sliftutils 1.7.125 → 1.7.126

package/security/authorizedKeys/dist/sources.ts.cache

@@ -0,0 +1,24 @@
+"use strict";
+// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of everything here, so it can
+// resolve the same locations with no dependencies. Both sides must derive identical paths from a
+// repo url - if you change one, make the matching change in the other.
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.sourceRepoPath = exports.sourceKeyPath = exports.sourceName = exports.REPOS_DIR = exports.REPO_KEYS_DIR = void 0;
+exports.REPO_KEYS_DIR = "/etc/portsecure/repo-keys";
+exports.REPOS_DIR = "/var/lib/portsecure/authorized-keys-repos";
+/** A repo url reduced to something usable as a file name. Derived rather than configured, so the
+    daemon and the deploy script always agree on where a source's key and checkout live. */
+function sourceName(repoURL) {
+    return repoURL.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase();
+}
+exports.sourceName = sourceName;
+function sourceKeyPath(repoURL) {
+    return `${exports.REPO_KEYS_DIR}/${sourceName(repoURL)}`;
+}
+exports.sourceKeyPath = sourceKeyPath;
+function sourceRepoPath(repoURL) {
+    return `${exports.REPOS_DIR}/${sourceName(repoURL)}`;
+}
+exports.sourceRepoPath = sourceRepoPath;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic291cmNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInNvdXJjZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLHlIQUF5SDtBQUN6SCxpR0FBaUc7QUFDakcsdUVBQXVFOzs7QUFFMUQsUUFBQSxhQUFhLEdBQUcsMkJBQTJCLENBQUM7QUFDNUMsUUFBQSxTQUFTLEdBQUcsMkNBQTJDLENBQUM7QUFFckU7MkZBQzJGO0FBQzNGLFNBQWdCLFVBQVUsQ0FBQyxPQUFlO0lBQ3RDLE9BQU8sT0FBTyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDO0FBQ3hGLENBQUM7QUFGRCxnQ0FFQztBQUVELFNBQWdCLGFBQWEsQ0FBQyxPQUFlO0lBQ3pDLE9BQU8sR0FBRyxxQkFBYSxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO0FBQ3JELENBQUM7QUFGRCxzQ0FFQztBQUVELFNBQWdCLGNBQWMsQ0FBQyxPQUFlO0lBQzFDLE9BQU8sR0FBRyxpQkFBUyxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO0FBQ2pELENBQUM7QUFGRCx3Q0FFQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIFBPUlRFRCBDT0RFOiBzZWN1cml0eS9hdXRob3JpemVkS2V5cy9kYWVtb24vcG9ydHNlY3VyZURhZW1vbi5qcyBjb250YWlucyBhIHBsYWluIEpTIHBvcnQgb2YgZXZlcnl0aGluZyBoZXJlLCBzbyBpdCBjYW5cbi8vIHJlc29sdmUgdGhlIHNhbWUgbG9jYXRpb25zIHdpdGggbm8gZGVwZW5kZW5jaWVzLiBCb3RoIHNpZGVzIG11c3QgZGVyaXZlIGlkZW50aWNhbCBwYXRocyBmcm9tIGFcbi8vIHJlcG8gdXJsIC0gaWYgeW91IGNoYW5nZSBvbmUsIG1ha2UgdGhlIG1hdGNoaW5nIGNoYW5nZSBpbiB0aGUgb3RoZXIuXG5cbmV4cG9ydCBjb25zdCBSRVBPX0tFWVNfRElSID0gXCIvZXRjL3BvcnRzZWN1cmUvcmVwby1rZXlzXCI7XG5leHBvcnQgY29uc3QgUkVQT1NfRElSID0gXCIvdmFyL2xpYi9wb3J0c2VjdXJlL2F1dGhvcml6ZWQta2V5cy1yZXBvc1wiO1xuXG4vKiogQSByZXBvIHVybCByZWR1Y2VkIHRvIHNvbWV0aGluZyB1c2FibGUgYXMgYSBmaWxlIG5hbWUuIERlcml2ZWQgcmF0aGVyIHRoYW4gY29uZmlndXJlZCwgc28gdGhlXG4gICAgZGFlbW9uIGFuZCB0aGUgZGVwbG95IHNjcmlwdCBhbHdheXMgYWdyZWUgb24gd2hlcmUgYSBzb3VyY2UncyBrZXkgYW5kIGNoZWNrb3V0IGxpdmUuICovXG5leHBvcnQgZnVuY3Rpb24gc291cmNlTmFtZShyZXBvVVJMOiBzdHJpbmcpIHtcbiAgICByZXR1cm4gcmVwb1VSTC5yZXBsYWNlKC9bXkEtWmEtejAtOV0rL2csIFwiLVwiKS5yZXBsYWNlKC9eLSt8LSskL2csIFwiXCIpLnRvTG93ZXJDYXNlKCk7XG59XG5cbmV4cG9ydCBmdW5jdGlvbiBzb3VyY2VLZXlQYXRoKHJlcG9VUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPX0tFWVNfRElSfS8ke3NvdXJjZU5hbWUocmVwb1VSTCl9YDtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHNvdXJjZVJlcG9QYXRoKHJlcG9VUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPU19ESVJ9LyR7c291cmNlTmFtZShyZXBvVVJMKX1gO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "d4a51163d16ac57a8fa5966ca3b09eaebcbef4ca2200c706a7e125220c7db7b8"; */

