sliftutils 1.7.124 → 1.7.126

package/security/keys/dist/sshKeyFile.ts.cache

@@ -0,0 +1,153 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.formatPublicKeyLine = exports.formatOpenSSHPrivateKey = exports.parseOpenSSHPrivateKey = exports.publicKeyFromSeed = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+// OpenSSH keeps private keys in its own container rather than anything node can read, so the few
+// bytes of it we need are handled here. Only unencrypted ed25519 keys are supported, which is what
+// a key used by automation is.
+const MAGIC = "openssh-key-v1\0";
+const KEY_TYPE = "ssh-ed25519";
+const NONE = "none";
+const SEED_LENGTH = 32;
+const PUBLIC_LENGTH = 32;
+// The one block size that matters here, since nothing is encrypted.
+const PADDING_BLOCK = 8;
+const PEM_LINE_LENGTH = 70;
+const PRIVATE_HEADER = "-----BEGIN OPENSSH PRIVATE KEY-----";
+const PRIVATE_FOOTER = "-----END OPENSSH PRIVATE KEY-----";
+// The prefix that turns a bare 32 byte seed into a pkcs8 ed25519 key node will accept.
+const PKCS8_ED25519_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+class ByteReader {
+    constructor(buffer) {
+        this.buffer = buffer;
+        this.offset = 0;
+    }
+    readBytes(length) {
+        let value = this.buffer.subarray(this.offset, this.offset + length);
+        if (value.length !== length) {
+            throw new Error(`Expected ${length} bytes at offset ${this.offset}, was ${value.length}`);
+        }
+        this.offset += length;
+        return value;
+    }
+    readUInt32() {
+        let value = this.buffer.readUInt32BE(this.offset);
+        this.offset += 4;
+        return value;
+    }
+    readString() {
+        return this.readBytes(this.readUInt32());
+    }
+}
+function writeString(value) {
+    let contents = Buffer.isBuffer(value) && value || Buffer.from(value, "utf8");
+    let length = Buffer.alloc(4);
+    length.writeUInt32BE(contents.length);
+    return Buffer.concat([length, contents]);
+}
+function writeUInt32(value) {
+    let bytes = Buffer.alloc(4);
+    bytes.writeUInt32BE(value);
+    return bytes;
+}
+/** The public key of a seed, worked out by node rather than by reimplementing the curve. */
+function publicKeyFromSeed(seed) {
+    if (seed.length !== SEED_LENGTH) {
+        throw new Error(`Expected a ${SEED_LENGTH} byte seed, was ${seed.length}`);
+    }
+    let privateKey = crypto_1.default.createPrivateKey({
+        key: Buffer.concat([PKCS8_ED25519_PREFIX, seed]),
+        format: "der",
+        type: "pkcs8",
+    });
+    // The spki wrapper is a fixed 12 byte header followed by the raw key.
+    return crypto_1.default.createPublicKey(privateKey).export({ format: "der", type: "spki" }).subarray(12);
+}
+exports.publicKeyFromSeed = publicKeyFromSeed;
+function parseOpenSSHPrivateKey(contents) {
+    let body = contents.split("\n").filter(line => line.trim() && !line.startsWith("-----")).join("");
+    if (!contents.includes(PRIVATE_HEADER)) {
+        throw new Error(`Expected an OpenSSH private key starting with ${PRIVATE_HEADER}`);
+    }
+    let reader = new ByteReader(Buffer.from(body, "base64"));
+    if (reader.readBytes(MAGIC.length).toString() !== MAGIC) {
+        throw new Error(`Expected the key to start with ${JSON.stringify(MAGIC)}`);
+    }
+    let cipherName = reader.readString().toString();
+    let kdfName = reader.readString().toString();
+    reader.readString();
+    if (cipherName !== NONE || kdfName !== NONE) {
+        throw new Error(`Expected an unencrypted key, was encrypted with ${cipherName}/${kdfName}.`
+            + ` Remove the passphrase with "ssh-keygen -p" first.`);
+    }
+    let keyCount = reader.readUInt32();
+    if (keyCount !== 1) {
+        throw new Error(`Expected the key file to hold one key, held ${keyCount}`);
+    }
+    reader.readString();
+    let privateSection = new ByteReader(reader.readString());
+    let checkOne = privateSection.readUInt32();
+    let checkTwo = privateSection.readUInt32();
+    if (checkOne !== checkTwo) {
+        throw new Error(`Expected the key's two check values to match, were ${checkOne} and ${checkTwo}`);
+    }
+    let keyType = privateSection.readString().toString();
+    if (keyType !== KEY_TYPE) {
+        throw new Error(`Expected an ${KEY_TYPE} key, was ${keyType}`);
+    }
+    privateSection.readString();
+    // OpenSSH stores the seed and the public key together in the private field.
+    let privateValue = privateSection.readString();
+    if (privateValue.length !== SEED_LENGTH + PUBLIC_LENGTH) {
+        throw new Error(`Expected a ${SEED_LENGTH + PUBLIC_LENGTH} byte private value, was ${privateValue.length}`);
+    }
+    return {
+        seed: privateValue.subarray(0, SEED_LENGTH),
+        publicKey: privateValue.subarray(SEED_LENGTH),
+        comment: privateSection.readString().toString(),
+    };
+}
+exports.parseOpenSSHPrivateKey = parseOpenSSHPrivateKey;
+function formatOpenSSHPrivateKey(config) {
+    let { seed, comment } = config;
+    let publicKey = publicKeyFromSeed(seed);
+    let publicBlob = Buffer.concat([writeString(KEY_TYPE), writeString(publicKey)]);
+    // The check value only proves a passphrase decrypted correctly, and nothing here is encrypted.
+    // Taking it from the seed keeps the same input producing the same file, so deriving a key twice
+    // is something you can compare rather than something that looks different every time.
