sliftutils 1.7.125 → 1.7.126

package/security/authorizedKeys/dist/revokeSource.ts.cache

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.deriveRevokeKey = exports.revokeRepoPath = exports.revokeKeyPath = exports.revokeRepoURL = exports.REVOKE_KEY_LABEL = void 0;
+const deriveKey_1 = require("../keys/deriveKey");
+const sshKeyFile_1 = require("../keys/sshKeyFile");
+const sources_1 = require("./sources");
+// A source's revocations live in a repo beside it. Derived rather than configured, so adding a
+// source brings its revoke repo with it and there is nothing extra to pass on the command line.
+const REVOKED_SUFFIX = "_revoked";
+// GitHub will not take the same public key as a deploy key on two repos, so the revoke repo is
+// reached with a key derived from the source's, under this label.
+exports.REVOKE_KEY_LABEL = "revokegithubkey";
+function revokeRepoURL(sourceURL) {
+    let withoutGit = sourceURL.replace(/\.git$/, "");
+    return `${withoutGit}${REVOKED_SUFFIX}.git`;
+}
+exports.revokeRepoURL = revokeRepoURL;
+function revokeKeyPath(sourceURL) {
+    return `${sources_1.REPO_KEYS_DIR}/${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`;
+}
+exports.revokeKeyPath = revokeKeyPath;
+function revokeRepoPath(sourceURL) {
+    return `${sources_1.REPOS_DIR}/${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`;
+}
+exports.revokeRepoPath = revokeRepoPath;
+/** The revoke repo's key, worked out from the source repo's key. Anything holding the source key
+    can produce it, so it never has to be stored anywhere separately or handed around. */
+function deriveRevokeKey(sourcePrivateKey) {
+    let source = (0, sshKeyFile_1.parseOpenSSHPrivateKey)(sourcePrivateKey);
+    let derived = (0, deriveKey_1.deriveEd25519Key)({ seed: source.seed, label: exports.REVOKE_KEY_LABEL });
+    return {
+        publicKey: `ssh-ed25519 ${Buffer.concat([
+            Buffer.from([0, 0, 0, 11]), Buffer.from("ssh-ed25519"),
+            Buffer.from([0, 0, 0, 32]), derived.publicKey,
+        ]).toString("base64")}`,
+        privateKeyFile: (0, sshKeyFile_1.formatOpenSSHPrivateKey)({
+            seed: derived.seed,
+            comment: `${source.comment || "portsecure"} ${exports.REVOKE_KEY_LABEL}`,
+        }),
+    };
+}
+exports.deriveRevokeKey = deriveRevokeKey;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlU291cmNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmV2b2tlU291cmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLGlEQUFxRDtBQUNyRCxtREFBcUY7QUFDckYsdUNBQWlFO0FBRWpFLCtGQUErRjtBQUMvRixnR0FBZ0c7QUFDaEcsTUFBTSxjQUFjLEdBQUcsVUFBVSxDQUFDO0FBQ2xDLCtGQUErRjtBQUMvRixrRUFBa0U7QUFDckQsUUFBQSxnQkFBZ0IsR0FBRyxpQkFBaUIsQ0FBQztBQUVsRCxTQUFnQixhQUFhLENBQUMsU0FBaUI7SUFDM0MsSUFBSSxVQUFVLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDakQsT0FBTyxHQUFHLFVBQVUsR0FBRyxjQUFjLE1BQU0sQ0FBQztBQUNoRCxDQUFDO0FBSEQsc0NBR0M7QUFFRCxTQUFnQixhQUFhLENBQUMsU0FBaUI7SUFDM0MsT0FBTyxHQUFHLHVCQUFhLElBQUksSUFBQSxvQkFBVSxFQUFDLFNBQVMsQ0FBQyxHQUFHLGNBQWMsRUFBRSxDQUFDO0FBQ3hFLENBQUM7QUFGRCxzQ0FFQztBQUVELFNBQWdCLGNBQWMsQ0FBQyxTQUFpQjtJQUM1QyxPQUFPLEdBQUcsbUJBQVMsSUFBSSxJQUFBLG9CQUFVLEVBQUMsU0FBUyxDQUFDLEdBQUcsY0FBYyxFQUFFLENBQUM7QUFDcEUsQ0FBQztBQUZELHdDQUVDO0FBRUQ7eUZBQ3lGO0FBQ3pGLFNBQWdCLGVBQWUsQ0FBQyxnQkFBd0I7SUFDcEQsSUFBSSxNQUFNLEdBQUcsSUFBQSxtQ0FBc0IsRUFBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3RELElBQUksT0FBTyxHQUFHLElBQUEsNEJBQWdCLEVBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsd0JBQWdCLEVBQUUsQ0FBQyxDQUFDO0lBQy9FLE9BQU87UUFDSCxTQUFTLEVBQUUsZUFBZSxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQ3BDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO1lBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1NBQ2hELENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFDdkIsY0FBYyxFQUFFLElBQUEsb0NBQXVCLEVBQUM7WUFDcEMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ2xCLE9BQU8sRUFBRSxHQUFHLE1BQU0sQ0FBQyxPQUFPLElBQUksWUFBWSxJQUFJLHdCQUFnQixFQUFFO1NBQ25FLENBQUM7S0FDTCxDQUFDO0FBQ04sQ0FBQztBQWJELDBDQWFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZGVyaXZlRWQyNTUxOUtleSB9IGZyb20gXCIuLi9rZXlzL2Rlcml2ZUtleVwiO1xuaW1wb3J0IHsgZm9ybWF0T3BlblNTSFByaXZhdGVLZXksIHBhcnNlT3BlblNTSFByaXZhdGVLZXkgfSBmcm9tIFwiLi4va2V5cy9zc2hLZXlGaWxlXCI7XG5pbXBvcnQgeyBSRVBPX0tFWVNfRElSLCBSRVBPU19ESVIsIHNvdXJjZU5hbWUgfSBmcm9tIFwiLi9zb3VyY2VzXCI7XG5cbi8vIEEgc291cmNlJ3MgcmV2b2NhdGlvbnMgbGl2ZSBpbiBhIHJlcG8gYmVzaWRlIGl0LiBEZXJpdmVkIHJhdGhlciB0aGFuIGNvbmZpZ3VyZWQsIHNvIGFkZGluZyBhXG4vLyBzb3VyY2UgYnJpbmdzIGl0cyByZXZva2UgcmVwbyB3aXRoIGl0IGFuZCB0aGVyZSBpcyBub3RoaW5nIGV4dHJhIHRvIHBhc3Mgb24gdGhlIGNvbW1hbmQgbGluZS5cbmNvbnN0IFJFVk9LRURfU1VGRklYID0gXCJfcmV2b2tlZFwiO1xuLy8gR2l0SHViIHdpbGwgbm90IHRha2UgdGhlIHNhbWUgcHVibGljIGtleSBhcyBhIGRlcGxveSBrZXkgb24gdHdvIHJlcG9zLCBzbyB0aGUgcmV2b2tlIHJlcG8gaXNcbi8vIHJlYWNoZWQgd2l0aCBhIGtleSBkZXJpdmVkIGZyb20gdGhlIHNvdXJjZSdzLCB1bmRlciB0aGlzIGxhYmVsLlxuZXhwb3J0IGNvbnN0IFJFVk9LRV9LRVlfTEFCRUwgPSBcInJldm9rZWdpdGh1YmtleVwiO1xuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlUmVwb1VSTChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIGxldCB3aXRob3V0R2l0ID0gc291cmNlVVJMLnJlcGxhY2UoL1xcLmdpdCQvLCBcIlwiKTtcbiAgICByZXR1cm4gYCR7d2l0aG91dEdpdH0ke1JFVk9LRURfU1VGRklYfS5naXRgO1xufVxuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlS2V5UGF0aChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPX0tFWVNfRElSfS8ke3NvdXJjZU5hbWUoc291cmNlVVJMKX0ke1JFVk9LRURfU1VGRklYfWA7XG59XG5cbmV4cG9ydCBmdW5jdGlvbiByZXZva2VSZXBvUGF0aChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPU19ESVJ9LyR7c291cmNlTmFtZShzb3VyY2VVUkwpfSR7UkVWT0tFRF9TVUZGSVh9YDtcbn1cblxuLyoqIFRoZSByZXZva2UgcmVwbydzIGtleSwgd29ya2VkIG91dCBmcm9tIHRoZSBzb3VyY2UgcmVwbydzIGtleS4gQW55dGhpbmcgaG9sZGluZyB0aGUgc291cmNlIGtleVxuICAgIGNhbiBwcm9kdWNlIGl0LCBzbyBpdCBuZXZlciBoYXMgdG8gYmUgc3RvcmVkIGFueXdoZXJlIHNlcGFyYXRlbHkgb3IgaGFuZGVkIGFyb3VuZC4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkZXJpdmVSZXZva2VLZXkoc291cmNlUHJpdmF0ZUtleTogc3RyaW5nKSB7XG4gICAgbGV0IHNvdXJjZSA9IHBhcnNlT3BlblNTSFByaXZhdGVLZXkoc291cmNlUHJpdmF0ZUtleSk7XG4gICAgbGV0IGRlcml2ZWQgPSBkZXJpdmVFZDI1NTE5S2V5KHsgc2VlZDogc291cmNlLnNlZWQsIGxhYmVsOiBSRVZPS0VfS0VZX0xBQkVMIH0pO1xuICAgIHJldHVybiB7XG4gICAgICAgIHB1YmxpY0tleTogYHNzaC1lZDI1NTE5ICR7QnVmZmVyLmNvbmNhdChbXG4gICAgICAgICAgICBCdWZmZXIuZnJvbShbMCwgMCwgMCwgMTFdKSwgQnVmZmVyLmZyb20oXCJzc2gtZWQyNTUxOVwiKSxcbiAgICAgICAgICAgIEJ1ZmZlci5mcm9tKFswLCAwLCAwLCAzMl0pLCBkZXJpdmVkLnB1YmxpY0tleSxcbiAgICAgICAgXSkudG9TdHJpbmcoXCJiYXNlNjRcIil9YCxcbiAgICAgICAgcHJpdmF0ZUtleUZpbGU6IGZvcm1hdE9wZW5TU0hQcml2YXRlS2V5KHtcbiAgICAgICAgICAgIHNlZWQ6IGRlcml2ZWQuc2VlZCxcbiAgICAgICAgICAgIGNvbW1lbnQ6IGAke3NvdXJjZS5jb21tZW50IHx8IFwicG9ydHNlY3VyZVwifSAke1JFVk9LRV9LRVlfTEFCRUx9YCxcbiAgICAgICAgfSksXG4gICAgfTtcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "9f16cd6aea6e1f1a646eda715ac4cac70dc67579ce23c1e473bd371b7985b229"; */