice(0, MAX_ERROR_BODY_LENGTH)}`);
+    }
+    return output.slice(newlineIndex + 1);
+}
+exports.readRemoteFile = readRemoteFile;
+async function writeRemoteFile(config) {
+    let { host, filePath, contents, fileMode, directoryMode } = config;
+    let directory = filePath.slice(0, filePath.lastIndexOf("/"));
+    await runOverSSH({
+        host,
+        // Deploying from Windows must not carry CRLF onto the target, where it breaks systemd
+        // units and makes private keys unreadable to ssh.
+        input: contents.replace(/\r\n/g, "\n"),
+        script: `${exports.SUDO_PREAMBLE}
+set -e
+$SUDO mkdir -p "${directory}"
+$SUDO chmod ${directoryMode} "${directory}"
+$SUDO tee "${filePath}" > /dev/null
+$SUDO chmod ${fileMode} "${filePath}"`,
+    });
+}
+exports.writeRemoteFile = writeRemoteFile;
+async function remoteCommandExists(config) {
+    let { host, command } = config;
+    let result = await runOverSSH({
+        host,
+        script: `command -v "${command}" > /dev/null 2>&1 && echo yes || echo no`,
+        allowFailure: true,
+    });
+    return result.stdout.trim() === "yes";
+}
+exports.remoteCommandExists = remoteCommandExists;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlU1NILmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmVtb3RlU1NILnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUF1QztBQUV2QyxNQUFNLG1CQUFtQixHQUFHLEVBQUUsQ0FBQztBQUMvQixNQUFNLGFBQWEsR0FBRyx1QkFBdUIsQ0FBQztBQUM5QyxNQUFNLGNBQWMsR0FBRyx3QkFBd0IsQ0FBQztBQUNoRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQztBQUVsQyw4RUFBOEU7QUFDakUsUUFBQSxhQUFhLEdBQUcsMkRBQTJELENBQUM7QUFFekY7d0ZBQ3dGO0FBQ2pGLEtBQUssVUFBVSxVQUFVLENBQUMsTUFBZ0Y7SUFDN0csSUFBSSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNuRCxJQUFJLE1BQU0sR0FBRyxNQUFNLElBQUEsb0JBQVksRUFBQztRQUM1QixPQUFPLEVBQUUsS0FBSztRQUNkLElBQUksRUFBRTtZQUNGLElBQUksRUFBRSxlQUFlO1lBQ3JCLElBQUksRUFBRSxrQkFBa0IsbUJBQW1CLEVBQUU7WUFDN0MsSUFBSTtZQUNKLE1BQU07U0FDVDtRQUNELEtBQUs7UUFDTCxhQUFhLEVBQUUsQ0FBQyxZQUFZO0tBQy9CLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsSUFBSSxpQkFBaUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkMsTUFBTSxJQUFJLEtBQUssQ0FDWCxtQkFBbUIsSUFBSSxtQkFBbUIsTUFBTSxDQUFDLE1BQU0sR0FBRztjQUN4RCxrQ0FBa0MsSUFBSSx3REFBd0Q7Y0FDOUYsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsRUFBRSxDQUNoRixDQUFDO0lBQ04sQ0FBQztJQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLElBQUksRUFBRSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDL0YsQ0FBQztBQXhCRCxnQ0F3QkM7QUFFRDtpQkFDaUI7QUFDVixLQUFLLFVBQVUsY0FBYyxDQUFDLE1BQTBDO0lBQzNFLElBQUksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ2hDLElBQUksTUFBTSxHQUFHLENBQUMsTUFBTSxVQUFVLENBQUM7UUFDM0IsSUFBSTtRQUNKLE1BQU0sRUFBRSxHQUFHLHFCQUFhO29CQUNaLFFBQVE7WUFDaEIsYUFBYTtpQkFDUixRQUFROztZQUViLGNBQWM7R0FDdkI7S0FDRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDWCxJQUFJLFlBQVksR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3hDLElBQUksTUFBTSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFlBQVksQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xELElBQUksTUFBTSxLQUFLLGNBQWMsRUFBRSxDQUFDO1FBQzVCLE9BQU8sU0FBUyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxJQUFJLE1BQU0sS0FBSyxhQUFhLEVBQUUsQ0FBQztRQUMzQixNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksYUFBYSxPQUFPLGNBQWMsU0FBUyxJQUFJLFNBQVMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDbEksQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDMUMsQ0FBQztBQXJCRCx3Q0FxQkM7QUFFTSxLQUFLLFVBQVUsZUFBZSxDQUFDLE1BTXJDO0lBQ0csSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxhQUFhLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDbkUsSUFBSSxTQUFTLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsUUFBUSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzdELE1BQU0sVUFBVSxDQUFDO1FBQ2IsSUFBSTtRQUNKLHNGQUFzRjtRQUN0RixrREFBa0Q7UUFDbEQsS0FBSyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQztRQUN0QyxNQUFNLEVBQUUsR0FBRyxxQkFBYTs7a0JBRWQsU0FBUztjQUNiLGFBQWEsS0FBSyxTQUFTO2FBQzVCLFFBQVE7Y0FDUCxRQUFRLEtBQUssUUFBUSxHQUFHO0tBQ2pDLENBQUMsQ0FBQztBQUNQLENBQUM7QUFyQkQsMENBcUJDO0FBRU0sS0FBSyxVQUFVLG1CQUFtQixDQUFDLE1BQXlDO0lBQy9FLElBQUksRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQy9CLElBQUksTUFBTSxHQUFHLE1BQU0sVUFBVSxDQUFDO1FBQzFCLElBQUk7UUFDSixNQUFNLEVBQUUsZUFBZSxPQUFPLDJDQUEyQztRQUN6RSxZQUFZLEVBQUUsSUFBSTtLQUNyQixDQUFDLENBQUM7SUFDSCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssS0FBSyxDQUFDO0FBQzFDLENBQUM7QUFSRCxrREFRQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IHNwYXduUHJvbWlzZSB9IGZyb20gXCIuL3NwYXduXCI7XG5cbmNvbnN0IFNTSF9DT05ORUNUX1RJTUVPVVQgPSAxMDtcbmNvbnN0IEVYSVNUU19NQVJLRVIgPSBcIl9fUE9SVFNFQ1VSRV9FWElTVFNfX1wiO1xuY29uc3QgTUlTU0lOR19NQVJLRVIgPSBcIl9fUE9SVFNFQ1VSRV9NSVNTSU5HX19cIjtcbmNvbnN0IE1BWF9FUlJPUl9CT0RZX0xFTkdUSCA9IDUwMDtcblxuLy8gL2V0YyBpcyByb290IG93bmVkLCBzbyBmYWxsIGJhY2sgdG8gc3VkbyB3aGVuZXZlciB0aGUgU1NIIHVzZXIgaXMgbm90IHJvb3QuXG5leHBvcnQgY29uc3QgU1VET19QUkVBTUJMRSA9IGBTVURPPVwiXCI7IGlmIFsgXCIkKGlkIC11KVwiIC1uZSAwIF07IHRoZW4gU1VETz1cInN1ZG8gLW5cIjsgZmlgO1xuXG4vKiogVGhlIGhvc3Qgc3RyaW5nIGlzIGhhbmRlZCB0byBzc2ggdW50b3VjaGVkLiBVc2Vycywga2V5cyBhbmQgcG9ydHMgYmVsb25nIGluIHRoZSBjYWxsZXIncyBzc2hcbiAgICBjb25maWcsIHNvIEJhdGNoTW9kZSBtYWtlcyBhIG1pc3Npbmcgc2V0dXAgZmFpbCBpbW1lZGlhdGVseSBpbnN0ZWFkIG9mIHByb21wdGluZy4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBydW5PdmVyU1NIKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IHNjcmlwdDogc3RyaW5nOyBpbnB1dD86IHN0cmluZzsgYWxsb3dGYWlsdXJlPzogYm9vbGVhbiB9KSB7XG4gICAgbGV0IHsgaG9zdCwgc2NyaXB0LCBpbnB1dCwgYWxsb3dGYWlsdXJlIH0gPSBjb25maWc7XG4gICAgbGV0IHJlc3VsdCA9IGF3YWl0IHNwYXduUHJvbWlzZSh7XG4gICAgICAgIGNvbW1hbmQ6IFwic3NoXCIsXG4gICAgICAgIGFyZ3M6IFtcbiAgICAgICAgICAgIFwiLW9cIiwgXCJCYXRjaE1vZGU9eWVzXCIsXG4gICAgICAgICAgICBcIi1vXCIsIGBDb25uZWN0VGltZW91dD0ke1NTSF9DT05ORUNUX1RJTUVPVVR9YCxcbiAgICAgICAgICAgIGhvc3QsXG4gICAgICAgICAgICBzY3JpcHQsXG4gICAgICAgIF0sXG4gICAgICAgIGlucHV0LFxuICAgICAgICBpbmhlcml0U3RkZXJyOiAhYWxsb3dGYWlsdXJlLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuZXJyb3IpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBzc2ggdG8gcnVuIGFnYWluc3QgJHtob3N0fSwgZmFpbGVkIHdpdGggJHtyZXN1bHQuZXJyb3IubWVzc2FnZX1gKTtcbiAgICB9XG4gICAgaWYgKHJlc3VsdC5zdGF0dXMgIT09IDAgJiYgIWFsbG93RmFpbHVyZSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgc3NoIHRvICR7aG9zdH0gdG8gZXhpdCAwLCB3YXMgJHtyZXN1bHQuc3RhdHVzfS5gXG4gICAgICAgICAgICArIGAgTm9uLWludGVyYWN0aXZlIHNzaCBhY2Nlc3MgdG8gJHtob3N0fSBoYXMgdG8gd29yayBvbiBpdHMgb3duIC0gZml4IGl0IGluIHlvdXIgc3NoIGNvbmZpZy5cXG5gXG4gICAgICAgICAgICArIGAkeyhyZXN1bHQuc3Rkb3V0ICsgcmVzdWx0LnN0ZGVycikudHJpbSgpLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICByZXR1cm4geyBzdGRvdXQ6IHJlc3VsdC5zdGRvdXQgfHwgXCJcIiwgc3RkZXJyOiByZXN1bHQuc3RkZXJyIHx8IFwiXCIsIHN0YXR1czogcmVzdWx0LnN0YXR1cyB9O1xufVxuXG4vKiogUmV0dXJucyB1bmRlZmluZWQgd2hlbiB0aGUgZmlsZSBkb2VzIG5vdCBleGlzdCwgc28gYSBtaXNzaW5nIGZpbGUgcmVhZHMgZGlmZmVyZW50bHkgZnJvbSBhblxuICAgIGVtcHR5IG9uZS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVtb3RlRmlsZShjb25maWc6IHsgaG9zdDogc3RyaW5nOyBmaWxlUGF0aDogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBob3N0LCBmaWxlUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBvdXRwdXQgPSAoYXdhaXQgcnVuT3ZlclNTSCh7XG4gICAgICAgIGhvc3QsXG4gICAgICAgIHNjcmlwdDogYCR7U1VET19QUkVBTUJMRX1cbmlmICRTVURPIHRlc3QgLWYgXCIke2ZpbGVQYXRofVwiOyB0aGVuXG4gICAgZWNobyBcIiR7RVhJU1RTX01BUktFUn1cIlxuICAgICRTVURPIGNhdCBcIiR7ZmlsZVBhdGh9XCJcbmVsc2VcbiAgICBlY2hvIFwiJHtNSVNTSU5HX01BUktFUn1cIlxuZmlgLFxuICAgIH0pKS5zdGRvdXQ7XG4gICAgbGV0IG5ld2xpbmVJbmRleCA9IG91dHB1dC5pbmRleE9mKFwiXFxuXCIpO1xuICAgIGxldCBtYXJrZXIgPSBvdXRwdXQuc2xpY2UoMCwgbmV3bGluZUluZGV4KS50cmltKCk7XG4gICAgaWYgKG1hcmtlciA9PT0gTUlTU0lOR19NQVJLRVIpIHtcbiAgICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9XG4gICAgaWYgKG1hcmtlciAhPT0gRVhJU1RTX01BUktFUikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7RVhJU1RTX01BUktFUn0gb3IgJHtNSVNTSU5HX01BUktFUn0gZnJvbSAke2hvc3R9LCB3YXMgJHtvdXRwdXQuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIG91dHB1dC5zbGljZShuZXdsaW5lSW5kZXggKyAxKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdyaXRlUmVtb3RlRmlsZShjb25maWc6IHtcbiAgICBob3N0OiBzdHJpbmc7XG4gICAgZmlsZVBhdGg6IHN0cmluZztcbiAgICBjb250ZW50czogc3RyaW5nO1xuICAgIGZpbGVNb2RlOiBzdHJpbmc7XG4gICAgZGlyZWN0b3J5TW9kZTogc3RyaW5nO1xufSkge1xuICAgIGxldCB7IGhvc3QsIGZpbGVQYXRoLCBjb250ZW50cywgZmlsZU1vZGUsIGRpcmVjdG9yeU1vZGUgfSA9IGNvbmZpZztcbiAgICBsZXQgZGlyZWN0b3J5ID0gZmlsZVBhdGguc2xpY2UoMCwgZmlsZVBhdGgubGFzdEluZGV4T2YoXCIvXCIpKTtcbiAgICBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgLy8gRGVwbG95aW5nIGZyb20gV2luZG93cyBtdXN0IG5vdCBjYXJyeSBDUkxGIG9udG8gdGhlIHRhcmdldCwgd2hlcmUgaXQgYnJlYWtzIHN5c3RlbWRcbiAgICAgICAgLy8gdW5pdHMgYW5kIG1ha2VzIHByaXZhdGUga2V5cyB1bnJlYWRhYmxlIHRvIHNzaC5cbiAgICAgICAgaW5wdXQ6IGNvbnRlbnRzLnJlcGxhY2UoL1xcclxcbi9nLCBcIlxcblwiKSxcbiAgICAgICAgc2NyaXB0OiBgJHtTVURPX1BSRUFNQkxFfVxuc2V0IC1lXG4kU1VETyBta2RpciAtcCBcIiR7ZGlyZWN0b3J5fVwiXG4kU1VETyBjaG1vZCAke2RpcmVjdG9yeU1vZGV9IFwiJHtkaXJlY3Rvcnl9XCJcbiRTVURPIHRlZSBcIiR7ZmlsZVBhdGh9XCIgPiAvZGV2L251bGxcbiRTVURPIGNobW9kICR7ZmlsZU1vZGV9IFwiJHtmaWxlUGF0aH1cImAsXG4gICAgfSk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZW1vdGVDb21tYW5kRXhpc3RzKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IGNvbW1hbmQ6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgaG9zdCwgY29tbWFuZCB9ID0gY29uZmlnO1xuICAgIGxldCByZXN1bHQgPSBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgc2NyaXB0OiBgY29tbWFuZCAtdiBcIiR7Y29tbWFuZH1cIiA+IC9kZXYvbnVsbCAyPiYxICYmIGVjaG8geWVzIHx8IGVjaG8gbm9gLFxuICAgICAgICBhbGxvd0ZhaWx1cmU6IHRydWUsXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlc3VsdC5zdGRvdXQudHJpbSgpID09PSBcInllc1wiO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "b9707fe65376e19327371edb2ebdda68daa9b9b21220d7ac91ec21ef22520290"; */

package/security/helpers/dist/spawn.ts.cache

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.spawnPromise = void 0;
+const child_process_1 = require("child_process");
+// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of spawnPromise, so it can run
+// with no dependencies. If you change one, make the matching change in the other.
+/** An argument list rather than a shell string, so hostnames and paths can never be parsed as
+    shell syntax. Resolves with the exit code instead of throwing, callers decide what a failure
+    means. `inheritStderr` lets a child's own errors reach the terminal as they happen. */
+function spawnPromise(config) {
+    let { command, args, cwd, input, inheritStderr, timeoutTime } = config;
+    return new Promise(resolve => {
+        var _a, _b, _c, _d;
+        let child = (0, child_process_1.spawn)(command, args, {
+            cwd,
+            stdio: ["pipe", "pipe", inheritStderr && "inherit" || "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        // A command that never returns would otherwise hold up everything behind it.
+        let timer = timeoutTime && setTimeout(() => child.kill("SIGKILL"), timeoutTime) || undefined;
+        child.on("close", () => timer && clearTimeout(timer));
+        (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on("data", chunk => stdout += chunk);
+        (_b = child.stderr) === null || _b === void 0 ? void 0 : _b.on("data", chunk => stderr += chunk);
+        child.on("error", error => resolve({ stdout, stderr, status: undefined, error }));
+        child.on("close", status => resolve({ stdout, stderr, status: status !== null && status !== void 0 ? status : undefined, error: undefined }));
+        // A child that exits before reading everything would otherwise raise EPIPE.
+        (_c = child.stdin) === null || _c === void 0 ? void 0 : _c.on("error", () => undefined);
+        (_d = child.stdin) === null || _d === void 0 ? void 0 : _d.end(input || "");
+    });
+}
+exports.spawnPromise = spawnPromise;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3Bhd24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJzcGF3bi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxpREFBc0M7QUFFdEMsMEhBQTBIO0FBQzFILGtGQUFrRjtBQUVsRjs7MEZBRTBGO0FBQzFGLFNBQWdCLFlBQVksQ0FBQyxNQU81QjtJQUNHLElBQUksRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLFdBQVcsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUN2RSxPQUFPLElBQUksT0FBTyxDQUEyRixPQUFPLENBQUMsRUFBRTs7UUFDbkgsSUFBSSxLQUFLLEdBQUcsSUFBQSxxQkFBSyxFQUFDLE9BQU8sRUFBRSxJQUFJLEVBQUU7WUFDN0IsR0FBRztZQUNILEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsYUFBYSxJQUFJLFNBQVMsSUFBSSxNQUFNLENBQUM7U0FDaEUsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxNQUFNLEdBQUcsRUFBRSxDQUFDO1FBQ2hCLElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztRQUNoQiw2RUFBNkU7UUFDN0UsSUFBSSxLQUFLLEdBQUcsV0FBVyxJQUFJLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxJQUFJLFNBQVMsQ0FBQztRQUM3RixLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxLQUFLLElBQUksWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDdEQsTUFBQSxLQUFLLENBQUMsTUFBTSwwQ0FBRSxFQUFFLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxDQUFDO1FBQ25ELE1BQUEsS0FBSyxDQUFDLE1BQU0sMENBQUUsRUFBRSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQztRQUNuRCxLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDbEYsS0FBSyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLGFBQU4sTUFBTSxjQUFOLE1BQU0sR0FBSSxTQUFTLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN4Ryw0RUFBNEU7UUFDNUUsTUFBQSxLQUFLLENBQUMsS0FBSywwQ0FBRSxFQUFFLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzFDLE1BQUEsS0FBSyxDQUFDLEtBQUssMENBQUUsR0FBRyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNsQyxDQUFDLENBQUMsQ0FBQztBQUNQLENBQUM7QUEzQkQsb0NBMkJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgc3Bhd24gfSBmcm9tIFwiY2hpbGRfcHJvY2Vzc1wiO1xuXG4vLyBQT1JURUQgQ09ERTogc2VjdXJpdHkvYXV0aG9yaXplZEtleXMvZGFlbW9uL3BvcnRzZWN1cmVEYWVtb24uanMgY29udGFpbnMgYSBwbGFpbiBKUyBwb3J0IG9mIHNwYXduUHJvbWlzZSwgc28gaXQgY2FuIHJ1blxuLy8gd2l0aCBubyBkZXBlbmRlbmNpZXMuIElmIHlvdSBjaGFuZ2Ugb25lLCBtYWtlIHRoZSBtYXRjaGluZyBjaGFuZ2UgaW4gdGhlIG90aGVyLlxuXG4vKiogQW4gYXJndW1lbnQgbGlzdCByYXRoZXIgdGhhbiBhIHNoZWxsIHN0cmluZywgc28gaG9zdG5hbWVzIGFuZCBwYXRocyBjYW4gbmV2ZXIgYmUgcGFyc2VkIGFzXG4gICAgc2hlbGwgc3ludGF4LiBSZXNvbHZlcyB3aXRoIHRoZSBleGl0IGNvZGUgaW5zdGVhZCBvZiB0aHJvd2luZywgY2FsbGVycyBkZWNpZGUgd2hhdCBhIGZhaWx1cmVcbiAgICBtZWFucy4gYGluaGVyaXRTdGRlcnJgIGxldHMgYSBjaGlsZCdzIG93biBlcnJvcnMgcmVhY2ggdGhlIHRlcm1pbmFsIGFzIHRoZXkgaGFwcGVuLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHNwYXduUHJvbWlzZShjb25maWc6IHtcbiAgICBjb21tYW5kOiBzdHJpbmc7XG4gICAgYXJnczogc3RyaW5nW107XG4gICAgY3dkPzogc3RyaW5nO1xuICAgIGlucHV0Pzogc3RyaW5nO1xuICAgIGluaGVyaXRTdGRlcnI/OiBib29sZWFuO1xuICAgIHRpbWVvdXRUaW1lPzogbnVtYmVyO1xufSkge1xuICAgIGxldCB7IGNvbW1hbmQsIGFyZ3MsIGN3ZCwgaW5wdXQsIGluaGVyaXRTdGRlcnIsIHRpbWVvdXRUaW1lIH0gPSBjb25maWc7XG4gICAgcmV0dXJuIG5ldyBQcm9taXNlPHsgc3Rkb3V0OiBzdHJpbmc7IHN0ZGVycjogc3RyaW5nOyBzdGF0dXM6IG51bWJlciB8IHVuZGVmaW5lZDsgZXJyb3I6IEVycm9yIHwgdW5kZWZpbmVkIH0+KHJlc29sdmUgPT4ge1xuICAgICAgICBsZXQgY2hpbGQgPSBzcGF3bihjb21tYW5kLCBhcmdzLCB7XG4gICAgICAgICAgICBjd2QsXG4gICAgICAgICAgICBzdGRpbzogW1wicGlwZVwiLCBcInBpcGVcIiwgaW5oZXJpdFN0ZGVyciAmJiBcImluaGVyaXRcIiB8fCBcInBpcGVcIl0sXG4gICAgICAgIH0pO1xuICAgICAgICBsZXQgc3Rkb3V0ID0gXCJcIjtcbiAgICAgICAgbGV0IHN0ZGVyciA9IFwiXCI7XG4gICAgICAgIC8vIEEgY29tbWFuZCB0aGF0IG5ldmVyIHJldHVybnMgd291bGQgb3RoZXJ3aXNlIGhvbGQgdXAgZXZlcnl0aGluZyBiZWhpbmQgaXQuXG4gICAgICAgIGxldCB0aW1lciA9IHRpbWVvdXRUaW1lICYmIHNldFRpbWVvdXQoKCkgPT4gY2hpbGQua2lsbChcIlNJR0tJTExcIiksIHRpbWVvdXRUaW1lKSB8fCB1bmRlZmluZWQ7XG4gICAgICAgIGNoaWxkLm9uKFwiY2xvc2VcIiwgKCkgPT4gdGltZXIgJiYgY2xlYXJUaW1lb3V0KHRpbWVyKSk7XG4gICAgICAgIGNoaWxkLnN0ZG91dD8ub24oXCJkYXRhXCIsIGNodW5rID0+IHN0ZG91dCArPSBjaHVuayk7XG4gICAgICAgIGNoaWxkLnN0ZGVycj8ub24oXCJkYXRhXCIsIGNodW5rID0+IHN0ZGVyciArPSBjaHVuayk7XG4gICAgICAgIGNoaWxkLm9uKFwiZXJyb3JcIiwgZXJyb3IgPT4gcmVzb2x2ZSh7IHN0ZG91dCwgc3RkZXJyLCBzdGF0dXM6IHVuZGVmaW5lZCwgZXJyb3IgfSkpO1xuICAgICAgICBjaGlsZC5vbihcImNsb3NlXCIsIHN0YXR1cyA9PiByZXNvbHZlKHsgc3Rkb3V0LCBzdGRlcnIsIHN0YXR1czogc3RhdHVzID8/IHVuZGVmaW5lZCwgZXJyb3I6IHVuZGVmaW5lZCB9KSk7XG4gICAgICAgIC8vIEEgY2hpbGQgdGhhdCBleGl0cyBiZWZvcmUgcmVhZGluZyBldmVyeXRoaW5nIHdvdWxkIG90aGVyd2lzZSByYWlzZSBFUElQRS5cbiAgICAgICAgY2hpbGQuc3RkaW4/Lm9uKFwiZXJyb3JcIiwgKCkgPT4gdW5kZWZpbmVkKTtcbiAgICAgICAgY2hpbGQuc3RkaW4/LmVuZChpbnB1dCB8fCBcIlwiKTtcbiAgICB9KTtcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "148887f3afb42a330df49eb955396403fab2e558c30741383b1a17b19a134288"; */

package/security/helpers/paths.ts

@@ -0,0 +1,20 @@
+import os from "os";
+import path from "path";
+
+/** Windows shells do not expand ~ themselves, and hunting down your home folder by hand is
+    annoying, so we expand it on every platform. Both separators are accepted, because a Windows
+    user may type either one. */
+export function expandHome(filePath: string) {
+    if (filePath === "~") {
+        return os.homedir();
+    }
+    if (filePath.startsWith("~/") || filePath.startsWith("~\\")) {
+        return path.join(os.homedir(), filePath.slice(2));
+    }
+    if (filePath.startsWith("~")) {
+        // ~otheruser needs an account database we cannot read portably, and quietly resolving it
+        // to the wrong home would be worse than refusing.