package/security/authorizedKeys/dist/unrevoke.ts.cache

@@ -0,0 +1,145 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.main = exports.revokedKeysInRepo = exports.readRemoteRevocations = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const runPromise_1 = require("socket-function/src/runPromise");
+const authorizedKeys_1 = require("./authorizedKeys");
+const revokeSource_1 = require("./revokeSource");
+const authorizedKeys_2 = require("./authorizedKeys");
+const paths_1 = require("../helpers/paths");
+const spawn_1 = require("../helpers/spawn");
+const UNREVOKES_DIR = "unrevoked";
+const REVOCATIONS_DIR = "revocations";
+const USAGE = `Usage: yarn unrevoke [keys-repo]
+
+Run this in a keys repo, or name one. It reads that repo's revoke repo and writes one unrevoke file
+naming every revocation in it, so the keys are accepted again once each machine's hour long wait
+passes.
+
+Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
+for a key you still want.`;
+/** Every revocation the revoke repo lists. Cloned read only into a temp directory, with whatever
+    credentials this machine already has - the derived deploy key is for servers, and a person
+    running this has their own access to the repo. */
+async function readRemoteRevocations(config) {
+    let { sourceURL } = config;
+    let temporaryDirectory = await promises_1.default.mkdtemp(path_1.default.join(os_1.default.tmpdir(), "unrevoke-"));
+    let repoPath = path_1.default.join(temporaryDirectory, "repo");
+    let clone = await (0, spawn_1.spawnPromise)({
+        command: "git",
+        args: ["clone", "--depth", "1", (0, revokeSource_1.revokeRepoURL)(sourceURL), repoPath],
+    });
+    if (clone.status !== 0) {
+        await promises_1.default.rm(temporaryDirectory, { recursive: true, force: true });
+        throw new Error(`Expected to be able to read ${(0, revokeSource_1.revokeRepoURL)(sourceURL)}.\n`
+            + `${(clone.stdout + clone.stderr).trim()}`);
+    }
+    let revocations = [];
+    let directory = path_1.default.join(repoPath, REVOCATIONS_DIR);
+    try {
+        for (let name of (await promises_1.default.readdir(directory)).sort()) {
+            if (name.endsWith(".json")) {
+                revocations.push(JSON.parse(await promises_1.default.readFile(path_1.default.join(directory, name), "utf8")));
+            }
+        }
+    }
+    catch (e) {
+        // No revocations directory at all just means nothing has ever been revoked.
+    }
+    await promises_1.default.rm(temporaryDirectory, { recursive: true, force: true });
+    return revocations;
+}
+exports.readRemoteRevocations = readRemoteRevocations;
+/** Which keys in a repo are revoked. What signfiles and securessh refuse over. */
+async function revokedKeysInRepo(config) {
+    let { repoPath, sourceURL } = config;
+    let revocations = await readRemoteRevocations({ sourceURL });
+    let revokedFingerprints = new Set(revocations.map(revocation => revocation.fingerprint));
+    let unrevoked = new Set();
+    try {
+        let directory = path_1.default.join(repoPath, UNREVOKES_DIR);
+        for (let name of await promises_1.default.readdir(directory)) {
+            if (!name.endsWith(".json")) {
+                continue;
+            }
+            let parsed = JSON.parse(await promises_1.default.readFile(path_1.default.join(directory, name), "utf8"));
+            for (let revocationId of parsed.revocationIds || []) {
+                unrevoked.add(revocationId);
+            }
+        }
+    }
+    catch (e) {
+        // Nothing has been unrevoked.
+    }
+    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId));
+    let keys = (0, authorizedKeys_1.normalizeKeys)(await promises_1.default.readFile(path_1.default.join(repoPath, "authorized_keys"), "utf8").catch(() => ""));
+    return stillRevoked
+        .filter(revocation => keys.some(key => (0, authorizedKeys_1.keyFingerprint)(key) === revocation.fingerprint))
+        .map(revocation => ({ revocation, key: keys.find(key => (0, authorizedKeys_1.keyFingerprint)(key) === revocation.fingerprint) || "" }));
+}
+exports.revokedKeysInRepo = revokedKeysInRepo;
+/** The repo named, or the one we are standing in. Checked the same way securessh checks it: a git
+    repo that actually holds keys and has an origin to clone from. */
+async function resolveKeysRepo(named) {
+    let cwd = named && (0, paths_1.expandHome)(named) || undefined;
+    let repoPath = (await (0, runPromise_1.runPromise)("git rev-parse --show-toplevel", { quiet: true, cwd })).trim();
+    if (!repoPath) {
+        throw new Error(`Expected ${named || "the current directory"} to be inside a git repo, it is not.\n${USAGE}`);
+    }
+    try {
+        await (0, authorizedKeys_2.readRepoKeys)(repoPath);
+    }
+    catch (e) {
+        throw new Error(`Expected ${repoPath} to be a keys repo, it holds no keys.\n${e}\n${USAGE}`);
+    }
+    let originURL = (await (0, runPromise_1.runPromise)("git remote get-url origin", { quiet: true, cwd: repoPath })).trim();
+    if (!originURL) {
+        throw new Error(`Expected ${repoPath} to have an origin remote, it has none.\n${USAGE}`);
+    }
+    return { repoPath, originURL };
+}
+async function main() {
+    var _a;
+    let argv = process.argv.slice(2);
+    if (argv.length > 1) {
+        throw new Error(`Expected at most a keys repo, was ${argv.length} argument(s)\n${USAGE}`);
+    }
+    let { repoPath, originURL } = await resolveKeysRepo(argv[0]);
+    let revocations = await readRemoteRevocations({ sourceURL: originURL });
+    if (!revocations.length) {
+        console.log(`${(0, revokeSource_1.revokeRepoURL)(originURL)} lists no revocations, so there is nothing to undo.`);
+        return;
+    }
+    let directory = path_1.default.join(repoPath, UNREVOKES_DIR);
+    await promises_1.default.mkdir(directory, { recursive: true });
+    let stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    let unrevokeId = `${stamp}-unrevoke`;
