sliftutils 1.7.125 → 1.7.126

package/security/authorizedKeys/daemon/sshdConfig.ts

@@ -0,0 +1,85 @@
+import fs from "fs/promises";
+import { spawnPromise } from "../../helpers/spawn";
+import { MAX_ERROR_BODY_LENGTH, SSHD_CONFIG_PATH, SSHD_DROPIN_DIR, SSHD_DROPIN_PATH } from "./paths";
+
+// VERBOSE is what makes sshd name the key a refused attempt used, which is the whole basis for
+// revoking it. Without it the log says an attempt was refused but not by whom.
+const SSHD_DROPIN_CONTENTS = `# Managed by portsecure. Manual changes are reverted and reported.
+# Keys come from the portsecure repo, so no other authentication method may be used.
+PasswordAuthentication no
+PermitEmptyPasswords no
+KbdInteractiveAuthentication no
+ChallengeResponseAuthentication no
+PubkeyAuthentication yes
+PermitRootLogin prohibit-password
+LogLevel VERBOSE
+`;
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+async function sshdConfigIncludesDropinDir() {
+    let contents = await fs.readFile(SSHD_CONFIG_PATH, "utf8");
+    return contents.split("\n").some(line => {
+        let trimmed = line.trim();
+        return trimmed.startsWith("Include") && trimmed.includes("sshd_config.d");
+    });
+}
+
+async function restartSSHD() {
+    for (let unit of ["ssh", "sshd"]) {
+        let result = await spawnPromise({ command: "systemctl", args: ["reload-or-restart", unit] });
+        if (result.status === 0) {
+            return unit;
+        }
+    }
+    throw new Error(`Expected to reload ssh or sshd, neither unit could be reloaded`);
+}
+
+/** Turns off every non key based way in. Validates before reloading, because a bad sshd config
+    that gets applied is exactly how a machine becomes unreachable. */
+export async function enforceSSHDConfig() {
+    let existing = "";
+    if (await pathExists(SSHD_DROPIN_PATH)) {
+        existing = await fs.readFile(SSHD_DROPIN_PATH, "utf8");
+    }
+    let includeMissing = !await sshdConfigIncludesDropinDir();
+    if (existing === SSHD_DROPIN_CONTENTS && !includeMissing) {
+        return;
+    }
+
+    let originalConfig = await fs.readFile(SSHD_CONFIG_PATH, "utf8");
+    await fs.mkdir(SSHD_DROPIN_DIR, { recursive: true });
+    await fs.writeFile(SSHD_DROPIN_PATH, SSHD_DROPIN_CONTENTS, { mode: 0o644 });
+    if (includeMissing) {
+        // sshd takes the first value it sees for most keywords, so the include has to come before
+        // any setting it is meant to override.
+        await fs.writeFile(SSHD_CONFIG_PATH, `Include ${SSHD_DROPIN_DIR}/*.conf\n${originalConfig}`);
+    }
+
+    let validation = await spawnPromise({ command: "sshd", args: ["-t"] });
+    if (validation.error) {
+        validation = await spawnPromise({ command: "/usr/sbin/sshd", args: ["-t"] });
+    }
+    if (validation.status !== 0) {
+        // Roll back rather than leave a config that sshd would refuse on its next start.
+        await fs.rm(SSHD_DROPIN_PATH, { force: true });
+        if (includeMissing) {
+            await fs.writeFile(SSHD_CONFIG_PATH, originalConfig);
+        }
+        console.log(
+            `sshd rejected the portsecure config, rolled it back. `
+            + `${(validation.stdout + validation.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
+        );
+        return;
+    }
+
+    let unit = await restartSSHD();
+    console.log(`Password authentication disabled, reloaded ${unit}`);
+}

package/security/authorizedKeys/daemon/state.ts

@@ -0,0 +1,108 @@
+import fs from "fs/promises";
+import path from "path";
+import { STATE_PATH } from "./paths";
+
+/** What we last decided to trust for one source, kept on disk so nobody can tell us a different
+    story about what we saw last time. */
+export type SourceState = {
+    lastSha: string;
+    branch: string;
+    accepted: boolean;
+    acceptedSigner: string;
+    acceptedKeys: string[];
+    acceptedManifestHash: string;
+    acceptedSignatureHash: string;
+    pendingSigner: string;
+    pendingSince: number;
+    reportedProblem: string;
+};
+
+/** A key this machine has stopped accepting. Kept even when the revoke repo no longer lists it:
+    the deploy key that writes revocations lives on every server, so an attacker who took one could
+    otherwise delete the revocation that locked them out. */
+export type RevocationState = {
+    fingerprint: string;
+    revocationId: string;
+    // Set once an unrevoke has been seen, so the wait can be served out across restarts.