+        throw new Error(`Expected ~ or an ordinary path, was ${filePath}. Referring to another user's home with ~name is not supported.`);
+    }
+    return path.resolve(filePath);
+}

package/security/helpers/remoteSSH.ts

@@ -0,0 +1,95 @@
+import { spawnPromise } from "./spawn";
+
+const SSH_CONNECT_TIMEOUT = 10;
+const EXISTS_MARKER = "__PORTSECURE_EXISTS__";
+const MISSING_MARKER = "__PORTSECURE_MISSING__";
+const MAX_ERROR_BODY_LENGTH = 500;
+
+// /etc is root owned, so fall back to sudo whenever the SSH user is not root.
+export const SUDO_PREAMBLE = `SUDO=""; if [ "$(id -u)" -ne 0 ]; then SUDO="sudo -n"; fi`;
+
+/** The host string is handed to ssh untouched. Users, keys and ports belong in the caller's ssh
+    config, so BatchMode makes a missing setup fail immediately instead of prompting. */
+export async function runOverSSH(config: { host: string; script: string; input?: string; allowFailure?: boolean }) {
+    let { host, script, input, allowFailure } = config;
+    let result = await spawnPromise({
+        command: "ssh",
+        args: [
+            "-o", "BatchMode=yes",
+            "-o", `ConnectTimeout=${SSH_CONNECT_TIMEOUT}`,
+            host,
+            script,
+        ],
+        input,
+        inheritStderr: !allowFailure,
+    });
+    if (result.error) {
+        throw new Error(`Expected ssh to run against ${host}, failed with ${result.error.message}`);
+    }
+    if (result.status !== 0 && !allowFailure) {
+        throw new Error(
+            `Expected ssh to ${host} to exit 0, was ${result.status}.`
+            + ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.\n`
+            + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
+        );
+    }
+    return { stdout: result.stdout || "", stderr: result.stderr || "", status: result.status };
+}
+
+/** Returns undefined when the file does not exist, so a missing file reads differently from an
+    empty one. */
+export async function readRemoteFile(config: { host: string; filePath: string }) {
+    let { host, filePath } = config;
+    let output = (await runOverSSH({
+        host,
+        script: `${SUDO_PREAMBLE}
+if $SUDO test -f "${filePath}"; then
+    echo "${EXISTS_MARKER}"
+    $SUDO cat "${filePath}"
+else
+    echo "${MISSING_MARKER}"
+fi`,
+    })).stdout;
+    let newlineIndex = output.indexOf("\n");
+    let marker = output.slice(0, newlineIndex).trim();
+    if (marker === MISSING_MARKER) {
+        return undefined;
+    }
+    if (marker !== EXISTS_MARKER) {
+        throw new Error(`Expected ${EXISTS_MARKER} or ${MISSING_MARKER} from ${host}, was ${output.slice(0, MAX_ERROR_BODY_LENGTH)}`);
+    }
+    return output.slice(newlineIndex + 1);
+}
+
+export async function writeRemoteFile(config: {
+    host: string;
+    filePath: string;
+    contents: string;
+    fileMode: string;
+    directoryMode: string;
+}) {
+    let { host, filePath, contents, fileMode, directoryMode } = config;
+    let directory = filePath.slice(0, filePath.lastIndexOf("/"));
+    await runOverSSH({
+        host,
+        // Deploying from Windows must not carry CRLF onto the target, where it breaks systemd
+        // units and makes private keys unreadable to ssh.
+        input: contents.replace(/\r\n/g, "\n"),
+        script: `${SUDO_PREAMBLE}
+set -e
+$SUDO mkdir -p "${directory}"
+$SUDO chmod ${directoryMode} "${directory}"
+$SUDO tee "${filePath}" > /dev/null
+$SUDO chmod ${fileMode} "${filePath}"`,
+    });
+}
+
+export async function remoteCommandExists(config: { host: string; command: string }) {
+    let { host, command } = config;
+    let result = await runOverSSH({
+        host,
+        script: `command -v "${command}" > /dev/null 2>&1 && echo yes || echo no`,
+        allowFailure: true,
+    });
+    return result.stdout.trim() === "yes";
+}

package/security/helpers/spawn.ts

@@ -0,0 +1,36 @@
+import { spawn } from "child_process";
+
+// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of spawnPromise, so it can run
+// with no dependencies. If you change one, make the matching change in the other.
+
+/** An argument list rather than a shell string, so hostnames and paths can never be parsed as
+    shell syntax. Resolves with the exit code instead of throwing, callers decide what a failure
+    means. `inheritStderr` lets a child's own errors reach the terminal as they happen. */
+export function spawnPromise(config: {
+    command: string;
+    args: string[];
+    cwd?: string;
+    input?: string;
+    inheritStderr?: boolean;
+    timeoutTime?: number;
+}) {
+    let { command, args, cwd, input, inheritStderr, timeoutTime } = config;
+    return new Promise<{ stdout: string; stderr: string; status: number | undefined; error: Error | undefined }>(resolve => {
+        let child = spawn(command, args, {
+            cwd,
+            stdio: ["pipe", "pipe", inheritStderr && "inherit" || "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        // A command that never returns would otherwise hold up everything behind it.
+        let timer = timeoutTime && setTimeout(() => child.kill("SIGKILL"), timeoutTime) || undefined;
+        child.on("close", () => timer && clearTimeout(timer));
+        child.stdout?.on("data", chunk => stdout += chunk);
+        child.stderr?.on("data", chunk => stderr += chunk);
+        child.on("error", error => resolve({ stdout, stderr, status: undefined, error }));
+        child.on("close", status => resolve({ stdout, stderr, status: status ?? undefined, error: undefined }));
+        // A child that exits before reading everything would otherwise raise EPIPE.
+        child.stdin?.on("error", () => undefined);
+        child.stdin?.end(input || "");
+    });
+}

package/security/keys/deriveKey.ts

@@ -0,0 +1,72 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import { expandHome } from "../helpers/paths";
+import { formatOpenSSHPrivateKey, formatPublicKeyLine, parseOpenSSHPrivateKey, publicKeyFromSeed } from "./sshKeyFile";
+
+const USAGE = `Usage: yarn derivekey <label> <source-key> <derived-key>
+
+Derives a second ed25519 key from an existing one. The same label and source key always give the
+same derived key, so it can be worked out again rather than backed up.
+
+  yarn derivekey revokegithubkey ~/authorized_keys_access/id_ed25519 ~/authorized_keys_access/id_ed25519_revoke`;
+
+/** A label mixed into a key's secret to get another key, so one key can stand behind several
+    identities without any of them being stored.