+    await promises_1.default.writeFile(path_1.default.join(directory, `${unrevokeId}.json`), JSON.stringify({
+        unrevokeId,
+        createdAt: new Date().toISOString(),
+        // Named one by one rather than as a blanket "allow everything again", so this file only
+        // ever undoes the revocations that existed when it was written.
+        revocationIds: revocations.map(revocation => revocation.revocationId),
+        revocations: revocations.map(revocation => ({
+            revocationId: revocation.revocationId,
+            fingerprint: revocation.fingerprint,
+            revokedAt: revocation.revokedAt,
+            revokedBy: revocation.revokedBy,
+            attempt: revocation.attempt,
+        })),
+    }, undefined, 4) + "\n");
+    console.log(`Wrote ${UNREVOKES_DIR}/${unrevokeId}.json covering ${revocations.length} revocation(s):`);
+    for (let revocation of revocations) {
+        console.log(`  ${revocation.fingerprint} revoked by ${revocation.revokedBy || "?"} from ${((_a = revocation.attempt) === null || _a === void 0 ? void 0 : _a.ip) || "?"}`);
+    }
+    console.log(`Each machine waits an hour after seeing it before the keys work again.`);
+    console.log(`Sign and publish it with:\n  yarn signfiles git`);
+}
+exports.main = main;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidW5yZXZva2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ1bnJldm9rZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSwyREFBNkI7QUFDN0IsNENBQW9CO0FBQ3BCLGdEQUF3QjtBQUN4QiwrREFBNEQ7QUFDNUQscURBQWlFO0FBQ2pFLGlEQUErQztBQUMvQyxxREFBZ0Q7QUFDaEQsNENBQThDO0FBQzlDLDRDQUFnRDtBQUVoRCxNQUFNLGFBQWEsR0FBRyxXQUFXLENBQUM7QUFDbEMsTUFBTSxlQUFlLEdBQUcsYUFBYSxDQUFDO0FBQ3RDLE1BQU0sS0FBSyxHQUFHOzs7Ozs7OzBCQU9ZLENBQUM7QUFXM0I7O3FEQUVxRDtBQUM5QyxLQUFLLFVBQVUscUJBQXFCLENBQUMsTUFBNkI7SUFDckUsSUFBSSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUMzQixJQUFJLGtCQUFrQixHQUFHLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxZQUFFLENBQUMsTUFBTSxFQUFFLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMvRSxJQUFJLFFBQVEsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLGtCQUFrQixFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3JELElBQUksS0FBSyxHQUFHLE1BQU0sSUFBQSxvQkFBWSxFQUFDO1FBQzNCLE9BQU8sRUFBRSxLQUFLO1FBQ2QsSUFBSSxFQUFFLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsSUFBQSw0QkFBYSxFQUFDLFNBQVMsQ0FBQyxFQUFFLFFBQVEsQ0FBQztLQUN0RSxDQUFDLENBQUM7SUFDSCxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDckIsTUFBTSxrQkFBRSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDbEUsTUFBTSxJQUFJLEtBQUssQ0FDWCwrQkFBK0IsSUFBQSw0QkFBYSxFQUFDLFNBQVMsQ0FBQyxLQUFLO2NBQzFELEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUM5QyxDQUFDO0lBQ04sQ0FBQztJQUNELElBQUksV0FBVyxHQUFpQixFQUFFLENBQUM7SUFDbkMsSUFBSSxTQUFTLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDckQsSUFBSSxDQUFDO1FBQ0QsS0FBSyxJQUFJLElBQUksSUFBSSxDQUFDLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQ3BELElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO2dCQUN6QixXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDeEYsQ0FBQztRQUNMLENBQUM7SUFDTCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULDRFQUE0RTtJQUNoRixDQUFDO0lBQ0QsTUFBTSxrQkFBRSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDbEUsT0FBTyxXQUFXLENBQUM7QUFDdkIsQ0FBQztBQTVCRCxzREE0QkM7QUFFRCxrRkFBa0Y7QUFDM0UsS0FBSyxVQUFVLGlCQUFpQixDQUFDLE1BQStDO0lBQ25GLElBQUksRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ3JDLElBQUksV0FBVyxHQUFHLE1BQU0scUJBQXFCLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzdELElBQUksbUJBQW1CLEdBQUcsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQ3pGLElBQUksU0FBUyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDbEMsSUFBSSxDQUFDO1FBQ0QsSUFBSSxTQUFTLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLENBQUM7UUFDbkQsS0FBSyxJQUFJLElBQUksSUFBSSxNQUFNLGtCQUFFLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDM0MsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDMUIsU0FBUztZQUNiLENBQUM7WUFDRCxJQUFJLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztZQUMvRSxLQUFLLElBQUksWUFBWSxJQUFJLE1BQU0sQ0FBQyxhQUFhLElBQUksRUFBRSxFQUFFLENBQUM7Z0JBQ2xELFNBQVMsQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDaEMsQ0FBQztRQUNMLENBQUM7SUFDTCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULDhCQUE4QjtJQUNsQyxDQUFDO0lBQ0QsSUFBSSxZQUFZLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUM3RixJQUFJLElBQUksR0FBRyxJQUFBLDhCQUFhLEVBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzVHLE9BQU8sWUFBWTtTQUNkLE1BQU0sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxJQUFBLCtCQUFjLEVBQUMsR0FBRyxDQUFDLEtBQUssVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1NBQ3RGLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxJQUFBLCtCQUFjLEVBQUMsR0FBRyxDQUFDLEtBQUssVUFBVSxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQztBQUMxSCxDQUFDO0FBeEJELDhDQXdCQztBQUVEO3FFQUNxRTtBQUNyRSxLQUFLLFVBQVUsZUFBZSxDQUFDLEtBQXlCO0lBQ3BELElBQUksR0FBRyxHQUFHLEtBQUssSUFBSSxJQUFBLGtCQUFVLEVBQUMsS0FBSyxDQUFDLElBQUksU0FBUyxDQUFDO0lBQ2xELElBQUksUUFBUSxHQUFHLENBQUMsTUFBTSxJQUFBLHVCQUFVLEVBQUMsK0JBQStCLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNoRyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDWixNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksS0FBSyxJQUFJLHVCQUF1Qix5Q0FBeUMsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUNsSCxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0QsTUFBTSxJQUFBLDZCQUFZLEVBQUMsUUFBUSxDQUFDLENBQUM7SUFDakMsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksUUFBUSwwQ0FBMEMsQ0FBQyxLQUFLLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUNELElBQUksU0FBUyxHQUFHLENBQUMsTUFBTSxJQUFBLHVCQUFVLEVBQUMsMkJBQTJCLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDdkcsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2IsTUFBTSxJQUFJLEtBQUssQ0FBQyxZQUFZLFFBQVEsNENBQTRDLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELE9BQU8sRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLENBQUM7QUFDbkMsQ0FBQztBQUVNLEtBQUssVUFBVSxJQUFJOztJQUN0QixJQUFJLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNqQyxJQUFJLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbEIsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsSUFBSSxDQUFDLE1BQU0saUJBQWlCLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDOUYsQ0FBQztJQUNELElBQUksRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxlQUFlLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFFN0QsSUFBSSxXQUFXLEdBQUcsTUFBTSxxQkFBcUIsQ0FBQyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ3hFLElBQUksQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDdEIsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLElBQUEsNEJBQWEsRUFBQyxTQUFTLENBQUMscURBQXFELENBQUMsQ0FBQztRQUM5RixPQUFPO0lBQ1gsQ0FBQztJQUVELElBQUksU0FBUyxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGFBQWEsQ0FBQyxDQUFDO0lBQ25ELE1BQU0sa0JBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDL0MsSUFBSSxLQUFLLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQzNELElBQUksVUFBVSxHQUFHLEdBQUcsS0FBSyxXQUFXLENBQUM7SUFDckMsTUFBTSxrQkFBRSxDQUFDLFNBQVMsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxHQUFHLFVBQVUsT0FBTyxDQUFDLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUMxRSxVQUFVO1FBQ1YsU0FBUyxFQUFFLElBQUksSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFO1FBQ25DLHdGQUF3RjtRQUN4RixnRUFBZ0U7UUFDaEUsYUFBYSxFQUFFLFdBQVcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1FBQ3JFLFdBQVcsRUFBRSxXQUFXLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUN4QyxZQUFZLEVBQUUsVUFBVSxDQUFDLFlBQVk7WUFDckMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxXQUFXO1lBQ25DLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztZQUMvQixTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7WUFDL0IsT0FBTyxFQUFFLFVBQVUsQ0FBQyxPQUFPO1NBQzlCLENBQUMsQ0FBQztLQUNOLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDO0lBRXpCLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUyxhQUFhLElBQUksVUFBVSxrQkFBa0IsV0FBVyxDQUFDLE1BQU0saUJBQWlCLENBQUMsQ0FBQztJQUN2RyxLQUFLLElBQUksVUFBVSxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ2pDLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxVQUFVLENBQUMsV0FBVyxlQUFlLFVBQVUsQ0FBQyxTQUFTLElBQUksR0FBRyxTQUFTLENBQUEsTUFBQSxVQUFVLENBQUMsT0FBTywwQ0FBRSxFQUFFLEtBQUksR0FBRyxFQUFFLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO0lBQ3RGLE9BQU8sQ0FBQyxHQUFHLENBQUMsaURBQWlELENBQUMsQ0FBQztBQUNuRSxDQUFDO0FBdENELG9CQXNDQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBmcyBmcm9tIFwiZnMvcHJvbWlzZXNcIjtcbmltcG9ydCBvcyBmcm9tIFwib3NcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5pbXBvcnQgeyBydW5Qcm9taXNlIH0gZnJvbSBcInNvY2tldC1mdW5jdGlvbi9zcmMvcnVuUHJvbWlzZVwiO1xuaW1wb3J0IHsga2V5RmluZ2VycHJpbnQsIG5vcm1hbGl6ZUtleXMgfSBmcm9tIFwiLi9hdXRob3JpemVkS2V5c1wiO1xuaW1wb3J0IHsgcmV2b2tlUmVwb1VSTCB9IGZyb20gXCIuL3Jldm9rZVNvdXJjZVwiO1xuaW1wb3J0IHsgcmVhZFJlcG9LZXlzIH0gZnJvbSBcIi4vYXV0aG9yaXplZEtleXNcIjtcbmltcG9ydCB7IGV4cGFuZEhvbWUgfSBmcm9tIFwiLi4vaGVscGVycy9wYXRoc1wiO1xuaW1wb3J0IHsgc3Bhd25Qcm9taXNlIH0gZnJvbSBcIi4uL2hlbHBlcnMvc3Bhd25cIjtcblxuY29uc3QgVU5SRVZPS0VTX0RJUiA9IFwidW5yZXZva2VkXCI7XG5jb25zdCBSRVZPQ0FUSU9OU19ESVIgPSBcInJldm9jYXRpb25zXCI7XG5jb25zdCBVU0FHRSA9IGBVc2FnZTogeWFybiB1bnJldm9rZSBba2V5cy1yZXBvXVxuXG5SdW4gdGhpcyBpbiBhIGtleXMgcmVwbywgb3IgbmFtZSBvbmUuIEl0IHJlYWRzIHRoYXQgcmVwbydzIHJldm9rZSByZXBvIGFuZCB3cml0ZXMgb25lIHVucmV2b2tlIGZpbGVcbm5hbWluZyBldmVyeSByZXZvY2F0aW9uIGluIGl0LCBzbyB0aGUga2V5cyBhcmUgYWNjZXB0ZWQgYWdhaW4gb25jZSBlYWNoIG1hY2hpbmUncyBob3VyIGxvbmcgd2FpdFxucGFzc2VzLlxuXG5LZXlzIHRoYXQgd2VyZSByZXZva2VkIHNob3VsZCBub3JtYWxseSBiZSBkZWxldGVkIGZyb20gdGhlIHJlcG8gaW5zdGVhZC4gVW5yZXZva2luZyBvbmx5IG1hdHRlcnNcbmZvciBhIGtleSB5b3Ugc3RpbGwgd2FudC5gO1xuXG5leHBvcnQgdHlwZSBSZXZvY2F0aW9uID0ge1xuICAgIHJldm9jYXRpb25JZDogc3RyaW5nO1xuICAgIGZpbmdlcnByaW50OiBzdHJpbmc7XG4gICAga2V5Pzogc3RyaW5nO1xuICAgIHJldm9rZWRBdD86IHN0cmluZztcbiAgICByZXZva2VkQnk/OiBzdHJpbmc7XG4gICAgYXR0ZW1wdD86IHsgaXA/OiBzdHJpbmc7IHVzZXI/OiBzdHJpbmc7IHJlcXVpcmVkPzogc3RyaW5nIH07XG59O1xuXG4vKiogRXZlcnkgcmV2b2NhdGlvbiB0aGUgcmV2b2tlIHJlcG8gbGlzdHMuIENsb25lZCByZWFkIG9ubHkgaW50byBhIHRlbXAgZGlyZWN0b3J5LCB3aXRoIHdoYXRldmVyXG4gICAgY3JlZGVudGlhbHMgdGhpcyBtYWNoaW5lIGFscmVhZHkgaGFzIC0gdGhlIGRlcml2ZWQgZGVwbG95IGtleSBpcyBmb3Igc2VydmVycywgYW5kIGEgcGVyc29uXG4gICAgcnVubmluZyB0aGlzIGhhcyB0aGVpciBvd24gYWNjZXNzIHRvIHRoZSByZXBvLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlYWRSZW1vdGVSZXZvY2F0aW9ucyhjb25maWc6IHsgc291cmNlVVJMOiBzdHJpbmcgfSkge1xuICAgIGxldCB7IHNvdXJjZVVSTCB9ID0gY29uZmlnO1xuICAgIGxldCB0ZW1wb3JhcnlEaXJlY3RvcnkgPSBhd2FpdCBmcy5ta2R0ZW1wKHBhdGguam9pbihvcy50bXBkaXIoKSwgXCJ1bnJldm9rZS1cIikpO1xuICAgIGxldCByZXBvUGF0aCA9IHBhdGguam9pbih0ZW1wb3JhcnlEaXJlY3RvcnksIFwicmVwb1wiKTtcbiAgICBsZXQgY2xvbmUgPSBhd2FpdCBzcGF3blByb21pc2Uoe1xuICAgICAgICBjb21tYW5kOiBcImdpdFwiLFxuICAgICAgICBhcmdzOiBbXCJjbG9uZVwiLCBcIi0tZGVwdGhcIiwgXCIxXCIsIHJldm9rZVJlcG9VUkwoc291cmNlVVJMKSwgcmVwb1BhdGhdLFxuICAgIH0pO1xuICAgIGlmIChjbG9uZS5zdGF0dXMgIT09IDApIHtcbiAgICAgICAgYXdhaXQgZnMucm0odGVtcG9yYXJ5RGlyZWN0b3J5LCB7IHJlY3Vyc2l2ZTogdHJ1ZSwgZm9yY2U6IHRydWUgfSk7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgIGBFeHBlY3RlZCB0byBiZSBhYmxlIHRvIHJlYWQgJHtyZXZva2VSZXBvVVJMKHNvdXJjZVVSTCl9LlxcbmBcbiAgICAgICAgICAgICsgYCR7KGNsb25lLnN0ZG91dCArIGNsb25lLnN0ZGVycikudHJpbSgpfWBcbiAgICAgICAgKTtcbiAgICB9XG4gICAgbGV0IHJldm9jYXRpb25zOiBSZXZvY2F0aW9uW10gPSBbXTtcbiAgICBsZXQgZGlyZWN0b3J5ID0gcGF0aC5qb2luKHJlcG9QYXRoLCBSRVZPQ0FUSU9OU19ESVIpO1xuICAgIHRyeSB7XG4gICAgICAgIGZvciAobGV0IG5hbWUgb2YgKGF3YWl0IGZzLnJlYWRkaXIoZGlyZWN0b3J5KSkuc29ydCgpKSB7XG4gICAgICAgICAgICBpZiAobmFtZS5lbmRzV2l0aChcIi5qc29uXCIpKSB7XG4gICAgICAgICAgICAgICAgcmV2b2NhdGlvbnMucHVzaChKU09OLnBhcnNlKGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihkaXJlY3RvcnksIG5hbWUpLCBcInV0ZjhcIikpKTtcbiAgICAgICAgICAgIH1cbiAgICAgICAgfVxuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgLy8gTm8gcmV2b2NhdGlvbnMgZGlyZWN0b3J5IGF0IGFsbCBqdXN0IG1lYW5zIG5vdGhpbmcgaGFzIGV2ZXIgYmVlbiByZXZva2VkLlxuICAgIH1cbiAgICBhd2FpdCBmcy5ybSh0ZW1wb3JhcnlEaXJlY3RvcnksIHsgcmVjdXJzaXZlOiB0cnVlLCBmb3JjZTogdHJ1ZSB9KTtcbiAgICByZXR1cm4gcmV2b2NhdGlvbnM7XG59XG5cbi8qKiBXaGljaCBrZXlzIGluIGEgcmVwbyBhcmUgcmV2b2tlZC4gV2hhdCBzaWduZmlsZXMgYW5kIHNlY3VyZXNzaCByZWZ1c2Ugb3Zlci4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZXZva2VkS2V5c0luUmVwbyhjb25maWc6IHsgcmVwb1BhdGg6IHN0cmluZzsgc291cmNlVVJMOiBzdHJpbmcgfSkge1xuICAgIGxldCB7IHJlcG9QYXRoLCBzb3VyY2VVUkwgfSA9IGNvbmZpZztcbiAgICBsZXQgcmV2b2NhdGlvbnMgPSBhd2FpdCByZWFkUmVtb3RlUmV2b2NhdGlvbnMoeyBzb3VyY2VVUkwgfSk7XG4gICAgbGV0IHJldm9rZWRGaW5nZXJwcmludHMgPSBuZXcgU2V0KHJldm9jYXRpb25zLm1hcChyZXZvY2F0aW9uID0+IHJldm9jYXRpb24uZmluZ2VycHJpbnQpKTtcbiAgICBsZXQgdW5yZXZva2VkID0gbmV3IFNldDxzdHJpbmc+KCk7XG4gICAgdHJ5IHtcbiAgICAgICAgbGV0IGRpcmVjdG9yeSA9IHBhdGguam9pbihyZXBvUGF0aCwgVU5SRVZPS0VTX0RJUik7XG4gICAgICAgIGZvciAobGV0IG5hbWUgb2YgYXdhaXQgZnMucmVhZGRpcihkaXJlY3RvcnkpKSB7XG4gICAgICAgICAgICBpZiAoIW5hbWUuZW5kc1dpdGgoXCIuanNvblwiKSkge1xuICAgICAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICAgICAgfVxuICAgICAgICAgICAgbGV0IHBhcnNlZCA9IEpTT04ucGFyc2UoYXdhaXQgZnMucmVhZEZpbGUocGF0aC5qb2luKGRpcmVjdG9yeSwgbmFtZSksIFwidXRmOFwiKSk7XG4gICAgICAgICAgICBmb3IgKGxldCByZXZvY2F0aW9uSWQgb2YgcGFyc2VkLnJldm9jYXRpb25JZHMgfHwgW10pIHtcbiAgICAgICAgICAgICAgICB1bnJldm9rZWQuYWRkKHJldm9jYXRpb25JZCk7XG4gICAgICAgICAgICB9XG4gICAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIC8vIE5vdGhpbmcgaGFzIGJlZW4gdW5yZXZva2VkLlxuICAgIH1cbiAgICBsZXQgc3RpbGxSZXZva2VkID0gcmV2b2NhdGlvbnMuZmlsdGVyKHJldm9jYXRpb24gPT4gIXVucmV2b2tlZC5oYXMocmV2b2NhdGlvbi5yZXZvY2F0aW9uSWQpKTtcbiAgICBsZXQga2V5cyA9IG5vcm1hbGl6ZUtleXMoYXdhaXQgZnMucmVhZEZpbGUocGF0aC5qb2luKHJlcG9QYXRoLCBcImF1dGhvcml6ZWRfa2V5c1wiKSwgXCJ1dGY4XCIpLmNhdGNoKCgpID0+IFwiXCIpKTtcbiAgICByZXR1cm4gc3RpbGxSZXZva2VkXG4gICAgICAgIC5maWx0ZXIocmV2b2NhdGlvbiA9PiBrZXlzLnNvbWUoa2V5ID0+IGtleUZpbmdlcnByaW50KGtleSkgPT09IHJldm9jYXRpb24uZmluZ2VycHJpbnQpKVxuICAgICAgICAubWFwKHJldm9jYXRpb24gPT4gKHsgcmV2b2NhdGlvbiwga2V5OiBrZXlzLmZpbmQoa2V5ID0+IGtleUZpbmdlcnByaW50KGtleSkgPT09IHJldm9jYXRpb24uZmluZ2VycHJpbnQpIHx8IFwiXCIgfSkpO1xufVxuXG4vKiogVGhlIHJlcG8gbmFtZWQsIG9yIHRoZSBvbmUgd2UgYXJlIHN0YW5kaW5nIGluLiBDaGVja2VkIHRoZSBzYW1lIHdheSBzZWN1cmVzc2ggY2hlY2tzIGl0OiBhIGdpdFxuICAgIHJlcG8gdGhhdCBhY3R1YWxseSBob2xkcyBrZXlzIGFuZCBoYXMgYW4gb3JpZ2luIHRvIGNsb25lIGZyb20uICovXG5hc3luYyBmdW5jdGlvbiByZXNvbHZlS2V5c1JlcG8obmFtZWQ6IHN0cmluZyB8IHVuZGVmaW5lZCkge1xuICAgIGxldCBjd2QgPSBuYW1lZCAmJiBleHBhbmRIb21lKG5hbWVkKSB8fCB1bmRlZmluZWQ7XG4gICAgbGV0IHJlcG9QYXRoID0gKGF3YWl0IHJ1blByb21pc2UoXCJnaXQgcmV2LXBhcnNlIC0tc2hvdy10b3BsZXZlbFwiLCB7IHF1aWV0OiB0cnVlLCBjd2QgfSkpLnRyaW0oKTtcbiAgICBpZiAoIXJlcG9QYXRoKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgJHtuYW1lZCB8fCBcInRoZSBjdXJyZW50IGRpcmVjdG9yeVwifSB0byBiZSBpbnNpZGUgYSBnaXQgcmVwbywgaXQgaXMgbm90LlxcbiR7VVNBR0V9YCk7XG4gICAgfVxuICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IHJlYWRSZXBvS2V5cyhyZXBvUGF0aCk7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7cmVwb1BhdGh9IHRvIGJlIGEga2V5cyByZXBvLCBpdCBob2xkcyBubyBrZXlzLlxcbiR7ZX1cXG4ke1VTQUdFfWApO1xuICAgIH1cbiAgICBsZXQgb3JpZ2luVVJMID0gKGF3YWl0IHJ1blByb21pc2UoXCJnaXQgcmVtb3RlIGdldC11cmwgb3JpZ2luXCIsIHsgcXVpZXQ6IHRydWUsIGN3ZDogcmVwb1BhdGggfSkpLnRyaW0oKTtcbiAgICBpZiAoIW9yaWdpblVSTCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7cmVwb1BhdGh9IHRvIGhhdmUgYW4gb3JpZ2luIHJlbW90ZSwgaXQgaGFzIG5vbmUuXFxuJHtVU0FHRX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIHsgcmVwb1BhdGgsIG9yaWdpblVSTCB9O1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbWFpbigpIHtcbiAgICBsZXQgYXJndiA9IHByb2Nlc3MuYXJndi5zbGljZSgyKTtcbiAgICBpZiAoYXJndi5sZW5ndGggPiAxKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYXQgbW9zdCBhIGtleXMgcmVwbywgd2FzICR7YXJndi5sZW5ndGh9IGFyZ3VtZW50KHMpXFxuJHtVU0FHRX1gKTtcbiAgICB9XG4gICAgbGV0IHsgcmVwb1BhdGgsIG9yaWdpblVSTCB9ID0gYXdhaXQgcmVzb2x2ZUtleXNSZXBvKGFyZ3ZbMF0pO1xuXG4gICAgbGV0IHJldm9jYXRpb25zID0gYXdhaXQgcmVhZFJlbW90ZVJldm9jYXRpb25zKHsgc291cmNlVVJMOiBvcmlnaW5VUkwgfSk7XG4gICAgaWYgKCFyZXZvY2F0aW9ucy5sZW5ndGgpIHtcbiAgICAgICAgY29uc29sZS5sb2coYCR7cmV2b2tlUmVwb1VSTChvcmlnaW5VUkwpfSBsaXN0cyBubyByZXZvY2F0aW9ucywgc28gdGhlcmUgaXMgbm90aGluZyB0byB1bmRvLmApO1xuICAgICAgICByZXR1cm47XG4gICAgfVxuXG4gICAgbGV0IGRpcmVjdG9yeSA9IHBhdGguam9pbihyZXBvUGF0aCwgVU5SRVZPS0VTX0RJUik7XG4gICAgYXdhaXQgZnMubWtkaXIoZGlyZWN0b3J5LCB7IHJlY3Vyc2l2ZTogdHJ1ZSB9KTtcbiAgICBsZXQgc3RhbXAgPSBuZXcgRGF0ZSgpLnRvSVNPU3RyaW5nKCkucmVwbGFjZSgvWzouXS9nLCBcIi1cIik7XG4gICAgbGV0IHVucmV2b2tlSWQgPSBgJHtzdGFtcH0tdW5yZXZva2VgO1xuICAgIGF3YWl0IGZzLndyaXRlRmlsZShwYXRoLmpvaW4oZGlyZWN0b3J5LCBgJHt1bnJldm9rZUlkfS5qc29uYCksIEpTT04uc3RyaW5naWZ5KHtcbiAgICAgICAgdW5yZXZva2VJZCxcbiAgICAgICAgY3JlYXRlZEF0OiBuZXcgRGF0ZSgpLnRvSVNPU3RyaW5nKCksXG4gICAgICAgIC8vIE5hbWVkIG9uZSBieSBvbmUgcmF0aGVyIHRoYW4gYXMgYSBibGFua2V0IFwiYWxsb3cgZXZlcnl0aGluZyBhZ2FpblwiLCBzbyB0aGlzIGZpbGUgb25seVxuICAgICAgICAvLyBldmVyIHVuZG9lcyB0aGUgcmV2b2NhdGlvbnMgdGhhdCBleGlzdGVkIHdoZW4gaXQgd2FzIHdyaXR0ZW4uXG4gICAgICAgIHJldm9jYXRpb25JZHM6IHJldm9jYXRpb25zLm1hcChyZXZvY2F0aW9uID0+IHJldm9jYXRpb24ucmV2b2NhdGlvbklkKSxcbiAgICAgICAgcmV2b2NhdGlvbnM6IHJldm9jYXRpb25zLm1hcChyZXZvY2F0aW9uID0+ICh7XG4gICAgICAgICAgICByZXZvY2F0aW9uSWQ6IHJldm9jYXRpb24ucmV2b2NhdGlvbklkLFxuICAgICAgICAgICAgZmluZ2VycHJpbnQ6IHJldm9jYXRpb24uZmluZ2VycHJpbnQsXG4gICAgICAgICAgICByZXZva2VkQXQ6IHJldm9jYXRpb24ucmV2b2tlZEF0LFxuICAgICAgICAgICAgcmV2b2tlZEJ5OiByZXZvY2F0aW9uLnJldm9rZWRCeSxcbiAgICAgICAgICAgIGF0dGVtcHQ6IHJldm9jYXRpb24uYXR0ZW1wdCxcbiAgICAgICAgfSkpLFxuICAgIH0sIHVuZGVmaW5lZCwgNCkgKyBcIlxcblwiKTtcblxuICAgIGNvbnNvbGUubG9nKGBXcm90ZSAke1VOUkVWT0tFU19ESVJ9LyR7dW5yZXZva2VJZH0uanNvbiBjb3ZlcmluZyAke3Jldm9jYXRpb25zLmxlbmd0aH0gcmV2b2NhdGlvbihzKTpgKTtcbiAgICBmb3IgKGxldCByZXZvY2F0aW9uIG9mIHJldm9jYXRpb25zKSB7XG4gICAgICAgIGNvbnNvbGUubG9nKGAgICR7cmV2b2NhdGlvbi5maW5nZXJwcmludH0gcmV2b2tlZCBieSAke3Jldm9jYXRpb24ucmV2b2tlZEJ5IHx8IFwiP1wifSBmcm9tICR7cmV2b2NhdGlvbi5hdHRlbXB0Py5pcCB8fCBcIj9cIn1gKTtcbiAgICB9XG4gICAgY29uc29sZS5sb2coYEVhY2ggbWFjaGluZSB3YWl0cyBhbiBob3VyIGFmdGVyIHNlZWluZyBpdCBiZWZvcmUgdGhlIGtleXMgd29yayBhZ2Fpbi5gKTtcbiAgICBjb25zb2xlLmxvZyhgU2lnbiBhbmQgcHVibGlzaCBpdCB3aXRoOlxcbiAgeWFybiBzaWduZmlsZXMgZ2l0YCk7XG59XG4iXX0=
+ /* _JS_SOURCE_HASH = "1f43574c62196a1eb6f7594da6497ffb17128b3c8914274f810f020ee0cc4224"; */