+    unrevokeSeenAt: number;
+    unrevokeId: string;
+    unrevoked: boolean;
+    // Whether we have said that this key actually left root's authorized_keys. The removal is the
+    // thing worth reporting, and it is worth reporting exactly once.
+    reportedRemoved: boolean;
+};
+
+/** A refusal we saw but could not write down yet. Held until it is recorded, because the log is
+    read once and moves on: losing one of these to a repo that happened to be unreachable would
+    leave a key that was misused accepted forever. */
+export type PendingRevocation = {
+    fingerprint: string;
+    keyLine: string;
+    sourceURL: string;
+    attempt: { ip: string; user: string; port: string; required: string; line: string };
+};
+
+export type DaemonState = {
+    sources: { [repoURL: string]: SourceState };
+    userKeyHashes: { [userName: string]: string };
+    revocations: { [fingerprint: string]: RevocationState };
+    pendingRevocations: PendingRevocation[];
+    // Where we had read up to in the auth log, so a restart does not re-report old attempts.
+    authLogOffset: number;
+    authLogSignature: string;
+};
+
+let state: DaemonState = {
+    sources: {},
+    userKeyHashes: {},
+    revocations: {},
+    pendingRevocations: [],
+    authLogOffset: 0,
+    authLogSignature: "",
+};
+
+export function getState() {
+    return state;
+}
+
+/** Per source progress, created on first use so a newly added source starts clean. */
+export function sourceState(repoURL: string) {
+    let existing = state.sources[repoURL];
+    if (existing) {
+        return existing;
+    }
+    let created: SourceState = {
+        lastSha: "",
+        branch: "",
+        accepted: false,
+        acceptedSigner: "",
+        acceptedKeys: [],
+        acceptedManifestHash: "",
+        acceptedSignatureHash: "",
+        pendingSigner: "",
+        pendingSince: 0,
+        reportedProblem: "",
+    };
+    state.sources[repoURL] = created;
+    return created;
+}
+
+export async function loadState() {
+    let contents;
+    try {
+        contents = await fs.readFile(STATE_PATH, "utf8");
+    } catch (e) {
+        return;
+    }
+    try {
+        state = Object.assign(state, JSON.parse(contents));
+    } catch (e) {
+        // Corrupt state only costs us one duplicate notification, so it is not worth failing over.
+        console.log(`Ignoring unreadable state file ${STATE_PATH}. ${e}`);
+    }
+}
+
+export async function saveState() {
+    await fs.mkdir(path.dirname(STATE_PATH), { recursive: true });
+    await fs.writeFile(STATE_PATH, JSON.stringify(state, undefined, 4), { mode: 0o600 });
+}

package/security/authorizedKeys/daemon/trust.ts

@@ -0,0 +1,291 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import path from "path";
+import { spawnPromise } from "../../helpers/spawn";
+import { normalizeKeys } from "../authorizedKeys";
+import { sourceRepoPath } from "../sources";
+import { MANIFEST_NAME, normalizeContent, SIGN_NAMESPACE, SIGNATURE_NAME } from "../../signedFiles/manifest";
+import { MAX_ERROR_BODY_LENGTH, SIGNER_CHANGE_DELAY } from "./paths";
+import { notify } from "./notify";
+import { saveState, sourceState } from "./state";
+
+// A source that has never been signed reads as this, so losing a signature counts as a change of
+// signer rather than as something to wave through.
+const UNSIGNED = "";
+// What fixes both of the signature problems we report, so the message can say so rather than
+// leaving someone to work it out.
+const SIGN_COMMAND = "yarn signfiles git";
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+function readSSHString(buffer: Buffer, offset: number) {
+    let length = buffer.readUInt32BE(offset);
+    return buffer.subarray(offset + 4, offset + 4 + length);
+}
+
+/** The signature carries the public key that made it, so the key itself can be reported rather
+    than only a fingerprint. Returns it in the usual "type base64" form. */
+export function publicKeyFromSignature(signatureText: string) {
+    let body = signatureText.split("\n").filter(line => line && !line.startsWith("-----")).join("");
+    let blob = Buffer.from(body, "base64");
+    if (blob.subarray(0, 6).toString() !== "SSHSIG") {
+        throw new Error(`Expected an SSHSIG signature, started with ${blob.subarray(0, 6).toString()}`);
+    }
+    // The magic, then a uint32 version, then the public key.