+
+    HMAC rather than hashing the two joined together: with a plain hash, anyone who obtained one
+    derived key could extend it into further labels without ever knowing the source key. The label
+    is the message and the source secret is the key, which is what HMAC is for. */
+export function deriveEd25519Key(config: { seed: Buffer; label: string }) {
+    let { seed, label } = config;
+    if (!label) {
+        throw new Error(`Expected a label to derive with, was ${JSON.stringify(label)}`);
+    }
+    let derivedSeed = crypto.createHmac("sha256", seed).update(label, "utf8").digest();
+    return { seed: derivedSeed, publicKey: publicKeyFromSeed(derivedSeed) };
+}
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+function parseArgs(argv: string[]) {
+    if (argv.length !== 3) {
+        throw new Error(`Expected a label, a source key and a derived key, was ${argv.length} argument(s)\n${USAGE}`);
+    }
+    let [label, sourcePath, derivedPath] = argv;
+    return { label, sourcePath: expandHome(sourcePath), derivedPath: expandHome(derivedPath) };
+}
+
+export async function main() {
+    let { label, sourcePath, derivedPath } = parseArgs(process.argv.slice(2));
+
+    if (!await pathExists(sourcePath)) {
+        throw new Error(`Expected a source key at ${sourcePath}, no such file exists`);
+    }
+    // Writing over a key would strand whatever it already gives access to, and the derived key can
+    // always be worked out again, so there is never a reason to overwrite.
+    if (await pathExists(derivedPath)) {
+        throw new Error(
+            `Expected ${derivedPath} to not exist, it does. Deriving the same label again gives the`
+            + ` same key, so delete it first if you want it rewritten.`
+        );
+    }
+
+    let source = parseOpenSSHPrivateKey(await fs.readFile(sourcePath, "utf8"));
+    let derived = deriveEd25519Key({ seed: source.seed, label });
+    let comment = `${source.comment || sourcePath} ${label}`.trim();
+
+    await fs.writeFile(derivedPath, formatOpenSSHPrivateKey({ seed: derived.seed, comment }), { mode: 0o600 });
+    let publicLine = formatPublicKeyLine({ publicKey: derived.publicKey, comment });
+    await fs.writeFile(`${derivedPath}.pub`, publicLine, { mode: 0o644 });
+
+    console.log(`Derived "${label}" from ${sourcePath}`);
+    console.log(`  private ${derivedPath}`);
+    console.log(`  public  ${derivedPath}.pub`);
+    console.log(publicLine.trim());
+}

package/security/keys/dist/deriveKey.ts.cache

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.main = exports.deriveEd25519Key = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const promises_1 = __importDefault(require("fs/promises"));
+const paths_1 = require("../helpers/paths");
+const sshKeyFile_1 = require("./sshKeyFile");
+const USAGE = `Usage: yarn derivekey <label> <source-key> <derived-key>
+
+Derives a second ed25519 key from an existing one. The same label and source key always give the
+same derived key, so it can be worked out again rather than backed up.
+
+  yarn derivekey revokegithubkey ~/authorized_keys_access/id_ed25519 ~/authorized_keys_access/id_ed25519_revoke`;
+/** A label mixed into a key's secret to get another key, so one key can stand behind several
+    identities without any of them being stored.
+
+    HMAC rather than hashing the two joined together: with a plain hash, anyone who obtained one
+    derived key could extend it into further labels without ever knowing the source key. The label
+    is the message and the source secret is the key, which is what HMAC is for. */
+function deriveEd25519Key(config) {
+    let { seed, label } = config;
+    if (!label) {
+        throw new Error(`Expected a label to derive with, was ${JSON.stringify(label)}`);
+    }
+    let derivedSeed = crypto_1.default.createHmac("sha256", seed).update(label, "utf8").digest();
+    return { seed: derivedSeed, publicKey: (0, sshKeyFile_1.publicKeyFromSeed)(derivedSeed) };
+}
+exports.deriveEd25519Key = deriveEd25519Key;
+async function pathExists(filePath) {
+    try {
+        await promises_1.default.access(filePath);
+        return true;
+    }
+    catch (e) {
+        return false;
+    }
+}
+function parseArgs(argv) {
+    if (argv.length !== 3) {
+        throw new Error(`Expected a label, a source key and a derived key, was ${argv.length} argument(s)\n${USAGE}`);
+    }
+    let [label, sourcePath, derivedPath] = argv;
+    return { label, sourcePath: (0, paths_1.expandHome)(sourcePath), derivedPath: (0, paths_1.expandHome)(derivedPath) };
+}
+async function main() {
+    let { label, sourcePath, derivedPath } = parseArgs(process.argv.slice(2));
+    if (!await pathExists(sourcePath)) {
+        throw new Error(`Expected a source key at ${sourcePath}, no such file exists`);
+    }
+    // Writing over a key would strand whatever it already gives access to, and the derived key can
+    // always be worked out again, so there is never a reason to overwrite.