+    let check = crypto_1.default.createHash("sha256").update(seed).digest().readUInt32BE(0);
+    let privateSection = Buffer.concat([
+        writeUInt32(check),
+        writeUInt32(check),
+        writeString(KEY_TYPE),
+        writeString(publicKey),
+        writeString(Buffer.concat([seed, publicKey])),
+        writeString(comment),
+    ]);
+    let paddingLength = (PADDING_BLOCK - privateSection.length % PADDING_BLOCK) % PADDING_BLOCK;
+    let padding = Buffer.from(Array.from({ length: paddingLength }, (unused, index) => index + 1));
+    let contents = Buffer.concat([
+        Buffer.from(MAGIC),
+        writeString(NONE),
+        writeString(NONE),
+        writeString(""),
+        writeUInt32(1),
+        writeString(publicBlob),
+        writeString(Buffer.concat([privateSection, padding])),
+    ]);
+    let encoded = contents.toString("base64").match(new RegExp(`.{1,${PEM_LINE_LENGTH}}`, "g")) || [];
+    return `${PRIVATE_HEADER}\n${encoded.join("\n")}\n${PRIVATE_FOOTER}\n`;
+}
+exports.formatOpenSSHPrivateKey = formatOpenSSHPrivateKey;
+/** The single line form, as it appears in authorized_keys and in a .pub file. */
+function formatPublicKeyLine(config) {
+    let { publicKey, comment } = config;
+    let blob = Buffer.concat([writeString(KEY_TYPE), writeString(publicKey)]);
+    return `${KEY_TYPE} ${blob.toString("base64")}${comment && ` ${comment}` || ""}\n`;
+}
+exports.formatPublicKeyLine = formatPublicKeyLine;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3NoS2V5RmlsZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInNzaEtleUZpbGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQUEsb0RBQTRCO0FBRTVCLGlHQUFpRztBQUNqRyxtR0FBbUc7QUFDbkcsK0JBQStCO0FBRS9CLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDO0FBQ2pDLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQztBQUMvQixNQUFNLElBQUksR0FBRyxNQUFNLENBQUM7QUFDcEIsTUFBTSxXQUFXLEdBQUcsRUFBRSxDQUFDO0FBQ3ZCLE1BQU0sYUFBYSxHQUFHLEVBQUUsQ0FBQztBQUN6QixvRUFBb0U7QUFDcEUsTUFBTSxhQUFhLEdBQUcsQ0FBQyxDQUFDO0FBQ3hCLE1BQU0sZUFBZSxHQUFHLEVBQUUsQ0FBQztBQUMzQixNQUFNLGNBQWMsR0FBRyxxQ0FBcUMsQ0FBQztBQUM3RCxNQUFNLGNBQWMsR0FBRyxtQ0FBbUMsQ0FBQztBQUMzRCx1RkFBdUY7QUFDdkYsTUFBTSxvQkFBb0IsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLGtDQUFrQyxFQUFFLEtBQUssQ0FBQyxDQUFDO0FBRXBGLE1BQU0sVUFBVTtJQUVaLFlBQW9CLE1BQWM7UUFBZCxXQUFNLEdBQU4sTUFBTSxDQUFRO1FBRDFCLFdBQU0sR0FBRyxDQUFDLENBQUM7SUFDbUIsQ0FBQztJQUV2QyxTQUFTLENBQUMsTUFBYztRQUNwQixJQUFJLEtBQUssR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLENBQUM7UUFDcEUsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsWUFBWSxNQUFNLG9CQUFvQixJQUFJLENBQUMsTUFBTSxTQUFTLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQzlGLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQztRQUN0QixPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsVUFBVTtRQUNOLElBQUksS0FBSyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNsRCxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsQ0FBQztRQUNqQixPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsVUFBVTtRQUNOLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUM3QyxDQUFDO0NBQ0o7QUFFRCxTQUFTLFdBQVcsQ0FBQyxLQUFzQjtJQUN2QyxJQUFJLFFBQVEsR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUM3RSxJQUFJLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzdCLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0FBQzdDLENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxLQUFhO0lBQzlCLElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUIsS0FBSyxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUMzQixPQUFPLEtBQUssQ0FBQztBQUNqQixDQUFDO0FBRUQsNEZBQTRGO0FBQzVGLFNBQWdCLGlCQUFpQixDQUFDLElBQVk7SUFDMUMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQzlCLE1BQU0sSUFBSSxLQUFLLENBQUMsY0FBYyxXQUFXLG1CQUFtQixJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsSUFBSSxVQUFVLEdBQUcsZ0JBQU0sQ0FBQyxnQkFBZ0IsQ0FBQztRQUNyQyxHQUFHLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLG9CQUFvQixFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2hELE1BQU0sRUFBRSxLQUFLO1FBQ2IsSUFBSSxFQUFFLE9BQU87S0FDaEIsQ0FBQyxDQUFDO0lBQ0gsc0VBQXNFO0lBQ3RFLE9BQU8