+    let publicKey = readSSHString(blob, 6 + 4);
+    let keyType = readSSHString(publicKey, 0).toString();
+    let fingerprint = "SHA256:" + crypto.createHash("sha256").update(publicKey).digest("base64").replace(/=+$/, "");
+    return { publicKey: `${keyType} ${publicKey.toString("base64")}`, fingerprint };
+}
+
+/** Reads one checkout's keys. Prefers a top level authorized_keys file and otherwise concatenates
+    every .pub at the top level. */
+export async function readCheckoutKeys(repoPath: string) {
+    let combinedPath = path.join(repoPath, "authorized_keys");
+    if (await pathExists(combinedPath)) {
+        return normalizeKeys(await fs.readFile(combinedPath, "utf8"));
+    }
+    let pubFiles = (await fs.readdir(repoPath)).filter(name => name.endsWith(".pub")).sort();
+    if (!pubFiles.length) {
+        throw new Error(`Expected authorized_keys or at least one .pub file in ${repoPath}, found neither`);
+    }
+    let keys: string[] = [];
+    for (let name of pubFiles) {
+        keys.push(...normalizeKeys(await fs.readFile(path.join(repoPath, name), "utf8")));
+    }
+    return keys;
+}
+
+/** Every file in a checkout, other than git's own directory and the signature files, which cannot
+    describe themselves. */
+async function listCheckoutFiles(repoPath: string, prefix?: string): Promise<string[]> {
+    let files: string[] = [];
+    for (let entry of await fs.readdir(path.join(repoPath, prefix || ""), { withFileTypes: true })) {
+        let relativePath = prefix && `${prefix}/${entry.name}` || entry.name;
+        if (entry.name === ".git") {
+            continue;
+        }
+        if (!prefix && (entry.name === MANIFEST_NAME || entry.name === SIGNATURE_NAME)) {
+            continue;
+        }
+        if (entry.isDirectory()) {
+            files.push(...await listCheckoutFiles(repoPath, relativePath));
+            continue;
+        }
+        files.push(relativePath);
+    }
+    return files.sort();
+}
+
+/** The signature only covers the manifest, so the manifest has to be checked against what is
+    actually on disk. Both directions matter: a missing file changes what the keys mean, and an
+    extra unlisted file could add keys nobody signed for. */
+async function verifyManifestMatchesFiles(repoPath: string) {
+    let manifest = JSON.parse(await fs.readFile(path.join(repoPath, MANIFEST_NAME), "utf8"));
+    let listed = new Map<string, { path: string; size: number; sha256: string }>(
+        (manifest.files || []).map((file: { path: string }) => [file.path, file])
+    );
+    let actual = await listCheckoutFiles(repoPath);
+
+    let missing = [...listed.keys()].filter(filePath => !actual.includes(filePath));
+    if (missing.length) {
+        throw new Error(`Expected the signed files to be present, ${missing.length} missing, first ${missing[0]}`);
+    }
+    let extra = actual.filter(filePath => !listed.has(filePath));
+    if (extra.length) {
+        throw new Error(`Expected only signed files to be present, ${extra.length} extra, first ${extra[0]}`);
+    }
+    for (let filePath of actual) {
+        let expected = listed.get(filePath);
+        if (!expected) {
+            continue;
+        }
+        let contents = normalizeContent(await fs.readFile(path.join(repoPath, filePath)));
+        if (contents.length !== expected.size) {
+            throw new Error(`Expected ${filePath} to be ${expected.size} bytes, was ${contents.length}`);
+        }
+        let hash = crypto.createHash("sha256").update(contents).digest("hex");
+        if (hash !== expected.sha256) {
+            throw new Error(`Expected ${filePath} to hash to ${expected.sha256}, was ${hash}`);
+        }
+    }
+}
+
+/** The manifest and signature as they stand, whether or not they are any good. The hashes are
+    what tell a signature that was never updated apart from one that is broken. */
+async function readSignatureFiles(repoPath: string) {
+    let manifestPath = path.join(repoPath, MANIFEST_NAME);
+    let signaturePath = path.join(repoPath, SIGNATURE_NAME);
+    let manifest = await pathExists(manifestPath) && await fs.readFile(manifestPath) || undefined;
+    let signature = await pathExists(signaturePath) && await fs.readFile(signaturePath) || undefined;
+    return {
+        manifest,
+        signature,
+        manifestHash: manifest && crypto.createHash("sha256").update(manifest).digest("hex") || "",
+        signatureHash: signature && crypto.createHash("sha256").update(signature).digest("hex") || "",
+    };
+}
+
+/** Who signed this checkout. Returns UNSIGNED when there is no signature at all, and throws when
+    there is one that does not hold up - an unverifiable signature is never treated as an identity,
+    so it can never become something we accept. */
+async function verifyCheckoutSigner(config: {
+    repoPath: string;
+    files: { manifest?: Buffer; signature?: Buffer };
+}) {
+    let { repoPath, files } = config;
+    if (!files.manifest && !files.signature) {
+        return UNSIGNED;
+    }
+    if (!files.manifest || !files.signature) {
+        throw new Error(`Expected both ${MANIFEST_NAME} and ${SIGNATURE_NAME}, only one is present`);
+    }
+    let result = await spawnPromise({
+        command: "ssh-keygen",
+        args: ["-Y", "check-novalidate", "-n", SIGN_NAMESPACE, "-s", path.join(repoPath, SIGNATURE_NAME)],
+        // The signature covers the normalised bytes, so a checkout that arrived with CRLF still
+        // verifies rather than looking like tampering.