package/security/authorizedKeys/revokeSource.ts

@@ -0,0 +1,40 @@
+import { deriveEd25519Key } from "../keys/deriveKey";
+import { formatOpenSSHPrivateKey, parseOpenSSHPrivateKey } from "../keys/sshKeyFile";
+import { REPO_KEYS_DIR, REPOS_DIR, sourceName } from "./sources";
+
+// A source's revocations live in a repo beside it. Derived rather than configured, so adding a
+// source brings its revoke repo with it and there is nothing extra to pass on the command line.
+const REVOKED_SUFFIX = "_revoked";
+// GitHub will not take the same public key as a deploy key on two repos, so the revoke repo is
+// reached with a key derived from the source's, under this label.
+export const REVOKE_KEY_LABEL = "revokegithubkey";
+
+export function revokeRepoURL(sourceURL: string) {
+    let withoutGit = sourceURL.replace(/\.git$/, "");
+    return `${withoutGit}${REVOKED_SUFFIX}.git`;
+}
+
+export function revokeKeyPath(sourceURL: string) {
+    return `${REPO_KEYS_DIR}/${sourceName(sourceURL)}${REVOKED_SUFFIX}`;
+}
+
+export function revokeRepoPath(sourceURL: string) {
+    return `${REPOS_DIR}/${sourceName(sourceURL)}${REVOKED_SUFFIX}`;
+}
+
+/** The revoke repo's key, worked out from the source repo's key. Anything holding the source key
+    can produce it, so it never has to be stored anywhere separately or handed around. */
+export function deriveRevokeKey(sourcePrivateKey: string) {
+    let source = parseOpenSSHPrivateKey(sourcePrivateKey);
+    let derived = deriveEd25519Key({ seed: source.seed, label: REVOKE_KEY_LABEL });
+    return {
+        publicKey: `ssh-ed25519 ${Buffer.concat([
+            Buffer.from([0, 0, 0, 11]), Buffer.from("ssh-ed25519"),
+            Buffer.from([0, 0, 0, 32]), derived.publicKey,
+        ]).toString("base64")}`,
+        privateKeyFile: formatOpenSSHPrivateKey({
+            seed: derived.seed,
+            comment: `${source.comment || "portsecure"} ${REVOKE_KEY_LABEL}`,
+        }),
+    };
+}

package/security/authorizedKeys/secureSSH.ts

@@ -4,24 +4,30 @@ import path from "path";
 import { DEFAULT_WEBHOOK_FILE_PATH, parseWebhookFile } from "../notifications/discord";
 import { normalizeKeys, readRepoKeys, summarizeKey } from "./authorizedKeys";
 import { sourceKeyPath, sourceRepoPath } from "./sources";
+import { deriveRevokeKey, REVOKE_KEY_LABEL, revokeRepoURL } from "./revokeSource";
+import { revokedKeysInRepo } from "./unrevoke";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
 import { readRemoteFile, remoteCommandExists, runOverSSH, SUDO_PREAMBLE, writeRemoteFile } from "../helpers/remoteSSH";
 