sZ0JBQU0sQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxDQUFDLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDbkcsQ0FBQztBQVhELDhDQVdDO0FBRUQsU0FBZ0Isc0JBQXNCLENBQUMsUUFBZ0I7SUFDbkQsSUFBSSxJQUFJLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2xHLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDckMsTUFBTSxJQUFJLEtBQUssQ0FBQyxpREFBaUQsY0FBYyxFQUFFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSxNQUFNLEdBQUcsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN6RCxJQUFJLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBRSxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQ3RELE1BQU0sSUFBSSxLQUFLLENBQUMsa0NBQWtDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxJQUFJLFVBQVUsR0FBRyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDaEQsSUFBSSxPQUFPLEdBQUcsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDO0lBQzdDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUNwQixJQUFJLFVBQVUsS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQzFDLE1BQU0sSUFBSSxLQUFLLENBQ1gsbURBQW1ELFVBQVUsSUFBSSxPQUFPLEdBQUc7Y0FDekUsb0RBQW9ELENBQ3pELENBQUM7SUFDTixDQUFDO0lBQ0QsSUFBSSxRQUFRLEdBQUcsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQ25DLElBQUksUUFBUSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2pCLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUVwQixJQUFJLGNBQWMsR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUN6RCxJQUFJLFFBQVEsR0FBRyxjQUFjLENBQUMsVUFBVSxFQUFFLENBQUM7SUFDM0MsSUFBSSxRQUFRLEdBQUcsY0FBYyxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQzNDLElBQUksUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0RBQXNELFFBQVEsUUFBUSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3RHLENBQUM7SUFDRCxJQUFJLE9BQU8sR0FBRyxjQUFjLENBQUMsVUFBVSxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDckQsSUFBSSxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyxlQUFlLFFBQVEsYUFBYSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxjQUFjLENBQUMsVUFBVSxFQUFFLENBQUM7SUFDNUIsNEVBQTRFO0lBQzVFLElBQUksWUFBWSxHQUFHLGNBQWMsQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUMvQyxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssV0FBVyxHQUFHLGFBQWEsRUFBRSxDQUFDO1FBQ3RELE1BQU0sSUFBSSxLQUFLLENBQUMsY0FBYyxXQUFXLEdBQUcsYUFBYSw0QkFBNEIsWUFBWSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDaEgsQ0FBQztJQUNELE9BQU87UUFDSCxJQUFJLEVBQUUsWUFBWSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsV0FBVyxDQUFDO1FBQzNDLFNBQVMsRUFBRSxZQUFZLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztRQUM3QyxPQUFPLEVBQUUsY0FBYyxDQUFDLFVBQVUsRUFBRSxDQUFDLFFBQVEsRUFBRTtLQUNsRCxDQUFDO0FBQ04sQ0FBQztBQTdDRCx3REE2Q0M7QUFFRCxTQUFnQix1QkFBdUIsQ0FBQyxNQUF5QztJQUM3RSxJQUFJLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUMvQixJQUFJLFNBQVMsR0FBRyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN4QyxJQUFJLFVBQVUsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFFaEYsK0ZBQStGO0lBQy9GLGdHQUFnRztJQUNoRyxzRkFBc0Y7SUFDdEYsSUFBSSxLQUFLLEdBQUcsZ0JBQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM5RSxJQUFJLGNBQWMsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQy9CLFdBQVcsQ0FBQyxLQUFLLENBQUM7UUFDbEIsV0FBVyxDQUFDLEtBQUssQ0FBQztRQUNsQixXQUFXLENBQUMsUUFBUSxDQUFDO1FBQ3JCLFdBQVcsQ0FBQyxTQUFTLENBQUM7UUFDdEIsV0FBVyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUM3QyxXQUFXLENBQUMsT0FBTyxDQUFDO0tBQ3ZCLENBQUMsQ0FBQztJQUNILElBQUksYUFBYSxHQUFHLENBQUMsYUFBYSxHQUFHLGNBQWMsQ0FBQyxNQUFNLEdBQUcsYUFBYSxDQUFDLEdBQUcsYUFBYSxDQUFDO0lBQzVGLElBQUksT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLE1BQU0sRUFBRSxhQUFhLEVBQUUsRUFBRSxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBRS9GLElBQUksUUFBUSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDekIsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUM7UUFDbEIsV0FBVyxDQUFDLElBQUksQ0FBQztRQUNqQixXQUFXLENBQUMsSUFBSSxDQUFDO1FBQ2pCLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDZixXQUFXLENBQUMsQ0FBQyxDQUFDO1FBQ2QsV0FBVyxDQUFDLFVBQVUsQ0FBQztRQUN2QixXQUFXLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLGNBQWMsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0tBQ3hELENBQUMsQ0FBQztJQUNILElBQUksT0FBTyxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sZUFBZSxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDbEcsT0FBTyxHQUFHLGNBQWMsS0FBSyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLGNBQWMsSUFBSSxDQUFDO0FBQzNFLENBQUM7QUEvQkQsMERBK0JDO0FBRUQsaUZBQWlGO0FBQ2pGLFNBQWdCLG1CQUFtQixDQUFDLE1BQThDO0lBQzlFLElBQUksRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ3BDLElBQUksSUFBSSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLEVBQUUsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMxRSxPQUFPLEdBQUcsUUFBUSxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsT0FBTyxJQUFJLElBQUksT0FBTyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUM7QUFDdkYsQ0FBQztBQUpELGtEQUlDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGNyeXB0byBmcm9tIFwiY3J5cHRvXCI7XG5cbi8vIE9wZW5TU0gga2VlcHMgcHJpdmF0ZSBrZXlzIGluIGl0cyBvd24gY29udGFpbmVyIHJhdGhlciB0aGFuIGFueXRoaW5nIG5vZGUgY2FuIHJlYWQsIHNvIHRoZSBmZXdcbi8vIGJ5dGVzIG9mIGl0IHdlIG5lZWQgYXJlIGhhbmRsZWQgaGVyZS4gT25seSB1bmVuY3J5cHRlZCBlZDI1NTE5IGtleXMgYXJlIHN1cHBvcnRlZCwgd2hpY2ggaXMgd2hhdFxuLy8gYSBrZXkgdXNlZCBieSBhdXRvbWF0aW9uIGlzLlxuXG5jb25zdCBNQUdJQyA9IFwib3BlbnNzaC1rZXktdjFcXDBcIjtcbmNvbnN0IEtFWV9UWVBFID0gXCJzc2gtZWQyNTUxOVwiO1xuY29uc3QgTk9ORSA9IFwibm9uZVwiO1xuY29uc3QgU0VFRF9MRU5HVEggPSAzMjtcbmNvbnN0IFBVQkxJQ19MRU5HVEggPSAzMjtcbi8vIFRoZSBvbmUgYmxvY2sgc2l6ZSB0aGF0IG1hdHRlcnMgaGVyZSwgc2luY2Ugbm90aGluZyBpcyBlbmNyeXB0ZWQuXG5jb25zdCBQQURESU5HX0JMT0NLID0gODtcbmNvbnN0IFBFTV9MSU5FX0xFTkdUSCA9IDcwO1xuY29uc3QgUFJJVkFURV9IRUFERVIgPSBcIi0tLS0tQkVHSU4gT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tXCI7XG5jb25zdCBQUklWQVRFX0ZPT1RFUiA9IFwiLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tXCI7XG4vLyBUaGUgcHJlZml4IHRoYXQgdHVybnMgYSBiYXJlIDMyIGJ5dGUgc2VlZCBpbnRvIGEgcGtjczggZWQyNTUxOSBrZXkgbm9kZSB3aWxsIGFjY2VwdC5cbmNvbnN0IFBLQ1M4X0VEMjU1MTlfUFJFRklYID0gQnVmZmVyLmZyb20oXCIzMDJlMDIwMTAwMzAwNTA2MDMyYjY1NzAwNDIyMDQyMFwiLCBcImhleFwiKTtcblxuY2xhc3MgQnl0ZVJlYWRlciB7XG4gICAgcHJpdmF0ZSBvZmZzZXQgPSAwO1xuICAgIGNvbnN0cnVjdG9yKHByaXZhdGUgYnVmZmVyOiBCdWZmZXIpIHsgfVxuXG4gICAgcmVhZEJ5dGVzKGxlbmd0aDogbnVtYmVyKSB7XG4gICAgICAgIGxldCB2YWx1ZSA9IHRoaXMuYnVmZmVyLnN1YmFycmF5KHRoaXMub2Zmc2V0LCB0aGlzLm9mZnNldCArIGxlbmd0aCk7XG4gICAgICAgIGlmICh2YWx1ZS5sZW5ndGggIT09IGxlbmd0aCkge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCAke2xlbmd0aH0gYnl0ZXMgYXQgb2Zmc2V0ICR7dGhpcy5vZmZzZXR9LCB3YXMgJHt2YWx1ZS5sZW5ndGh9YCk7XG4gICAgICAgIH1cbiAgICAgICAgdGhpcy5vZmZzZXQgKz0gbGVuZ3RoO1xuICAgICAgICByZXR1cm4gdmFsdWU7XG4gICAgfVxuXG4gICAgcmVhZFVJbnQzMigpIHtcbiAgICAgICAgbGV0IHZhbHVlID0gdGhpcy5idWZmZXIucmVhZFVJbnQzMkJFKHRoaXMub2Zmc2V0KTtcbiAgICAgICAgdGhpcy5vZmZzZXQgKz0gNDtcbiAgICAgICAgcmV0dXJuIHZhbHVlO1xuICAgIH1cblxuICAgIHJlYWRTdHJpbmcoKSB7XG4gICAgICAgIHJldHVybiB0aGlzLnJlYWRCeXRlcyh0aGlzLnJlYWRVSW50MzIoKSk7XG4gICAgfVxufVxuXG5mdW5jdGlvbiB3cml0ZVN0cmluZyh2YWx1ZTogQnVmZmVyIHwgc3RyaW5nKSB7XG4gICAgbGV0IGNvbnRlbnRzID0gQnVmZmVyLmlzQnVmZmVyKHZhbHVlKSAmJiB2YWx1ZSB8fCBCdWZmZXIuZnJvbSh2YWx1ZSwgXCJ1dGY4XCIpO1xuICAgIGxldCBsZW5ndGggPSBCdWZmZXIuYWxsb2MoNCk7XG4gICAgbGVuZ3RoLndyaXRlVUludDMyQkUoY29udGVudHMubGVuZ3RoKTtcbiAgICByZXR1cm4gQnVmZmVyLmNvbmNhdChbbGVuZ3RoLCBjb250ZW50c10pO1xufVxuXG5mdW5jdGlvbiB3cml0ZVVJbnQzMih2YWx1ZTogbnVtYmVyKSB7XG4gICAgbGV0IGJ5dGVzID0gQnVmZmVyLmFsbG9jKDQpO1xuICAgIGJ5dGVzLndyaXRlVUludDMyQkUodmFsdWUpO1xuICAgIHJldHVybiBieXRlcztcbn1cblxuLyoqIFRoZSBwdWJsaWMga2V5IG9mIGEgc2VlZCwgd29ya2VkIG91dCBieSBub2RlIHJhdGhlciB0aGFuIGJ5IHJlaW1wbGVtZW50aW5nIHRoZSBjdXJ2ZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBwdWJsaWNLZXlGcm9tU2VlZChzZWVkOiBCdWZmZXIpIHtcbiAgICBpZiAoc2VlZC5sZW5ndGggIT09IFNFRURfTEVOR1RIKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYSAke1NFRURfTEVOR1RIfSBieXRlIHNlZWQsIHdhcyAke3NlZWQubGVuZ3RofWApO1xuICAgIH1cbiAgICBsZXQgcHJpdmF0ZUtleSA9IGNyeXB0by5jcmVhdGVQcml2YXRlS2V5KHtcbiAgICAgICAga2V5OiBCdWZmZXIuY29uY2F0KFtQS0NTOF9FRDI1NTE5X1BSRUZJWCwgc2VlZF0pLFxuICAgICAgICBmb3JtYXQ6IFwiZGVyXCIsXG4gICAgICAgIHR5cGU6IFwicGtjczhcIixcbiAgICB9KTtcbiAgICAvLyBUaGUgc3BraSB3cmFwcGVyIGlzIGEgZml4ZWQgMTIgYnl0ZSBoZWFkZXIgZm9sbG93ZWQgYnkgdGhlIHJhdyBrZXkuXG4gICAgcmV0dXJuIGNyeXB0by5jcmVhdGVQdWJsaWNLZXkocHJpdmF0ZUtleSkuZXhwb