+        input: normalizeContent(files.manifest).toString("utf8"),
+    });
+    if (result.status !== 0) {
+        throw new Error(
+            `the signature over ${MANIFEST_NAME} does not verify: `
+            + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
+        );
+    }
+    let reported = `${result.stdout} ${result.stderr}`.match(/(SHA256:[A-Za-z0-9+/=]+)/);
+    if (!reported) {
+        throw new Error(`ssh-keygen reported no signer fingerprint, said ${result.stdout.slice(0, MAX_ERROR_BODY_LENGTH)}`);
+    }
+    let { publicKey, fingerprint } = publicKeyFromSignature(files.signature.toString("utf8"));
+    // The key we read out of the signature has to be the one ssh-keygen just checked against,
+    // otherwise we would be reporting an identity that did not sign anything.
+    if (fingerprint !== reported[1]) {
+        throw new Error(`the signing key reads as ${fingerprint} but ssh-keygen verified ${reported[1]}`);
+    }
+    await verifyManifestMatchesFiles(repoPath);
+    return publicKey;
+}
+
+export function describeSigner(signer: string) {
+    return signer === UNSIGNED && "<no public key>" || signer;
+}
+
+/** Reports a problem with a source's signature, but only when it is not the same problem we
+    already reported, so a fault that persists does not repeat every check. */
+async function reportProblem(config: { repoURL: string; problem: string; message: string }) {
+    let { repoURL, problem, message } = config;
+    let sourceStateValue = sourceState(repoURL);
+    if (sourceStateValue.reportedProblem === problem) {
+        return;
+    }
+    sourceStateValue.reportedProblem = problem;
+    await saveState();
+    await notify(message);
+}
+
+/** The keys a source is allowed to contribute right now. A source signed by someone we have not
+    accepted keeps contributing the keys we last accepted, until the delay has passed. */
+export async function resolveSourceKeys(repoURL: string) {
+    let sourceStateValue = sourceState(repoURL);
+    let repoPath = sourceRepoPath(repoURL);
+    let files = await readSignatureFiles(repoPath);
+
+    let signer: string;
+    try {
+        signer = await verifyCheckoutSigner({ repoPath, files });
+    } catch (e) {
+        // Nothing here is trustworthy, so nothing here is used. Which of the two problems it is
+        // depends on whether the signature is simply the one we already accepted.
+        let unchanged = files.manifestHash === sourceStateValue.acceptedManifestHash
+            && files.signatureHash === sourceStateValue.acceptedSignatureHash;
+        if (unchanged) {
+            await reportProblem({
+                repoURL,
+                problem: "stale",
+                message: `\`${repoURL}\` changed but its signature was not updated, so the changes are being`
+                    + ` ignored. Still using the keys signed by \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
+                    + `\nTo deploy the change, run this in that repo:\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
+            });
+        } else {
+            await reportProblem({
+                repoURL,
+                problem: "corrupt",
+                message: `\`${repoURL}\` has a corrupted signature, so its contents are being ignored:`
+                    + ` ${e}.\nStill using the keys signed by \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
+                    + `\nTo replace it, run this in that repo:\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
+            });
+        }
+        return sourceStateValue.acceptedKeys;
+    }
+    if (sourceStateValue.reportedProblem) {
+        sourceStateValue.reportedProblem = "";
+        await saveState();
+    }
+    let checkoutKeys = await readCheckoutKeys(repoPath);
+
+    let accept = async () => {
+        sourceStateValue.accepted = true;
+        sourceStateValue.acceptedSigner = signer;
+        sourceStateValue.acceptedKeys = checkoutKeys;
+        sourceStateValue.acceptedManifestHash = files.manifestHash;
+        sourceStateValue.acceptedSignatureHash = files.signatureHash;
+        sourceStateValue.pendingSigner = UNSIGNED;
+        sourceStateValue.pendingSince = 0;
+        await saveState();
+        return checkoutKeys;
+    };
+
+    // Nothing has ever been accepted from this source, so this is what we start trusting.
+    if (!sourceStateValue.accepted) {
+        console.log(`Trusting ${repoURL} as signed by ${describeSigner(signer)}`);
+        return await accept();
+    }
+
+    if (signer === sourceStateValue.acceptedSigner) {
+        // Back to the signer we already trust, so anything we were waiting on is moot.
+        if (sourceStateValue.pendingSince) {
+            console.log(`${repoURL} is signed by its accepted key again, dropping the pending change`);
+        }
+        return await accept();
+    }
+
+    // Going from nothing to something signed is only ever an improvement, so it does not wait.
+    if (sourceStateValue.acceptedSigner === UNSIGNED) {
+        await notify(
+            `\`${repoURL}\` is now signed, by \`${signer}\`. It was not signed before, so its keys are`
+            + ` being applied right away.`
+        );
+        return await accept();
+    }
+
+    // A signer we have not accepted. Anything new restarts the wait, so publishing twice in a row
+    // gains an attacker nothing. pendingSince is what marks a wait as running, because an unsigned
+    // checkout is itself a signer value and cannot double as "nothing pending".
+    if (!sourceStateValue.pendingSince || signer !== sourceStateValue.pendingSigner) {
+        sourceStateValue.pendingSigner = signer;
+        sourceStateValue.pendingSince = Date.now();
+        await saveState();
+        await notify(
+            `\`${repoURL}\` is now signed by \`${describeSigner(signer)}\`, where it was signed by`
+            + ` \`${describeSigner(sourceStateValue.acceptedSigner)}\`. Its keys are NOT being applied.`
+            + ` If nothing changes they will be applied in 24 hours.`
+        );
+        return sourceStateValue.acceptedKeys;
+    }
+
+    if (Date.now() - sourceStateValue.pendingSince < SIGNER_CHANGE_DELAY) {
+        return sourceStateValue.acceptedKeys;
+    }
+
+    // Same new signer, 24 hours later, and nobody stopped it.
+    console.log(`Accepting ${describeSigner(signer)} for ${repoURL} after the ${SIGNER_CHANGE_DELAY}ms wait`);
+    return await accept();
+}

package/security/authorizedKeys/daemon/userKeys.ts

@@ -0,0 +1,76 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import path from "path";
+import { summarizeKey } from "../authorizedKeys";
+import { PASSWD_PATH, ROOT_AUTHORIZED_KEYS } from "./paths";
+import { notify } from "./notify";
+import { getState, saveState } from "./state";
+import { readAuthorizedKeysFile } from "./rootKeys";
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+export async function listUserAuthorizedKeyFiles() {
+    let entries: { name: string; filePath: string }[] = [];
+    let passwd = await fs.readFile(PASSWD_PATH, "utf8");
+    for (let line of passwd.split("\n")) {
+        let fields = line.split(":");
+        if (fields.length < 7) {
+            continue;
+        }
+        let [name, , , , , home] = fields;
+        if (!home || !await pathExists(home)) {
+            continue;
+        }
+        let filePath = path.join(home, ".ssh", "authorized_keys");
+        if (filePath === ROOT_AUTHORIZED_KEYS) {
+            continue;
+        }
+        entries.push({ name, filePath });
+    }
+    return entries;
+}
+
+function hashKeys(keys: string[]) {
+    return crypto.createHash("sha256").update(keys.join("\n")).digest("hex");
+}
+
+/** Seeds the per user hashes without reporting every existing file as a change. */
+export async function seedUserKeys() {
+    let state = getState();
+    if (Object.keys(state.userKeyHashes).length) {
+        return;
+    }
+    for (let entry of await listUserAuthorizedKeyFiles()) {
+        state.userKeyHashes[entry.name] = hashKeys(await readAuthorizedKeysFile(entry.filePath));
+    }
+    await saveState();
+}
+
+/** Root is enforced elsewhere, every other account is watched and reported on. */
+export async function checkOtherUserKeys() {
+    let state = getState();
+    let hashes: { [name: string]: string } = {};
+    for (let entry of await listUserAuthorizedKeyFiles()) {
+        let keys = await readAuthorizedKeysFile(entry.filePath);
+        let hash = hashKeys(keys);
+        hashes[entry.name] = hash;
+        let previousHash = state.userKeyHashes[entry.name];
+        if (previousHash === undefined || previousHash === hash) {
+            continue;
+        }
+        await notify(
+            `authorized_keys for user \`${entry.name}\` changed (\`${entry.filePath}\`).`
+            + ` portsecure does not manage this account, so the change was left in place.`
+            + `\n\`\`\`\n${keys.map(summarizeKey).join("\n") || "(now empty)"}\n\`\`\``
+        );
+    }
+    state.userKeyHashes = hashes;
+    await saveState();
+}

package/security/authorizedKeys/dist/authorizedKeys.ts.cache

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.readRepoKeys = exports.summarizeKey = exports.keyRestriction = exports.keyFingerprint = exports.normalizeKeys = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of normalizeKeys,
+// summarizeKey and readRepoKeys, so it can resolve the same keys with no dependencies. The two
+// must agree on which keys a repo produces - if you change one, make the matching change in the
+// other.