-const DAEMON_SOURCE = path.join(__dirname, "daemon", "portsecureDaemon.js");
 const SERVICE_SOURCE = path.join(__dirname, "daemon", "portsecure.service");
-const REMOTE_DAEMON_PATH = "/opt/portsecure/portsecure-daemon.js";
+// The daemon runs from a checkout of this repo on the host, rather than from a copy we upload, so
+// a host updates itself from github the same way anything else does. sliftutils is public, so this
+// needs no key.
+const SLIFTUTILS_URL = "https://github.com/sliftist/sliftutils.git";
+const REMOTE_CHECKOUT_PATH = "/opt/portsecure/sliftutils";
 const REMOTE_SERVICE_PATH = "/etc/systemd/system/portsecure.service";
 const REMOTE_CONFIG_PATH = "/etc/portsecure/daemon.json";
 const ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
 const SERVICE_NAME = "portsecure";
 const MAX_ERROR_BODY_LENGTH = 500;
-const VERBS = ["add", "remove", "list"];
+const VERBS = ["add", "remove", "list", "update"];
 // The repo url is optional, and defaults to the repo the command is run from.
 const USAGE = `Usage:
   yarn securessh <host> add <repo-private-key> [repo-url]
   yarn securessh <host> remove [repo-url]
-  yarn securessh <host> list`;
+  yarn securessh <host> list
+  yarn securessh <host> update`;
 
 async function pathExists(filePath: string) {
     try {
@@ -41,7 +47,7 @@ async function runLocal(config: { command: string; args: string[]; cwd?: string;
     if (result.status !== 0 && !allowFailure) {
         throw new Error(
             `Expected ${command} ${args.join(" ")} to exit 0, was ${result.status}. `
-            + `${(result.stderr || "").slice(0, MAX_ERROR_BODY_LENGTH)}`
+            + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
         );
     }
     return result;
@@ -69,7 +75,7 @@ async function gitWithKey(config: { keyPath: string; args: string[]; cwd?: strin
     if (result.status !== 0 && !allowFailure) {
         throw new Error(
             `Expected git ${args.join(" ")} to exit 0, was ${result.status}. `
-            + `${(result.stderr || "").slice(0, MAX_ERROR_BODY_LENGTH)}`
+            + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
         );
     }
     return result;
@@ -158,6 +164,101 @@ async function resolveRepoURL(passedURL: string | undefined) {
     return repoURL;
 }
 
+/** Every source's revoke repo has to exist and hold at least one commit, or the hosts using it
+    cannot record a revocation. Checked with this machine's own git credentials, since update is
+    not given any deploy key, and an empty repo is initialised rather than merely complained about.
+
+    A host that cannot write a revocation silently keeps accepting a key it just saw being misused,
+    which is the one failure this whole thing exists to prevent, so it is checked on every deploy
+    and not only when a source is first added. */
+async function ensureRevokeReposExist(repoSources: string[]) {
+    for (let repoURL of repoSources) {
+        let revokeURL = revokeRepoURL(repoURL);
+        let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "portsecure-revoke-"));
+        let checkoutPath = path.join(temporaryDirectory, "repo");
+        let clone = await runLocal({ command: "git", args: ["clone", revokeURL, checkoutPath], allowFailure: true });
+        if (clone.status !== 0) {
+            await fs.rm(temporaryDirectory, { recursive: true, force: true });
+            throw new Error(
+                `Expected ${revokeURL} to exist, it does not, so ${repoURL} has nowhere to record a`
+                + ` revocation.\nCreate it, then run "yarn securessh <host> add" for that source to`
+                + ` register its deploy key.\n${(clone.stdout + clone.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
+            );
+        }
+        let head = await runLocal({ command: "git", args: ["-C", checkoutPath, "rev-parse", "HEAD"], allowFailure: true });
+        if (head.status !== 0) {
+            console.log(`${revokeURL} is empty, giving it a first commit`);
+            await fs.writeFile(path.join(checkoutPath, "README.md"),
+                `# revoked keys\n\nWritten by portsecure. Each file under revocations/ is one key that was used from an\n`
+                + `address it is not allowed from, and is no longer accepted anywhere.\n`);
+            for (let args of [
+                ["-C", checkoutPath, "add", "-A"],
+                ["-C", checkoutPath, "-c", "user.email=portsecure@localhost", "-c", "user.name=portsecure", "commit", "-m", "initialise revoke repo"],
+                ["-C", checkoutPath, "push", "origin", "HEAD"],
+            ]) {
+                await runLocal({ command: "git", args });
+            }
+        }
+        await fs.rm(temporaryDirectory, { recursive: true, force: true });
+        console.log(`${revokeURL} is ready`);
+    }
+}
+
+/** The revoke repo has to exist and be writable before a host is set up, because a host that
+    cannot write a revocation cannot revoke a key that is being misused. The key for it is derived
+    from the source's, since github will not take one public key on two repos. */
+async function ensureRevokeRepo(config: { keyPath: string; repoURL: string }) {
+    let { keyPath, repoURL } = config;
+    let revokeURL = revokeRepoURL(repoURL);
+    let derived = deriveRevokeKey(await fs.readFile(keyPath, "utf8"));
+
+    let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "portsecure-revoke-"));
+    let derivedKeyPath = path.join(temporaryDirectory, "key");
+    await fs.writeFile(derivedKeyPath, derived.privateKeyFile, { mode: 0o600 });
+    let checkoutPath = path.join(temporaryDirectory, "repo");
+
+    let explain = (problem: string) => new Error(
+        `${problem}\n`
+        + `Create ${revokeURL} and add this as a deploy key WITH WRITE ACCESS:\n`
+        + `  ${derived.publicKey} ${REVOKE_KEY_LABEL}\n`
+        + `It has to be this key: it is derived from ${keyPath}, and github will not accept the same`
+        + ` public key on two repositories.`
+    );
+
+    console.log(`Checking ${revokeURL}`);
+    let clone = await gitWithKey({ keyPath: derivedKeyPath, args: ["clone", revokeURL, checkoutPath], allowFailure: true });
+    if (clone.status !== 0) {
+        throw explain(`Expected ${revokeURL} to be readable with the derived key, it is not.`);
+    }
+
+    // An empty repo has no branch for the daemon to clone, so it gets its first commit here. That
+    // doubles as the proof that we can write to it.
+    let head = await gitWithKey({ keyPath: derivedKeyPath, args: ["rev-parse", "HEAD"], cwd: checkoutPath, allowFailure: true });
+    if (head.status !== 0) {
+        await fs.writeFile(path.join(checkoutPath, "README.md"),
+            `# revoked keys\n\nWritten by portsecure. Each file under revocations/ is one key that was used from an\n`
+            + `address it is not allowed from, and is no longer accepted anywhere.\n`);
+        for (let args of [
+            ["add", "-A"],
+            ["-c", "user.email=portsecure@localhost", "-c", "user.name=portsecure", "commit", "-m", "initialise revoke repo"],
+        ]) {
+            await gitWithKey({ keyPath: derivedKeyPath, args, cwd: checkoutPath });
+        }
+        let push = await gitWithKey({ keyPath: derivedKeyPath, args: ["push", "origin", "HEAD"], cwd: checkoutPath, allowFailure: true });
+        if (push.status !== 0) {
+            throw explain(`Expected write access to ${revokeURL}, the first push was refused.\n${(push.stdout + push.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`);
+        }
+    } else {
+        let dryRun = await gitWithKey({ keyPath: derivedKeyPath, args: ["push", "--dry-run", "origin", "HEAD"], cwd: checkoutPath, allowFailure: true });
+        if (dryRun.status !== 0) {
+            throw explain(`Expected write access to ${revokeURL}, a dry run push was refused.\n${(dryRun.stdout + dryRun.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`);
+        }
+    }
+
+    await fs.rm(temporaryDirectory, { recursive: true, force: true });
+    console.log(`${revokeURL} is writable`);
+}
+
 async function readRemoteConfig(host: string) {
     let contents = await readRemoteFile({ host, filePath: REMOTE_CONFIG_PATH });
     if (!contents) {
@@ -187,11 +288,31 @@ fi`,
 