3J0KHsgZm9ybWF0OiBcImRlclwiLCB0eXBlOiBcInNwa2lcIiB9KS5zdWJhcnJheSgxMik7XG59XG5cbmV4cG9ydCBmdW5jdGlvbiBwYXJzZU9wZW5TU0hQcml2YXRlS2V5KGNvbnRlbnRzOiBzdHJpbmcpIHtcbiAgICBsZXQgYm9keSA9IGNvbnRlbnRzLnNwbGl0KFwiXFxuXCIpLmZpbHRlcihsaW5lID0+IGxpbmUudHJpbSgpICYmICFsaW5lLnN0YXJ0c1dpdGgoXCItLS0tLVwiKSkuam9pbihcIlwiKTtcbiAgICBpZiAoIWNvbnRlbnRzLmluY2x1ZGVzKFBSSVZBVEVfSEVBREVSKSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGFuIE9wZW5TU0ggcHJpdmF0ZSBrZXkgc3RhcnRpbmcgd2l0aCAke1BSSVZBVEVfSEVBREVSfWApO1xuICAgIH1cbiAgICBsZXQgcmVhZGVyID0gbmV3IEJ5dGVSZWFkZXIoQnVmZmVyLmZyb20oYm9keSwgXCJiYXNlNjRcIikpO1xuICAgIGlmIChyZWFkZXIucmVhZEJ5dGVzKE1BR0lDLmxlbmd0aCkudG9TdHJpbmcoKSAhPT0gTUFHSUMpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCB0aGUga2V5IHRvIHN0YXJ0IHdpdGggJHtKU09OLnN0cmluZ2lmeShNQUdJQyl9YCk7XG4gICAgfVxuICAgIGxldCBjaXBoZXJOYW1lID0gcmVhZGVyLnJlYWRTdHJpbmcoKS50b1N0cmluZygpO1xuICAgIGxldCBrZGZOYW1lID0gcmVhZGVyLnJlYWRTdHJpbmcoKS50b1N0cmluZygpO1xuICAgIHJlYWRlci5yZWFkU3RyaW5nKCk7XG4gICAgaWYgKGNpcGhlck5hbWUgIT09IE5PTkUgfHwga2RmTmFtZSAhPT0gTk9ORSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgYW4gdW5lbmNyeXB0ZWQga2V5LCB3YXMgZW5jcnlwdGVkIHdpdGggJHtjaXBoZXJOYW1lfS8ke2tkZk5hbWV9LmBcbiAgICAgICAgICAgICsgYCBSZW1vdmUgdGhlIHBhc3NwaHJhc2Ugd2l0aCBcInNzaC1rZXlnZW4gLXBcIiBmaXJzdC5gXG4gICAgICAgICk7XG4gICAgfVxuICAgIGxldCBrZXlDb3VudCA9IHJlYWRlci5yZWFkVUludDMyKCk7XG4gICAgaWYgKGtleUNvdW50ICE9PSAxKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgdGhlIGtleSBmaWxlIHRvIGhvbGQgb25lIGtleSwgaGVsZCAke2tleUNvdW50fWApO1xuICAgIH1cbiAgICByZWFkZXIucmVhZFN0cmluZygpO1xuXG4gICAgbGV0IHByaXZhdGVTZWN0aW9uID0gbmV3IEJ5dGVSZWFkZXIocmVhZGVyLnJlYWRTdHJpbmcoKSk7XG4gICAgbGV0IGNoZWNrT25lID0gcHJpdmF0ZVNlY3Rpb24ucmVhZFVJbnQzMigpO1xuICAgIGxldCBjaGVja1R3byA9IHByaXZhdGVTZWN0aW9uLnJlYWRVSW50MzIoKTtcbiAgICBpZiAoY2hlY2tPbmUgIT09IGNoZWNrVHdvKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgdGhlIGtleSdzIHR3byBjaGVjayB2YWx1ZXMgdG8gbWF0Y2gsIHdlcmUgJHtjaGVja09uZX0gYW5kICR7Y2hlY2tUd299YCk7XG4gICAgfVxuICAgIGxldCBrZXlUeXBlID0gcHJpdmF0ZVNlY3Rpb24ucmVhZFN0cmluZygpLnRvU3RyaW5nKCk7XG4gICAgaWYgKGtleVR5cGUgIT09IEtFWV9UWVBFKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYW4gJHtLRVlfVFlQRX0ga2V5LCB3YXMgJHtrZXlUeXBlfWApO1xuICAgIH1cbiAgICBwcml2YXRlU2VjdGlvbi5yZWFkU3RyaW5nKCk7XG4gICAgLy8gT3BlblNTSCBzdG9yZXMgdGhlIHNlZWQgYW5kIHRoZSBwdWJsaWMga2V5IHRvZ2V0aGVyIGluIHRoZSBwcml2YXRlIGZpZWxkLlxuICAgIGxldCBwcml2YXRlVmFsdWUgPSBwcml2YXRlU2VjdGlvbi5yZWFkU3RyaW5nKCk7XG4gICAgaWYgKHByaXZhdGVWYWx1ZS5sZW5ndGggIT09IFNFRURfTEVOR1RIICsgUFVCTElDX0xFTkdUSCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgJHtTRUVEX0xFTkdUSCArIFBVQkxJQ19MRU5HVEh9IGJ5dGUgcHJpdmF0ZSB2YWx1ZSwgd2FzICR7cHJpdmF0ZVZhbHVlLmxlbmd0aH1gKTtcbiAgICB9XG4gICAgcmV0dXJuIHtcbiAgICAgICAgc2VlZDogcHJpdmF0ZVZhbHVlLnN1YmFycmF5KDAsIFNFRURfTEVOR1RIKSxcbiAgICAgICAgcHVibGljS2V5OiBwcml2YXRlVmFsdWUuc3ViYXJyYXkoU0VFRF9MRU5HVEgpLFxuICAgICAgICBjb21tZW50OiBwcml2YXRlU2VjdGlvbi5yZWFkU3RyaW5nKCkudG9TdHJpbmcoKSxcbiAgICB9O1xufVxuXG5leHBvcnQgZnVuY3Rpb24gZm9ybWF0T3BlblNTSFByaXZhdGVLZXkoY29uZmlnOiB7IHNlZWQ6IEJ1ZmZlcjsgY29tbWVudDogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBzZWVkLCBjb21tZW50IH0gPSBjb25maWc7XG4gICAgbGV0IHB1YmxpY0tleSA9IHB1YmxpY0tleUZyb21TZWVkKHNlZWQpO1xuICAgIGxldCBwdWJsaWNCbG9iID0gQnVmZmVyLmNvbmNhdChbd3JpdGVTdHJpbmcoS0VZX1RZUEUpLCB3cml0ZVN0cmluZyhwdWJsaWNLZXkpXSk7XG5cbiAgICAvLyBUaGUgY2hlY2sgdmFsdWUgb25seSBwcm92ZXMgYSBwYXNzcGhyYXNlIGRlY3J5cHRlZCBjb3JyZWN0bHksIGFuZCBub3RoaW5nIGhlcmUgaXMgZW5jcnlwdGVkLlxuICAgIC8vIFRha2luZyBpdCBmcm9tIHRoZSBzZWVkIGtlZXBzIHRoZSBzYW1lIGlucHV0IHByb2R1Y2luZyB0aGUgc2FtZSBmaWxlLCBzbyBkZXJpdmluZyBhIGtleSB0d2ljZVxuICAgIC8vIGlzIHNvbWV0aGluZyB5b3UgY2FuIGNvbXBhcmUgcmF0aGVyIHRoYW4gc29tZXRoaW5nIHRoYXQgbG9va3MgZGlmZmVyZW50IGV2ZXJ5IHRpbWUuXG4gICAgbGV0IGNoZWNrID0gY3J5cHRvLmNyZWF0ZUhhc2goXCJzaGEyNTZcIikudXBkYXRlKHNlZWQpLmRpZ2VzdCgpLnJlYWRVSW50MzJCRSgwKTtcbiAgICBsZXQgcHJpdmF0ZVNlY3Rpb24gPSBCdWZmZXIuY29uY2F0KFtcbiAgICAgICAgd3JpdGVVSW50MzIoY2hlY2spLFxuICAgICAgICB3cml0ZVVJbnQzMihjaGVjayksXG4gICAgICAgIHdyaXRlU3RyaW5nKEtFWV9UWVBFKSxcbiAgICAgICAgd3JpdGVTdHJpbmcocHVibGljS2V5KSxcbiAgICAgICAgd3JpdGVTdHJpbmcoQnVmZmVyLmNvbmNhdChbc2VlZCwgcHVibGljS2V5XSkpLFxuICAgICAgICB3cml0ZVN0cmluZyhjb21tZW50KSxcbiAgICBdKTtcbiAgICBsZXQgcGFkZGluZ0xlbmd0aCA9IChQQURESU5HX0JMT0NLIC0gcHJpdmF0ZVNlY3Rpb24ubGVuZ3RoICUgUEFERElOR19CTE9DSykgJSBQQURESU5HX0JMT0NLO1xuICAgIGxldCBwYWRkaW5nID0gQnVmZmVyLmZyb20oQXJyYXkuZnJvbSh7IGxlbmd0aDogcGFkZGluZ0xlbmd0aCB9LCAodW51c2VkLCBpbmRleCkgPT4gaW5kZXggKyAxKSk7XG5cbiAgICBsZXQgY29udGVudHMgPSBCdWZmZXIuY29uY2F0KFtcbiAgICAgICAgQnVmZmVyLmZyb20oTUFHSUMpLFxuICAgICAgICB3cml0ZVN0cmluZyhOT05FKSxcbiAgICAgICAgd3JpdGVTdHJpbmcoTk9ORSksXG4gICAgICAgIHdyaXRlU3RyaW5nKFwiXCIpLFxuICAgICAgICB3cml0ZVVJbnQzMigxKSxcbiAgICAgICAgd3JpdGVTdHJpbmcocHVibGljQmxvYiksXG4gICAgICAgIHdyaXRlU3RyaW5nKEJ1ZmZlci5jb25jYXQoW3ByaXZhdGVTZWN0aW9uLCBwYWRkaW5nXSkpLFxuICAgIF0pO1xuICAgIGxldCBlbmNvZGVkID0gY29udGVudHMudG9TdHJpbmcoXCJiYXNlNjRcIikubWF0Y2gobmV3IFJlZ0V4cChgLnsxLCR7UEVNX0xJTkVfTEVOR1RIfX1gLCBcImdcIikpIHx8IFtdO1xuICAgIHJldHVybiBgJHtQUklWQVRFX0hFQURFUn1cXG4ke2VuY29kZWQuam9pbihcIlxcblwiKX1cXG4ke1BSSVZBVEVfRk9PVEVSfVxcbmA7XG59XG5cbi8qKiBUaGUgc2luZ2xlIGxpbmUgZm9ybSwgYXMgaXQgYXBwZWFycyBpbiBhdXRob3JpemVkX2tleXMgYW5kIGluIGEgLnB1YiBmaWxlLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGZvcm1hdFB1YmxpY0tleUxpbmUoY29uZmlnOiB7IHB1YmxpY0tleTogQnVmZmVyOyBjb21tZW50OiBzdHJpbmcgfSkge1xuICAgIGxldCB7IHB1YmxpY0tleSwgY29tbWVudCB9ID0gY29uZmlnO1xuICAgIGxldCBibG9iID0gQnVmZmVyLmNvbmNhdChbd3JpdGVTdHJpbmcoS0VZX1RZUEUpLCB3cml0ZVN0cmluZyhwdWJsaWNLZXkpXSk7XG4gICAgcmV0dXJuIGAke0tFWV9UWVBFfSAke2Jsb2IudG9TdHJpbmcoXCJiYXNlNjRcIil9JHtjb21tZW50ICYmIGAgJHtjb21tZW50fWAgfHwgXCJcIn1cXG5gO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "57e4d1fd38c49a01bb35cf57a53a29f28eb2053b81167b87b4c17bab13251fae"; */

package/security/keys/sshKeyFile.ts

@@ -0,0 +1,156 @@
+import crypto from "crypto";
+
+// OpenSSH keeps private keys in its own container rather than anything node can read, so the few
+// bytes of it we need are handled here. Only unencrypted ed25519 keys are supported, which is what
+// a key used by automation is.
+
+const MAGIC = "openssh-key-v1\0";
+const KEY_TYPE = "ssh-ed25519";
+const NONE = "none";
+const SEED_LENGTH = 32;
+const PUBLIC_LENGTH = 32;
+// The one block size that matters here, since nothing is encrypted.
+const PADDING_BLOCK = 8;
+const PEM_LINE_LENGTH = 70;
+const PRIVATE_HEADER = "-----BEGIN OPENSSH PRIVATE KEY-----";
+const PRIVATE_FOOTER = "-----END OPENSSH PRIVATE KEY-----";
+// The prefix that turns a bare 32 byte seed into a pkcs8 ed25519 key node will accept.
+const PKCS8_ED25519_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+
+class ByteReader {
+    private offset = 0;
+    constructor(private buffer: Buffer) { }
+
+    readBytes(length: number) {
+        let value = this.buffer.subarray(this.offset, this.offset + length);
+        if (value.length !== length) {
+            throw new Error(`Expected ${length} bytes at offset ${this.offset}, was ${value.length}`);
+        }
+        this.offset += length;
+        return value;
+    }
+
+    readUInt32() {
+        let value = this.buffer.readUInt32BE(this.offset);
+        this.offset += 4;
+        return value;
+    }
+
+    readString() {
+        return this.readBytes(this.readUInt32());
+    }
+}
+
+function writeString(value: Buffer | string) {
+    let contents = Buffer.isBuffer(value) && value || Buffer.from(value, "utf8");
+    let length = Buffer.alloc(4);
+    length.writeUInt32BE(contents.length);
+    return Buffer.concat([length, contents]);
+}
+
+function writeUInt32(value: number) {
+    let bytes = Buffer.alloc(4);
+    bytes.writeUInt32BE(value);
+    return bytes;
+}
+
+/** The public key of a seed, worked out by node rather than by reimplementing the curve. */
+export function publicKeyFromSeed(seed: Buffer) {
+    if (seed.length !== SEED_LENGTH) {
+        throw new Error(`Expected a ${SEED_LENGTH} byte seed, was ${seed.length}`);
+    }
+    let privateKey = crypto.createPrivateKey({
+        key: Buffer.concat([PKCS8_ED25519_PREFIX, seed]),
+        format: "der",
+        type: "pkcs8",
+    });
+    // The spki wrapper is a fixed 12 byte header followed by the raw key.
