sliftutils 1.7.125 → 1.7.127

package/security/authorizedKeys/dist/authorizedKeys.ts.cache

@@ -0,0 +1,111 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.readRepoKeys = exports.findKeyProblems = exports.summarizeKey = exports.keyRestriction = exports.keyRestrictionList = exports.NO_RESTRICTION = exports.keyFingerprint = exports.normalizeKeys = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+function normalizeKeys(contents) {
+    return contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
+}
+exports.normalizeKeys = normalizeKeys;
+/** The fingerprint ssh itself reports for a key, which is what the sshd log names and therefore
+    what a revocation is keyed by. Returns "" for a line that holds no key. */
+function keyFingerprint(keyLine) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    let blob = typeIndex >= 0 && parts[typeIndex + 1] || "";
+    if (!blob) {
+        return "";
+    }
+    return "SHA256:" + crypto_1.default.createHash("sha256").update(Buffer.from(blob, "base64")).digest("base64").replace(/=+$/, "");
+}
+exports.keyFingerprint = keyFingerprint;
+exports.NO_RESTRICTION = "ANY ADDRESS (no from= restriction)";
+/** The addresses a key may be used from, one by one, or undefined when the key carries no from=
+    at all. Undefined and an empty list are very different things, so they stay distinguishable. */
+function keyRestrictionList(keyLine) {
+    let match = keyLine.match(/from="([^"]*)"/);
+    if (!match) {
+        return undefined;
+    }
+    return match[1].split(",").map(entry => entry.trim()).filter(entry => entry);
+}
+exports.keyRestrictionList = keyRestrictionList;
+/** The addresses a key may be used from, which is the part of an authorized_keys line that
+    decides how much a stolen key is worth. A key with no restriction says so loudly. */
+function keyRestriction(keyLine) {
+    let list = keyRestrictionList(keyLine);
+    if (!list) {
+        return exports.NO_RESTRICTION;
+    }
+    return list.join(",");
+}
+exports.keyRestriction = keyRestriction;
+/** Enough to recognise whose key this is without printing the whole blob. */
+function summarizeKey(keyLine) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    if (typeIndex < 0) {
+        return keyLine.slice(0, 60);
+    }
+    let type = parts[typeIndex];
+    let blob = parts[typeIndex + 1] || "";
+    let comment = parts.slice(typeIndex + 2).join(" ");
+    return `${type} ...${blob.slice(-12)}${comment && ` ${comment}` || ""}`;
+}
+exports.summarizeKey = summarizeKey;
+/** What a set of keys has to satisfy before it is worth signing, as a list of complaints.
+
+    Every key needs a from=, because an unrestricted key can never be caught being used from the
+    wrong place, and being caught is the only thing that triggers a revocation.
+
+    No two keys may allow the same addresses, because that is one person holding two keys: revoking
+    one of them leaves the other working, so the revocation achieves nothing. */
+function findKeyProblems(keys) {
+    let problems = [];
+    let byRestriction = new Map();
+    for (let key of keys) {
+        let restriction = keyRestrictionList(key);
+        if (!restriction) {
+            problems.push(`no from= restriction, so it can be used from anywhere:\n      ${summarizeKey(key)}`);
+            continue;
+        }
+        // Sorted, so the same addresses written in a different order still count as the same.
+        let identity = [...restriction].sort().join(",");
+        byRestriction.set(identity, [...(byRestriction.get(identity) || []), key]);
+    }
+    for (let [restriction, sharing] of byRestriction) {
+        if (sharing.length < 2) {
+            continue;
+        }
+        problems.push(`${sharing.length} keys allow exactly the same addresses (${restriction}), which is one`
+            + ` person holding more than one key:\n`
+            + sharing.map(key => `      ${summarizeKey(key)}`).join("\n"));
+    }
+    return problems;