 async function installDaemon(config: { host: string; hostLabel: string; repoSources: string[] }) {
     let { host, hostLabel, repoSources } = config;
-    for (let command of ["node", "git"]) {
+    for (let command of ["node", "git", "yarn"]) {
         if (!await remoteCommandExists({ host, command })) {
             throw new Error(`Expected ${command} to be installed on ${host}, it is not. Install it and rerun.`);
         }
     }
+
+    // The checkout is brought to the latest commit rather than a copy being pushed, so what runs on
+    // the host is exactly what is on github.
+    console.log(`Updating ${REMOTE_CHECKOUT_PATH} on ${host}`);
+    await runOverSSH({
+        host,
+        script: `${SUDO_PREAMBLE}
+set -e
+$SUDO mkdir -p "${path.posix.dirname(REMOTE_CHECKOUT_PATH)}"
+if $SUDO test -d "${REMOTE_CHECKOUT_PATH}/.git"; then
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" fetch --prune origin
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" reset --hard origin/HEAD
+else
+    $SUDO rm -rf "${REMOTE_CHECKOUT_PATH}"
+    $SUDO git clone "${SLIFTUTILS_URL}" "${REMOTE_CHECKOUT_PATH}"
+fi
+$SUDO yarn --cwd "${REMOTE_CHECKOUT_PATH}" install --production --non-interactive
+# The single file daemon this replaced, left over on a host set up by an older version.
+$SUDO rm -f /opt/portsecure/portsecure-daemon.js`,
+    });
     await writeRemoteFile({
         host,
         filePath: REMOTE_CONFIG_PATH,
@@ -201,13 +322,6 @@ async function installDaemon(config: { host: string; hostLabel: string; repoSour
         fileMode: "600",
         directoryMode: "700",
     });
-    await writeRemoteFile({
-        host,
-        filePath: REMOTE_DAEMON_PATH,
-        contents: await fs.readFile(DAEMON_SOURCE, "utf8"),
-        fileMode: "755",
-        directoryMode: "755",
-    });
     await writeRemoteFile({
         host,
         filePath: REMOTE_SERVICE_PATH,
@@ -271,7 +385,8 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
     if (reachable.status !== 0) {
         throw new Error(
             `Expected ${repoURL} to be reachable with ${keyPath}, git ls-remote failed.`
-            + ` The daemon would have no way to fetch keys.\n${reachable.stderr.slice(0, MAX_ERROR_BODY_LENGTH)}`
+            + ` The daemon would have no way to fetch keys.\n`
+            + `${(reachable.stdout + reachable.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
         );
     }
 
@@ -299,6 +414,19 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
     }
     console.log(`Our key ${ourFingerprint} is in the merged keys, access will survive.`);
 
+    await ensureRevokeRepo({ keyPath, repoURL });
+
+    // Deploying a repo that still holds a revoked key would hand it back to every machine.
+    let revoked = await revokedKeysInRepo({ repoPath: inspectionPath, sourceURL: repoURL });
+    if (revoked.length) {
+        throw new Error(
+            `Expected ${repoURL} to hold no revoked keys, it holds ${revoked.length}:\n`
+            + revoked.map(entry => `  ${entry.revocation.fingerprint} revoked by`
+                + ` ${entry.revocation.revokedBy || "?"} after use from ${entry.revocation.attempt?.ip || "?"}`).join("\n")
+            + `\nDelete them from the repo, or run "yarn unrevoke" there to allow them again.`
+        );
+    }
+
     let webhookURL = await requireRemoteWebhook(host);
     console.log(`${host} notifies ${webhookURL}`);
 
@@ -362,6 +490,57 @@ $SUDO rm -rf "${sourceRepoPath(repoURL)}"`,
 
 /** Answers "who can log into this box, and which repo says so". The paths the daemon uses are
     left out on purpose, they are plumbing rather than something to act on. */
+/** The daemon is installed from this checkout, so the checkout is brought up to date first.
+    Anything that stops the pull - a conflict, local commits, no upstream - stops the update too,
+    rather than quietly installing whatever happened to be on disk. */
+async function pullLocalCheckout() {
+    let topLevel = await spawnPromise({ command: "git", args: ["rev-parse", "--show-toplevel"], cwd: __dirname });
+    if (topLevel.status !== 0) {
+        throw new Error(
+            `Expected ${__dirname} to be inside a git checkout, it is not.`
+            + ` update installs the daemon from this checkout, so it has to be one.`
+        );
+    }
+    let repoPath = topLevel.stdout.trim();
+    let pull = await spawnPromise({ command: "git", args: ["pull", "--ff-only"], cwd: repoPath });
+    if (pull.status !== 0) {
+        throw new Error(
+            `Expected git pull in ${repoPath} to succeed, it did not, so nothing was installed.\n`
+            + `${(pull.stdout + pull.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
+        );
+    }
+    // The host installs from github, not from here, so local commits that have not been pushed
+    // are not what it will run.
+    let local = await spawnPromise({ command: "git", args: ["rev-parse", "HEAD"], cwd: repoPath });
+    let remote = await spawnPromise({ command: "git", args: ["rev-parse", "@{u}"], cwd: repoPath });
+    if (local.stdout.trim() !== remote.stdout.trim()) {
+        console.log(`WARNING: ${repoPath} has commits that are not pushed. The host installs from github,`);
+        console.log(`         so it will run the pushed version, not what is here.`);
+    }
+    console.log(`Pulled ${repoPath}`);
+}
+
+/** Pushes the current daemon onto a host that already has one, for when this code has moved on.
+    Nothing about which keys the host trusts is touched. */
+async function updateDaemon(host: string) {
+    // Pulled before anything else, so a checkout that cannot be brought up to date fails here
+    // rather than after we have already started changing the host.
+    await pullLocalCheckout();
+    let contents = await readRemoteFile({ host, filePath: REMOTE_CONFIG_PATH });
+    if (!contents) {
+        throw new Error(
+            `Expected ${host} to already have portsecure, ${REMOTE_CONFIG_PATH} does not exist.\n`
+            + `Set it up with:\n  yarn securessh ${host} add <repo-private-key> [repo-url]`
+        );
+    }
+    let parsed = JSON.parse(contents) as { hostLabel?: string; repoSources?: string[] };
+    let repoSources = parsed.repoSources || [];
+    await requireRemoteWebhook(host);
+    await ensureRevokeReposExist(repoSources);
+    await installDaemon({ host, hostLabel: parsed.hostLabel || host, repoSources });
+    console.log(`Updated the daemon on ${host}. ${repoSources.length} source(s), unchanged.`);
+}
+
 async function listSources(host: string) {
     let remoteConfig = await readRemoteConfig(host);
     if (!remoteConfig.repoSources.length) {
@@ -413,6 +592,13 @@ export async function main() {
         await listSources(host);
         return;
     }
+    if (verb === "update") {
+        if (rest.length) {
+            throw new Error(`Expected nothing after update, was ${rest.length} argument(s)\n${USAGE}`);
+        }
+        await updateDaemon(host);
+        return;
+    }
     if (verb === "add") {
         if (!rest.length || rest.length > 2) {
             throw new Error(`Expected a private key and optionally a repo url, was ${rest.length} argument(s)\n${USAGE}`);