+    return crypto.createPublicKey(privateKey).export({ format: "der", type: "spki" }).subarray(12);
+}
+
+export function parseOpenSSHPrivateKey(contents: string) {
+    let body = contents.split("\n").filter(line => line.trim() && !line.startsWith("-----")).join("");
+    if (!contents.includes(PRIVATE_HEADER)) {
+        throw new Error(`Expected an OpenSSH private key starting with ${PRIVATE_HEADER}`);
+    }
+    let reader = new ByteReader(Buffer.from(body, "base64"));
+    if (reader.readBytes(MAGIC.length).toString() !== MAGIC) {
+        throw new Error(`Expected the key to start with ${JSON.stringify(MAGIC)}`);
+    }
+    let cipherName = reader.readString().toString();
+    let kdfName = reader.readString().toString();
+    reader.readString();
+    if (cipherName !== NONE || kdfName !== NONE) {
+        throw new Error(
+            `Expected an unencrypted key, was encrypted with ${cipherName}/${kdfName}.`
+            + ` Remove the passphrase with "ssh-keygen -p" first.`
+        );
+    }
+    let keyCount = reader.readUInt32();
+    if (keyCount !== 1) {
+        throw new Error(`Expected the key file to hold one key, held ${keyCount}`);
+    }
+    reader.readString();
+
+    let privateSection = new ByteReader(reader.readString());
+    let checkOne = privateSection.readUInt32();
+    let checkTwo = privateSection.readUInt32();
+    if (checkOne !== checkTwo) {
+        throw new Error(`Expected the key's two check values to match, were ${checkOne} and ${checkTwo}`);
+    }
+    let keyType = privateSection.readString().toString();
+    if (keyType !== KEY_TYPE) {
+        throw new Error(`Expected an ${KEY_TYPE} key, was ${keyType}`);
+    }
+    privateSection.readString();
+    // OpenSSH stores the seed and the public key together in the private field.
+    let privateValue = privateSection.readString();
+    if (privateValue.length !== SEED_LENGTH + PUBLIC_LENGTH) {
+        throw new Error(`Expected a ${SEED_LENGTH + PUBLIC_LENGTH} byte private value, was ${privateValue.length}`);
+    }
+    return {
+        seed: privateValue.subarray(0, SEED_LENGTH),
+        publicKey: privateValue.subarray(SEED_LENGTH),
+        comment: privateSection.readString().toString(),
+    };
+}
+
+export function formatOpenSSHPrivateKey(config: { seed: Buffer; comment: string }) {
+    let { seed, comment } = config;
+    let publicKey = publicKeyFromSeed(seed);
+    let publicBlob = Buffer.concat([writeString(KEY_TYPE), writeString(publicKey)]);
+
+    // The check value only proves a passphrase decrypted correctly, and nothing here is encrypted.
+    // Taking it from the seed keeps the same input producing the same file, so deriving a key twice
+    // is something you can compare rather than something that looks different every time.
+    let check = crypto.createHash("sha256").update(seed).digest().readUInt32BE(0);
+    let privateSection = Buffer.concat([
+        writeUInt32(check),
+        writeUInt32(check),
+        writeString(KEY_TYPE),
+        writeString(publicKey),
+        writeString(Buffer.concat([seed, publicKey])),
+        writeString(comment),
+    ]);
+    let paddingLength = (PADDING_BLOCK - privateSection.length % PADDING_BLOCK) % PADDING_BLOCK;
+    let padding = Buffer.from(Array.from({ length: paddingLength }, (unused, index) => index + 1));
+
+    let contents = Buffer.concat([
+        Buffer.from(MAGIC),
+        writeString(NONE),
+        writeString(NONE),
+        writeString(""),
+        writeUInt32(1),
+        writeString(publicBlob),
+        writeString(Buffer.concat([privateSection, padding])),
+    ]);
+    let encoded = contents.toString("base64").match(new RegExp(`.{1,${PEM_LINE_LENGTH}}`, "g")) || [];
+    return `${PRIVATE_HEADER}\n${encoded.join("\n")}\n${PRIVATE_FOOTER}\n`;
+}
+
+/** The single line form, as it appears in authorized_keys and in a .pub file. */
+export function formatPublicKeyLine(config: { publicKey: Buffer; comment: string }) {
+    let { publicKey, comment } = config;
+    let blob = Buffer.concat([writeString(KEY_TYPE), writeString(publicKey)]);
+    return `${KEY_TYPE} ${blob.toString("base64")}${comment && ` ${comment}` || ""}\n`;
+}

package/security/notifications/discord.ts

@@ -0,0 +1,190 @@
+import fs from "fs/promises";
+
+// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js embeds a hand port of this file in plain JS, so the
+// daemon can run with no dependencies. The two are expected to behave identically - if you change
+// one, make the matching change in the other.
+
+export const DEFAULT_WEBHOOK_FILE_PATH = "/etc/portsecure/discord-webhook";
+const DEFAULT_CHECK_INTERVAL = 5 * 60 * 1000;
+const VALID_WEBHOOK_PREFIXES = [
+    "https://discord.com/api/webhooks/",
+    "https://discordapp.com/api/webhooks/",
+    "https://canary.discord.com/api/webhooks/",
+];
+const DISCORD_MESSAGE_LIMIT = 2000;
+const MAX_ERROR_BODY_LENGTH = 500;
+const MAX_SEND_ATTEMPTS = 3;
+const REDACTED_TOKEN_VISIBLE = 8;
+const DEFAULT_RATE_LIMIT_WAIT = 2 * 1000;
+
+let notificationState: {
+    filePath: string;
+    webhookURL: string;
+    checkTimer: NodeJS.Timeout;
+} | undefined;
+
+// Discord webhooks are rate limited (roughly 5 requests per 2 seconds), so every send
+// goes through one chain instead of racing.