+function normalizeKeys(contents) {
+    return contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
+}
+exports.normalizeKeys = normalizeKeys;
+/** The fingerprint ssh itself reports for a key, which is what the sshd log names and therefore
+    what a revocation is keyed by. Returns "" for a line that holds no key. */
+function keyFingerprint(keyLine) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    let blob = typeIndex >= 0 && parts[typeIndex + 1] || "";
+    if (!blob) {
+        return "";
+    }
+    return "SHA256:" + crypto_1.default.createHash("sha256").update(Buffer.from(blob, "base64")).digest("base64").replace(/=+$/, "");
+}
+exports.keyFingerprint = keyFingerprint;
+/** The addresses a key may be used from, which is the part of an authorized_keys line that
+    decides how much a stolen key is worth. A key with no restriction says so loudly. */
+function keyRestriction(keyLine) {
+    let match = keyLine.match(/from="([^"]*)"/);
+    if (!match) {
+        return "ANY ADDRESS (no from= restriction)";
+    }
+    return match[1];
+}
+exports.keyRestriction = keyRestriction;
+/** Enough to recognise whose key this is without printing the whole blob. */
+function summarizeKey(keyLine) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    if (typeIndex < 0) {
+        return keyLine.slice(0, 60);
+    }
+    let type = parts[typeIndex];
+    let blob = parts[typeIndex + 1] || "";
+    let comment = parts.slice(typeIndex + 2).join(" ");
+    return `${type} ...${blob.slice(-12)}${comment && ` ${comment}` || ""}`;
+}
+exports.summarizeKey = summarizeKey;
+/** Reads the authorized keys a repo checkout wants applied. Prefers a top level authorized_keys
+    file and otherwise concatenates every .pub at the top level. */
+async function readRepoKeys(repoPath) {
+    let combinedPath = path_1.default.join(repoPath, "authorized_keys");
+    let entries = await promises_1.default.readdir(repoPath);
+    if (entries.includes("authorized_keys")) {
+        return normalizeKeys(await promises_1.default.readFile(combinedPath, "utf8"));
+    }
+    let pubFiles = entries.filter(name => name.endsWith(".pub")).sort();
+    if (!pubFiles.length) {
+        throw new Error(`Expected authorized_keys or at least one .pub file in ${repoPath}, found neither`);
+    }
+    let keys = [];
+    for (let name of pubFiles) {
+        keys.push(...normalizeKeys(await promises_1.default.readFile(path_1.default.join(repoPath, name), "utf8")));
+    }
+    return keys;
+}
+exports.readRepoKeys = readRepoKeys;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplZEtleXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhdXRob3JpemVkS2V5cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxvREFBNEI7QUFDNUIsMkRBQTZCO0FBQzdCLGdEQUF3QjtBQUV4Qiw2R0FBNkc7QUFDN0csK0ZBQStGO0FBQy9GLGdHQUFnRztBQUNoRyxTQUFTO0FBRVQsU0FBZ0IsYUFBYSxDQUFDLFFBQWdCO0lBQzFDLE9BQU8sUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDdkcsQ0FBQztBQUZELHNDQUVDO0FBRUQ7OEVBQzhFO0FBQzlFLFNBQWdCLGNBQWMsQ0FBQyxPQUFlO0lBQzFDLElBQUksS0FBSyxHQUFHLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEMsSUFBSSxTQUFTLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLElBQUksSUFBSSxHQUFHLFNBQVMsSUFBSSxDQUFDLElBQUksS0FBSyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDeEQsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1IsT0FBTyxFQUFFLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxTQUFTLEdBQUcsZ0JBQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDM0gsQ0FBQztBQVJELHdDQVFDO0FBRUQ7d0ZBQ3dGO0FBQ3hGLFNBQWdCLGNBQWMsQ0FBQyxPQUFlO0lBQzFDLElBQUksS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUM1QyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDVCxPQUFPLG9DQUFvQyxDQUFDO0lBQ2hELENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNwQixDQUFDO0FBTkQsd0NBTUM7QUFFRCw2RUFBNkU7QUFDN0UsU0FBZ0IsWUFBWSxDQUFDLE9BQWU7SUFDeEMsSUFBSSxLQUFLLEdBQUcsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN4QyxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDekUsSUFBSSxTQUFTLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEIsT0FBTyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNoQyxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzVCLElBQUksSUFBSSxHQUFHLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3RDLElBQUksT0FBTyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNuRCxPQUFPLEdBQUcsSUFBSSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsR0FBRyxPQUFPLElBQUksSUFBSSxPQUFPLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztBQUM1RSxDQUFDO0FBVkQsb0NBVUM7QUFFRDttRUFDbUU7QUFDNUQsS0FBSyxVQUFVLFlBQVksQ0FBQyxRQUFnQjtJQUMvQyxJQUFJLFlBQVksR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQzFELElBQUksT0FBTyxHQUFHLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekMsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztRQUN0QyxPQUFPLGFBQWEsQ0FBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLFFBQVEsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3BFLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkIsTUFBTSxJQUFJLEtBQUssQ0FBQyx5REFBeUQsUUFBUSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3hHLENBQUM7SUFDRCxJQUFJLElBQUksR0FBYSxFQUFFLENBQUM7SUFDeEIsS0FBSyxJQUFJLElBQUksSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUN4QixJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsYUFBYSxDQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNoQixDQUFDO0FBZkQsb0NBZUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgY3J5cHRvIGZyb20gXCJjcnlwdG9cIjtcbmltcG9ydCBmcyBmcm9tIFwiZnMvcHJvbWlzZXNcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5cbi8vIFBPUlRFRCBDT0RFOiBzZWN1cml0eS9hdXRob3JpemVkS2V5cy9kYWVtb24vcG9ydHNlY3VyZURhZW1vbi5qcyBjb250YWlucyBhIHBsYWluIEpTIHBvcnQgb2Ygbm9ybWFsaXplS2V5cyxcbi8vIHN1bW1hcml6ZUtleSBhbmQgcmVhZFJlcG9LZXlzLCBzbyBpdCBjYW4gcmVzb2x2ZSB0aGUgc2FtZSBrZXlzIHdpdGggbm8gZGVwZW5kZW5jaWVzLiBUaGUgdHdvXG4vLyBtdXN0IGFncmVlIG9uIHdoaWNoIGtleXMgYSByZXBvIHByb2R1Y2VzIC0gaWYgeW91IGNoYW5nZSBvbmUsIG1ha2UgdGhlIG1hdGNoaW5nIGNoYW5nZSBpbiB0aGVcbi8vIG90aGVyLlxuXG5leHBvcnQgZnVuY3Rpb24gbm9ybWFsaXplS2V5cyhjb250ZW50czogc3RyaW5nKSB7XG4gICAgcmV0dXJuIGNvbnRlbnRzLnNwbGl0KFwiXFxuXCIpLm1hcChsaW5lID0+IGxpbmUudHJpbSgpKS5maWx0ZXIobGluZSA9PiBsaW5lICYmICFsaW5lLnN0YXJ0c1dpdGgoXCIjXCIpKTtcbn1cblxuLyoqIFRoZSBmaW5nZXJwcmludCBzc2ggaXRzZWxmIHJlcG9ydHMgZm9yIGEga2V5LCB3aGljaCBpcyB3aGF0IHRoZSBzc2hkIGxvZyBuYW1lcyBhbmQgdGhlcmVmb3JlXG4gICAgd2hhdCBhIHJldm9jYXRpb24gaXMga2V5ZWQgYnkuIFJldHVybnMgXCJcIiBmb3IgYSBsaW5lIHRoYXQgaG9sZHMgbm8ga2V5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGtleUZpbmdlcnByaW50KGtleUxpbmU6IHN0cmluZykge1xuICAgIGxldCBwYXJ0cyA9IGtleUxpbmUudHJpbSgpLnNwbGl0KC9cXHMrLyk7XG4gICAgbGV0IHR5cGVJbmRleCA9IHBhcnRzLmZpbmRJbmRleChwYXJ0ID0+IC9eKHNzaC18ZWNkc2EtfHNrLSkvLnRlc3QocGFydCkpO1xuICAgIGxldCBibG9iID0gdHlwZUluZGV4ID49IDAgJiYgcGFydHNbdHlwZUluZGV4ICsgMV0gfHwgXCJcIjtcbiAgICBpZiAoIWJsb2IpIHtcbiAgICAgICAgcmV0dXJuIFwiXCI7XG4gICAgfVxuICAgIHJldHVybiBcIlNIQTI1NjpcIiArIGNyeXB0by5jcmVhdGVIYXNoKFwic2hhMjU2XCIpLnVwZGF0ZShCdWZmZXIuZnJvbShibG9iLCBcImJhc2U2NFwiKSkuZGlnZXN0KFwiYmFzZTY0XCIpLnJlcGxhY2UoLz0rJC8sIFwiXCIpO1xufVxuXG4vKiogVGhlIGFkZHJlc3NlcyBhIGtleSBtYXkgYmUgdXNlZCBmcm9tLCB3aGljaCBpcyB0aGUgcGFydCBvZiBhbiBhdXRob3JpemVkX2tleXMgbGluZSB0aGF0XG4gICAgZGVjaWRlcyBob3cgbXVjaCBhIHN0b2xlbiBrZXkgaXMgd29ydGguIEEga2V5IHdpdGggbm8gcmVzdHJpY3Rpb24gc2F5cyBzbyBsb3VkbHkuICovXG5leHBvcnQgZnVuY3Rpb24ga2V5UmVzdHJpY3Rpb24oa2V5TGluZTogc3RyaW5nKSB7XG4gICAgbGV0IG1hdGNoID0ga2V5TGluZS5tYXRjaCgvZnJvbT1cIihbXlwiXSopXCIvKTtcbiAgICBpZiAoIW1hdGNoKSB7XG4gICAgICAgIHJldHVybiBcIkFOWSBBRERSRVNTIChubyBmcm9tPSByZXN0cmljdGlvbilcIjtcbiAgICB9XG4gICAgcmV0dXJuIG1hdGNoWzFdO1xufVxuXG4vKiogRW5vdWdoIHRvIHJlY29nbmlzZSB3aG9zZSBrZXkgdGhpcyBpcyB3aXRob3V0IHByaW50aW5nIHRoZSB3aG9sZSBibG9iLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHN1bW1hcml6ZUtleShrZXlMaW5lOiBzdHJpbmcpIHtcbiAgICBsZXQgcGFydHMgPSBrZXlMaW5lLnRyaW0oKS5zcGxpdCgvXFxzKy8pO1xuICAgIGxldCB0eXBlSW5kZXggPSBwYXJ0cy5maW5kSW5kZXgocGFydCA9PiAvXihzc2gtfGVjZHNhLXxzay0pLy50ZXN0KHBhcnQpKTtcbiAgICBpZiAodHlwZUluZGV4IDwgMCkge1xuICAgICAgICByZXR1cm4ga2V5TGluZS5zbGljZSgwLCA2MCk7XG4gICAgfVxuICAgIGxldCB0eXBlID0gcGFydHNbdHlwZUluZGV4XTtcbiAgICBsZXQgYmxvYiA9IHBhcnRzW3R5cGVJbmRleCArIDFdIHx8IFwiXCI7XG4gICAgbGV0IGNvbW1lbnQgPSBwYXJ0cy5zbGljZSh0eXBlSW5kZXggKyAyKS5qb2luKFwiIFwiKTtcbiAgICByZXR1cm4gYCR7dHlwZX0gLi4uJHtibG9iLnNsaWNlKC0xMil9JHtjb21tZW50ICYmIGAgJHtjb21tZW50fWAgfHwgXCJcIn1gO1xufVxuXG4vKiogUmVhZHMgdGhlIGF1dGhvcml6ZWQga2V5cyBhIHJlcG8gY2hlY2tvdXQgd2FudHMgYXBwbGllZC4gUHJlZmVycyBhIHRvcCBsZXZlbCBhdXRob3JpemVkX2tleXNcbiAgICBmaWxlIGFuZCBvdGhlcndpc2UgY29uY2F0ZW5hdGVzIGV2ZXJ5IC5wdWIgYXQgdGhlIHRvcCBsZXZlbC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVwb0tleXMocmVwb1BhdGg6IHN0cmluZykge1xuICAgIGxldCBjb21iaW5lZFBhdGggPSBwYXRoLmpvaW4ocmVwb1BhdGgsIFwiYXV0aG9yaXplZF9rZXlzXCIpO1xuICAgIGxldCBlbnRyaWVzID0gYXdhaXQgZnMucmVhZGRpcihyZXBvUGF0aCk7XG4gICAgaWYgKGVudHJpZXMuaW5jbHVkZXMoXCJhdXRob3JpemVkX2tleXNcIikpIHtcbiAgICAgICAgcmV0dXJuIG5vcm1hbGl6ZUtleXMoYXdhaXQgZnMucmVhZEZpbGUoY29tYmluZWRQYXRoLCBcInV0ZjhcIikpO1xuICAgIH1cbiAgICBsZXQgcHViRmlsZXMgPSBlbnRyaWVzLmZpbHRlcihuYW1lID0+IG5hbWUuZW5kc1dpdGgoXCIucHViXCIpKS5zb3J0KCk7XG4gICAgaWYgKCFwdWJGaWxlcy5sZW5ndGgpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhdXRob3JpemVkX2tleXMgb3IgYXQgbGVhc3Qgb25lIC5wdWIgZmlsZSBpbiAke3JlcG9QYXRofSwgZm91bmQgbmVpdGhlcmApO1xuICAgIH1cbiAgICBsZXQga2V5czogc3RyaW5nW10gPSBbXTtcbiAgICBmb3IgKGxldCBuYW1lIG9mIHB1YkZpbGVzKSB7XG4gICAgICAgIGtleXMucHVzaCguLi5ub3JtYWxpemVLZXlzKGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihyZXBvUGF0aCwgbmFtZSksIFwidXRmOFwiKSkpO1xuICAgIH1cbiAgICByZXR1cm4ga2V5cztcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "acd843c08a7ede6419089a90a105d6fbe56220931b66deb6b231678bdebe43cf"; */