+    if (await pathExists(derivedPath)) {
+        throw new Error(`Expected ${derivedPath} to not exist, it does. Deriving the same label again gives the`
+            + ` same key, so delete it first if you want it rewritten.`);
+    }
+    let source = (0, sshKeyFile_1.parseOpenSSHPrivateKey)(await promises_1.default.readFile(sourcePath, "utf8"));
+    let derived = deriveEd25519Key({ seed: source.seed, label });
+    let comment = `${source.comment || sourcePath} ${label}`.trim();
+    await promises_1.default.writeFile(derivedPath, (0, sshKeyFile_1.formatOpenSSHPrivateKey)({ seed: derived.seed, comment }), { mode: 0o600 });
+    let publicLine = (0, sshKeyFile_1.formatPublicKeyLine)({ publicKey: derived.publicKey, comment });
+    await promises_1.default.writeFile(`${derivedPath}.pub`, publicLine, { mode: 0o644 });
+    console.log(`Derived "${label}" from ${sourcePath}`);
+    console.log(`  private ${derivedPath}`);
+    console.log(`  public  ${derivedPath}.pub`);
+    console.log(publicLine.trim());
+}
+exports.main = main;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVyaXZlS2V5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiZGVyaXZlS2V5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLG9EQUE0QjtBQUM1QiwyREFBNkI7QUFDN0IsNENBQThDO0FBQzlDLDZDQUF1SDtBQUV2SCxNQUFNLEtBQUssR0FBRzs7Ozs7Z0hBS2tHLENBQUM7QUFFakg7Ozs7O2tGQUtrRjtBQUNsRixTQUFnQixnQkFBZ0IsQ0FBQyxNQUF1QztJQUNwRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUM3QixJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDVCxNQUFNLElBQUksS0FBSyxDQUFDLHdDQUF3QyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxXQUFXLEdBQUcsZ0JBQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDbkYsT0FBTyxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsU0FBUyxFQUFFLElBQUEsOEJBQWlCLEVBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztBQUM1RSxDQUFDO0FBUEQsNENBT0M7QUFFRCxLQUFLLFVBQVUsVUFBVSxDQUFDLFFBQWdCO0lBQ3RDLElBQUksQ0FBQztRQUNELE1BQU0sa0JBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUIsT0FBTyxJQUFJLENBQUM7SUFDaEIsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0FBQ0wsQ0FBQztBQUVELFNBQVMsU0FBUyxDQUFDLElBQWM7SUFDN0IsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3BCLE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELElBQUksQ0FBQyxNQUFNLGlCQUFpQixLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ2xILENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxXQUFXLENBQUMsR0FBRyxJQUFJLENBQUM7SUFDNUMsT0FBTyxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsSUFBQSxrQkFBVSxFQUFDLFVBQVUsQ0FBQyxFQUFFLFdBQVcsRUFBRSxJQUFBLGtCQUFVLEVBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztBQUMvRixDQUFDO0FBRU0sS0FBSyxVQUFVLElBQUk7SUFDdEIsSUFBSSxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFFMUUsSUFBSSxDQUFDLE1BQU0sVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDaEMsTUFBTSxJQUFJLEtBQUssQ0FBQyw0QkFBNEIsVUFBVSx1QkFBdUIsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCwrRkFBK0Y7SUFDL0YsdUVBQXVFO0lBQ3ZFLElBQUksTUFBTSxVQUFVLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNoQyxNQUFNLElBQUksS0FBSyxDQUNYLFlBQVksV0FBVyxpRUFBaUU7Y0FDdEYseURBQXlELENBQzlELENBQUM7SUFDTixDQUFDO0lBRUQsSUFBSSxNQUFNLEdBQUcsSUFBQSxtQ0FBc0IsRUFBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQzNFLElBQUksT0FBTyxHQUFHLGdCQUFnQixDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUM3RCxJQUFJLE9BQU8sR0FBRyxHQUFHLE1BQU0sQ0FBQyxPQUFPLElBQUksVUFBVSxJQUFJLEtBQUssRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDO0lBRWhFLE1BQU0sa0JBQUUsQ0FBQyxTQUFTLENBQUMsV0FBVyxFQUFFLElBQUEsb0NBQXVCLEVBQUMsRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQyxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDM0csSUFBSSxVQUFVLEdBQUcsSUFBQSxnQ0FBbUIsRUFBQyxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDaEYsTUFBTSxrQkFBRSxDQUFDLFNBQVMsQ0FBQyxHQUFHLFdBQVcsTUFBTSxFQUFFLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBRXRFLE9BQU8sQ0FBQyxHQUFHLENBQUMsWUFBWSxLQUFLLFVBQVUsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUNyRCxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUN4QyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsV0FBVyxNQUFNLENBQUMsQ0FBQztJQUM1QyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0FBQ25DLENBQUM7QUEzQkQsb0JBMkJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGNyeXB0byBmcm9tIFwiY3J5cHRvXCI7XG5pbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5pbXBvcnQgeyBleHBhbmRIb21lIH0gZnJvbSBcIi4uL2hlbHBlcnMvcGF0aHNcIjtcbmltcG9ydCB7IGZvcm1hdE9wZW5TU0hQcml2YXRlS2V5LCBmb3JtYXRQdWJsaWNLZXlMaW5lLCBwYXJzZU9wZW5TU0hQcml2YXRlS2V5LCBwdWJsaWNLZXlGcm9tU2VlZCB9IGZyb20gXCIuL3NzaEtleUZpbGVcIjtcblxuY29uc3QgVVNBR0UgPSBgVXNhZ2U6IHlhcm4gZGVyaXZla2V5IDxsYWJlbD4gPHNvdXJjZS1rZXk+IDxkZXJpdmVkLWtleT5cblxuRGVyaXZlcyBhIHNlY29uZCBlZDI1NTE5IGtleSBmcm9tIGFuIGV4aXN0aW5nIG9uZS4gVGhlIHNhbWUgbGFiZWwgYW5kIHNvdXJjZSBrZXkgYWx3YXlzIGdpdmUgdGhlXG5zYW1lIGRlcml2ZWQga2V5LCBzbyBpdCBjYW4gYmUgd29ya2VkIG91dCBhZ2FpbiByYXRoZXIgdGhhbiBiYWNrZWQgdXAuXG5cbiAgeWFybiBkZXJpdmVrZXkgcmV2b2tlZ2l0aHVia2V5IH4vYXV0aG9yaXplZF9rZXlzX2FjY2Vzcy9pZF9lZDI1NTE5IH4vYXV0aG9yaXplZF9rZXlzX2FjY2Vzcy9pZF9lZDI1NTE5X3Jldm9rZWA7XG5cbi8qKiBBIGxhYmVsIG1peGVkIGludG8gYSBrZXkncyBzZWNyZXQgdG8gZ2V0IGFub3RoZXIga2V5LCBzbyBvbmUga2V5IGNhbiBzdGFuZCBiZWhpbmQgc2V2ZXJhbFxuICAgIGlkZW50aXRpZXMgd2l0aG91dCBhbnkgb2YgdGhlbSBiZWluZyBzdG9yZWQuXG5cbiAgICBITUFDIHJhdGhlciB0aGFuIGhhc2hpbmcgdGhlIHR3byBqb2luZWQgdG9nZXRoZXI6IHdpdGggYSBwbGFpbiBoYXNoLCBhbnlvbmUgd2hvIG9idGFpbmVkIG9uZVxuICAgIGRlcml2ZWQga2V5IGNvdWxkIGV4dGVuZCBpdCBpbnRvIGZ1cnRoZXIgbGFiZWxzIHdpdGhvdXQgZXZlciBrbm93aW5nIHRoZSBzb3VyY2Uga2V5LiBUaGUgbGFiZWxcbiAgICBpcyB0aGUgbWVzc2FnZSBhbmQgdGhlIHNvdXJjZSBzZWNyZXQgaXMgdGhlIGtleSwgd2hpY2ggaXMgd2hhdCBITUFDIGlzIGZvci4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkZXJpdmVFZDI1NTE5S2V5KGNvbmZpZzogeyBzZWVkOiBCdWZmZXI7IGxhYmVsOiBzdHJpbmcgfSkge1xuICAgIGxldCB7IHNlZWQsIGxhYmVsIH0gPSBjb25maWc7XG4gICAgaWYgKCFsYWJlbCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgbGFiZWwgdG8gZGVyaXZlIHdpdGgsIHdhcyAke0pTT04uc3RyaW5naWZ5KGxhYmVsKX1gKTtcbiAgICB9XG4gICAgbGV0IGRlcml2ZWRTZWVkID0gY3J5cHRvLmNyZWF0ZUhtYWMoXCJzaGEyNTZcIiwgc2VlZCkudXBkYXRlKGxhYmVsLCBcInV0ZjhcIikuZGlnZXN0KCk7XG4gICAgcmV0dXJuIHsgc2VlZDogZGVyaXZlZFNlZWQsIHB1YmxpY0tleTogcHVibGljS2V5RnJvbVNlZWQoZGVyaXZlZFNlZWQpIH07XG59XG5cbmFzeW5jIGZ1bmN0aW9uIHBhdGhFeGlzdHMoZmlsZVBhdGg6IHN0cmluZykge1xuICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IGZzLmFjY2VzcyhmaWxlUGF0aCk7XG4gICAgICAgIHJldHVybiB0cnVlO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cbn1cblxuZnVuY3Rpb24gcGFyc2VBcmdzKGFyZ3Y6IHN0cmluZ1tdKSB7XG4gICAgaWYgKGFyZ3YubGVuZ3RoICE9PSAzKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYSBsYWJlbCwgYSBzb3VyY2Uga2V5IGFuZCBhIGRlcml2ZWQga2V5LCB3YXMgJHthcmd2Lmxlbmd0aH0gYXJndW1lbnQocylcXG4ke1VTQUdFfWApO1xuICAgIH1cbiAgICBsZXQgW2xhYmVsLCBzb3VyY2VQYXRoLCBkZXJpdmVkUGF0aF0gPSBhcmd2O1xuICAgIHJldHVybiB7IGxhYmVsLCBzb3VyY2VQYXRoOiBleHBhbmRIb21lKHNvdXJjZVBhdGgpLCBkZXJpdmVkUGF0aDogZXhwYW5kSG9tZShkZXJpdmVkUGF0aCkgfTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIG1haW4oKSB7XG4gICAgbGV0IHsgbGFiZWwsIHNvdXJjZVBhdGgsIGRlcml2ZWRQYXRoIH0gPSBwYXJzZUFyZ3MocHJvY2Vzcy5hcmd2LnNsaWNlKDIpKTtcblxuICAgIGlmICghYXdhaXQgcGF0aEV4aXN0cyhzb3VyY2VQYXRoKSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgc291cmNlIGtleSBhdCAke3NvdXJjZVBhdGh9LCBubyBzdWNoIGZpbGUgZXhpc3RzYCk7XG4gICAgfVxuICAgIC8vIFdyaXRpbmcgb3ZlciBhIGtleSB3b3VsZCBzdHJhbmQgd2hhdGV2ZXIgaXQgYWxyZWFkeSBnaXZlcyBhY2Nlc3MgdG8sIGFuZCB0aGUgZGVyaXZlZCBrZXkgY2FuXG4gICAgLy8gYWx3YXlzIGJlIHdvcmtlZCBvdXQgYWdhaW4sIHNvIHRoZXJlIGlzIG5ldmVyIGEgcmVhc29uIHRvIG92ZXJ3cml0ZS5cbiAgICBpZiAoYXdhaXQgcGF0aEV4aXN0cyhkZXJpdmVkUGF0aCkpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAgICAgYEV4cGVjdGVkICR7ZGVyaXZlZFBhdGh9IHRvIG5vdCBleGlzdCwgaXQgZG9lcy4gRGVyaXZpbmcgdGhlIHNhbWUgbGFiZWwgYWdhaW4gZ2l2ZXMgdGhlYFxuICAgICAgICAgICAgKyBgIHNhbWUga2V5LCBzbyBkZWxldGUgaXQgZmlyc3QgaWYgeW91IHdhbnQgaXQgcmV3cml0dGVuLmBcbiAgICAgICAgKTtcbiAgICB9XG5cbiAgICBsZXQgc291cmNlID0gcGFyc2VPcGVuU1NIUHJpdmF0ZUtleShhd2FpdCBmcy5yZWFkRmlsZShzb3VyY2VQYXRoLCBcInV0ZjhcIikpO1xuICAgIGxldCBkZXJpdmVkID0gZGVyaXZlRWQyNTUxOUtleSh7IHNlZWQ6IHNvdXJjZS5zZWVkLCBsYWJlbCB9KTtcbiAgICBsZXQgY29tbWVudCA9IGAke3NvdXJjZS5jb21tZW50IHx8IHNvdXJjZVBhdGh9ICR7bGFiZWx9YC50cmltKCk7XG5cbiAgICBhd2FpdCBmcy53cml0ZUZpbGUoZGVyaXZlZFBhdGgsIGZvcm1hdE9wZW5TU0hQcml2YXRlS2V5KHsgc2VlZDogZGVyaXZlZC5zZWVkLCBjb21tZW50IH0pLCB7IG1vZGU6IDBvNjAwIH0pO1xuICAgIGxldCBwdWJsaWNMaW5lID0gZm9ybWF0UHVibGljS2V5TGluZSh7IHB1YmxpY0tleTogZGVyaXZlZC5wdWJsaWNLZXksIGNvbW1lbnQgfSk7XG4gICAgYXdhaXQgZnMud3JpdGVGaWxlKGAke2Rlcml2ZWRQYXRofS5wdWJgLCBwdWJsaWNMaW5lLCB7IG1vZGU6IDBvNjQ0IH0pO1xuXG4gICAgY29uc29sZS5sb2coYERlcml2ZWQgXCIke2xhYmVsfVwiIGZyb20gJHtzb3VyY2VQYXRofWApO1xuICAgIGNvbnNvbGUubG9nKGAgIHByaXZhdGUgJHtkZXJpdmVkUGF0aH1gKTtcbiAgICBjb25zb2xlLmxvZyhgICBwdWJsaWMgICR7ZGVyaXZlZFBhdGh9LnB1YmApO1xuICAgIGNvbnNvbGUubG9nKHB1YmxpY0xpbmUudHJpbSgpKTtcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "7d3b190d59d20686acd4f001d6c457d0b90d75d2ae382d6aff4571bb3310be76"; */