+let sendChain: Promise<unknown> = Promise.resolve();
+
+/** Pulls the webhook URL out of webhook file contents. `sourceName` only appears in errors, so
+    callers can name a remote path. */
+export function parseWebhookFile(config: { contents: string; sourceName: string }) {
+    let { contents, sourceName } = config;
+    let lines = contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
+    let webhookURL = lines[0];
+    if (!webhookURL) {
+        throw new Error(`Expected a Discord webhook URL in ${sourceName}, the file has no usable lines`);
+    }
+    if (!VALID_WEBHOOK_PREFIXES.some(prefix => webhookURL.startsWith(prefix))) {
+        throw new Error(
+            `Expected a Discord webhook URL starting with one of ${VALID_WEBHOOK_PREFIXES.join(", ")}, `
+            + `was ${webhookURL.slice(0, MAX_ERROR_BODY_LENGTH)} (in ${sourceName})`
+        );
+    }
+    return webhookURL;
+}
+
+/** Keeps the id and both ends of the token, so a reader can confirm which webhook replaced theirs
+    without receiving one they could post to. */
+export function redactWebhookURL(webhookURL: string) {
+    let separatorIndex = webhookURL.lastIndexOf("/");
+    let base = webhookURL.slice(0, separatorIndex + 1);
+    let token = webhookURL.slice(separatorIndex + 1);
+    if (token.length <= REDACTED_TOKEN_VISIBLE * 2) {
+        // Too short to show both ends without giving away the whole token.
+        return `${base}${token.slice(0, REDACTED_TOKEN_VISIBLE)}...`;
+    }
+    return `${base}${token.slice(0, REDACTED_TOKEN_VISIBLE)}...${token.slice(-REDACTED_TOKEN_VISIBLE)}`;
+}
+
+export function formatWebhookFile(webhookURL: string) {
+    return `# portsecure Discord webhook. First non-comment line is used.\n${webhookURL}\n`;
+}
+
+async function readWebhookFile(filePath: string) {
+    let contents;
+    try {
+        contents = await fs.readFile(filePath, "utf8");
+    } catch (e) {
+        throw new Error(`Expected a readable Discord webhook file at ${filePath}, ${e}`);
+    }
+    return parseWebhookFile({ contents, sourceName: filePath });
+}
+
+async function postToWebhook(webhookURL: string, message: string) {
+    let content = message;
+    if (content.length > DISCORD_MESSAGE_LIMIT) {
+        content = content.slice(0, DISCORD_MESSAGE_LIMIT - 3) + "...";
+    }
+    for (let attempt = 1; attempt <= MAX_SEND_ATTEMPTS; attempt++) {
+        let response = await fetch(webhookURL, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ content }),
+        });
+        if (response.ok) {
+            return;
+        }
+        let body = (await response.text()).slice(0, MAX_ERROR_BODY_LENGTH);
+        if (response.status === 429 && attempt < MAX_SEND_ATTEMPTS) {
+            let retryAfter = Number(response.headers.get("retry-after"));
+            let waitTime = retryAfter && retryAfter * 1000 || DEFAULT_RATE_LIMIT_WAIT;
+            await new Promise(resolve => setTimeout(resolve, waitTime));
+            continue;
+        }
+        throw new Error(
+            `Expected a 2xx response from the Discord webhook, was ${response.status} ${response.statusText}, body ${body}`
+        );
+    }
+}
+
+function queueSend(webhookURL: string, message: string) {
+    let send = () => postToWebhook(webhookURL, message);
+    let result = sendChain.then(send, send);
+    sendChain = result.catch(() => undefined);
+    return result;
+}
+
+/** Sends to an explicit webhook URL, for tooling that acts on a webhook before (or instead of)
+    configureDiscordNotifications - setup, migrations, connectivity checks. */
+export function sendToWebhookURL(config: { webhookURL: string; message: string }) {
+    return queueSend(config.webhookURL, config.message);
+}
+
+async function checkWebhookFileChanged() {
+    let state = notificationState;
+    if (!state) {
+        return;
+    }
+    let newWebhookURL;
+    try {
+        newWebhookURL = await readWebhookFile(state.filePath);
+    } catch (e) {
+        console.error(`portsecure: Discord webhook file is no longer readable, still using the loaded webhook. ${e}`);
+        return;
+    }
+    if (newWebhookURL === state.webhookURL) {
+        return;
+    }
+    // Warn the old channel first, with the new webhook redacted, so a stolen old webhook does not
+    // hand the attacker a usable new one.
+    try {
+        await queueSend(
+            state.webhookURL,
+            `**portsecure**: the Discord webhook in \`${state.filePath}\` changed to`
+            + ` \`${redactWebhookURL(newWebhookURL)}\`.`
+            + ` Notifications are moving to the new webhook and this channel will stop receiving them.`
+        );
+    } catch (e) {
+        console.error(`portsecure: failed to warn the old Discord webhook about the change. ${e}`);
+    }
+    state.webhookURL = newWebhookURL;
+}
+
+/** Must be called once on startup, before any notification is sent. Aborts the process if the
+    webhook file is missing or invalid, then re-checks the file on an interval and warns the old
+    webhook whenever it changes. */
+export async function configureDiscordNotifications(config?: {
+    filePath?: string;
+    checkInterval?: number;
+}) {
+    if (notificationState) {
+        throw new Error(`Expected configureDiscordNotifications to be called once, was called again (already using ${notificationState.filePath})`);
+    }
+    let filePath = config?.filePath || DEFAULT_WEBHOOK_FILE_PATH;
+    let checkInterval = config?.checkInterval || DEFAULT_CHECK_INTERVAL;
+    let webhookURL;
+    try {
+        webhookURL = await readWebhookFile(filePath);
+    } catch (e) {
+        console.error(`portsecure: refusing to start without a valid Discord webhook file.\n${e}`);
+        process.exit(1);
+    }
+    let checkTimer = setInterval(() => {
+        checkWebhookFileChanged().catch(e => console.error(`portsecure: Discord webhook file check failed. ${e}`));
+    }, checkInterval);
+    // The check should never be the reason the process stays alive.
+    checkTimer.unref();
+    notificationState = { filePath, webhookURL, checkTimer };
+    return { filePath, checkInterval };
+}
+
+// DO NOT add new calls to this. Every message goes to a real Discord server someone reads, so a
+// notification is only ever added when the user explicitly asks for that specific case. Startup,
+// success, errors, retries and recoveries all belong in a log instead.
+export async function sendDiscordNotification(message: string) {
+    let state = notificationState;
+    if (!state) {
+        throw new Error(`Expected configureDiscordNotifications to be called before sending, was called with message ${message.slice(0, MAX_ERROR_BODY_LENGTH)}`);
+    }
+    await queueSend(state.webhookURL, message);
+}
+
+export function stopDiscordNotifications() {
+    if (!notificationState) {
+        return;
+    }
+    clearInterval(notificationState.checkTimer);
+    notificationState = undefined;
+}