+}
+exports.findKeyProblems = findKeyProblems;
+/** Reads the authorized keys a repo checkout wants applied. Prefers a top level authorized_keys
+    file and otherwise concatenates every .pub at the top level. */
+async function readRepoKeys(repoPath) {
+    let combinedPath = path_1.default.join(repoPath, "authorized_keys");
+    let entries = await promises_1.default.readdir(repoPath);
+    if (entries.includes("authorized_keys")) {
+        return normalizeKeys(await promises_1.default.readFile(combinedPath, "utf8"));
+    }
+    let pubFiles = entries.filter(name => name.endsWith(".pub")).sort();
+    if (!pubFiles.length) {
+        throw new Error(`Expected authorized_keys or at least one .pub file in ${repoPath}, found neither`);
+    }
+    let keys = [];
+    for (let name of pubFiles) {
+        keys.push(...normalizeKeys(await promises_1.default.readFile(path_1.default.join(repoPath, name), "utf8")));
+    }
+    return keys;
+}
+exports.readRepoKeys = readRepoKeys;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplZEtleXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhdXRob3JpemVkS2V5cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxvREFBNEI7QUFDNUIsMkRBQTZCO0FBQzdCLGdEQUF3QjtBQUV4QixTQUFnQixhQUFhLENBQUMsUUFBZ0I7SUFDMUMsT0FBTyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztBQUN2RyxDQUFDO0FBRkQsc0NBRUM7QUFFRDs4RUFDOEU7QUFDOUUsU0FBZ0IsY0FBYyxDQUFDLE9BQWU7SUFDMUMsSUFBSSxLQUFLLEdBQUcsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN4QyxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDekUsSUFBSSxJQUFJLEdBQUcsU0FBUyxJQUFJLENBQUMsSUFBSSxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN4RCxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDUixPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFDRCxPQUFPLFNBQVMsR0FBRyxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztBQUMzSCxDQUFDO0FBUkQsd0NBUUM7QUFFWSxRQUFBLGNBQWMsR0FBRyxvQ0FBb0MsQ0FBQztBQUVuRTttR0FDbUc7QUFDbkcsU0FBZ0Isa0JBQWtCLENBQUMsT0FBZTtJQUM5QyxJQUFJLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDNUMsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ1QsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNqRixDQUFDO0FBTkQsZ0RBTUM7QUFFRDt3RkFDd0Y7QUFDeEYsU0FBZ0IsY0FBYyxDQUFDLE9BQWU7SUFDMUMsSUFBSSxJQUFJLEdBQUcsa0JBQWtCLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdkMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1IsT0FBTyxzQkFBYyxDQUFDO0lBQzFCLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDMUIsQ0FBQztBQU5ELHdDQU1DO0FBRUQsNkVBQTZFO0FBQzdFLFNBQWdCLFlBQVksQ0FBQyxPQUFlO0lBQ3hDLElBQUksS0FBSyxHQUFHLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEMsSUFBSSxTQUFTLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLElBQUksU0FBUyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2hCLE9BQU8sT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDaEMsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUM1QixJQUFJLElBQUksR0FBRyxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN0QyxJQUFJLE9BQU8sR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbkQsT0FBTyxHQUFHLElBQUksT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLEdBQUcsT0FBTyxJQUFJLElBQUksT0FBTyxFQUFFLElBQUksRUFBRSxFQUFFLENBQUM7QUFDNUUsQ0FBQztBQVZELG9DQVVDO0FBRUQ7Ozs7OztnRkFNZ0Y7QUFDaEYsU0FBZ0IsZUFBZSxDQUFDLElBQWM7SUFDMUMsSUFBSSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksYUFBYSxHQUFHLElBQUksR0FBRyxFQUFvQixDQUFDO0lBQ2hELEtBQUssSUFBSSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7UUFDbkIsSUFBSSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDMUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2YsUUFBUSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNwRyxTQUFTO1FBQ2IsQ0FBQztRQUNELHNGQUFzRjtRQUN0RixJQUFJLFFBQVEsR0FBRyxDQUFDLEdBQUcsV0FBVyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2pELGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsS0FBSyxJQUFJLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQy9DLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyQixTQUFTO1FBQ2IsQ0FBQztRQUNELFFBQVEsQ0FBQyxJQUFJLENBQ1QsR0FBRyxPQUFPLENBQUMsTUFBTSwyQ0FBMkMsV0FBVyxpQkFBaUI7Y0FDdEYsc0NBQXNDO2NBQ3RDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxTQUFTLFlBQVksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUNoRSxDQUFDO0lBQ04sQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ3BCLENBQUM7QUF4QkQsMENBd0JDO0FBRUQ7bUVBQ21FO0FBQzVELEtBQUssVUFBVSxZQUFZLENBQUMsUUFBZ0I7SUFDL0MsSUFBSSxZQUFZLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUMxRCxJQUFJLE9BQU8sR0FBRyxNQUFNLGtCQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pDLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7UUFDdEMsT0FBTyxhQUFhLENBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsSUFBSSxRQUFRLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNwRSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25CLE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELFFBQVEsaUJBQWlCLENBQUMsQ0FBQztJQUN4RyxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQWEsRUFBRSxDQUFDO0lBQ3hCLEtBQUssSUFBSSxJQUFJLElBQUksUUFBUSxFQUFFLENBQUM7UUFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLGFBQWEsQ0FBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQztBQWZELG9DQWVDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGNyeXB0byBmcm9tIFwiY3J5cHRvXCI7XG5pbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5pbXBvcnQgcGF0aCBmcm9tIFwicGF0aFwiO1xuXG5leHBvcnQgZnVuY3Rpb24gbm9ybWFsaXplS2V5cyhjb250ZW50czogc3RyaW5nKSB7XG4gICAgcmV0dXJuIGNvbnRlbnRzLnNwbGl0KFwiXFxuXCIpLm1hcChsaW5lID0+IGxpbmUudHJpbSgpKS5maWx0ZXIobGluZSA9PiBsaW5lICYmICFsaW5lLnN0YXJ0c1dpdGgoXCIjXCIpKTtcbn1cblxuLyoqIFRoZSBmaW5nZXJwcmludCBzc2ggaXRzZWxmIHJlcG9ydHMgZm9yIGEga2V5LCB3aGljaCBpcyB3aGF0IHRoZSBzc2hkIGxvZyBuYW1lcyBhbmQgdGhlcmVmb3JlXG4gICAgd2hhdCBhIHJldm9jYXRpb24gaXMga2V5ZWQgYnkuIFJldHVybnMgXCJcIiBmb3IgYSBsaW5lIHRoYXQgaG9sZHMgbm8ga2V5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGtleUZpbmdlcnByaW50KGtleUxpbmU6IHN0cmluZykge1xuICAgIGxldCBwYXJ0cyA9IGtleUxpbmUudHJpbSgpLnNwbGl0KC9cXHMrLyk7XG4gICAgbGV0IHR5cGVJbmRleCA9IHBhcnRzLmZpbmRJbmRleChwYXJ0ID0+IC9eKHNzaC18ZWNkc2EtfHNrLSkvLnRlc3QocGFydCkpO1xuICAgIGxldCBibG9iID0gdHlwZUluZGV4ID49IDAgJiYgcGFydHNbdHlwZUluZGV4ICsgMV0gfHwgXCJcIjtcbiAgICBpZiAoIWJsb2IpIHtcbiAgICAgICAgcmV0dXJuIFwiXCI7XG4gICAgfVxuICAgIHJldHVybiBcIlNIQTI1NjpcIiArIGNyeXB0by5jcmVhdGVIYXNoKFwic2hhMjU2XCIpLnVwZGF0ZShCdWZmZXIuZnJvbShibG9iLCBcImJhc2U2NFwiKSkuZGlnZXN0KFwiYmFzZTY0XCIpLnJlcGxhY2UoLz0rJC8sIFwiXCIpO1xufVxuXG5leHBvcnQgY29uc3QgTk9fUkVTVFJJQ1RJT04gPSBcIkFOWSBBRERSRVNTIChubyBmcm9tPSByZXN0cmljdGlvbilcIjtcblxuLyoqIFRoZSBhZGRyZXNzZXMgYSBrZXkgbWF5IGJlIHVzZWQgZnJvbSwgb25lIGJ5IG9uZSwgb3IgdW5kZWZpbmVkIHdoZW4gdGhlIGtleSBjYXJyaWVzIG5vIGZyb209XG4gICAgYXQgYWxsLiBVbmRlZmluZWQgYW5kIGFuIGVtcHR5IGxpc3QgYXJlIHZlcnkgZGlmZmVyZW50IHRoaW5ncywgc28gdGhleSBzdGF5IGRpc3Rpbmd1aXNoYWJsZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBrZXlSZXN0cmljdGlvbkxpc3Qoa2V5TGluZTogc3RyaW5nKSB7XG4gICAgbGV0IG1hdGNoID0ga2V5TGluZS5tYXRjaCgvZnJvbT1cIihbXlwiXSopXCIvKTtcbiAgICBpZiAoIW1hdGNoKSB7XG4gICAgICAgIHJldHVybiB1bmRlZmluZWQ7XG4gICAgfVxuICAgIHJldHVybiBtYXRjaFsxXS5zcGxpdChcIixcIikubWFwKGVudHJ5ID0+IGVudHJ5LnRyaW0oKSkuZmlsdGVyKGVudHJ5ID0+IGVudHJ5KTtcbn1cblxuLyoqIFRoZSBhZGRyZXNzZXMgYSBrZXkgbWF5IGJlIHVzZWQgZnJvbSwgd2hpY2ggaXMgdGhlIHBhcnQgb2YgYW4gYXV0aG9yaXplZF9rZXlzIGxpbmUgdGhhdFxuICAgIGRlY2lkZXMgaG93IG11Y2ggYSBzdG9sZW4ga2V5IGlzIHdvcnRoLiBBIGtleSB3aXRoIG5vIHJlc3RyaWN0aW9uIHNheXMgc28gbG91ZGx5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGtleVJlc3RyaWN0aW9uKGtleUxpbmU6IHN0cmluZykge1xuICAgIGxldCBsaXN0ID0ga2V5UmVzdHJpY3Rpb25MaXN0KGtleUxpbmUpO1xuICAgIGlmICghbGlzdCkge1xuICAgICAgICByZXR1cm4gTk9fUkVTVFJJQ1RJT047XG4gICAgfVxuICAgIHJldHVybiBsaXN0LmpvaW4oXCIsXCIpO1xufVxuXG4vKiogRW5vdWdoIHRvIHJlY29nbmlzZSB3aG9zZSBrZXkgdGhpcyBpcyB3aXRob3V0IHByaW50aW5nIHRoZSB3aG9sZSBibG9iLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHN1bW1hcml6ZUtleShrZXlMaW5lOiBzdHJpbmcpIHtcbiAgICBsZXQgcGFydHMgPSBrZXlMaW5lLnRyaW0oKS5zcGxpdCgvXFxzKy8pO1xuICAgIGxldCB0eXBlSW5kZXggPSBwYXJ0cy5maW5kSW5kZXgocGFydCA9PiAvXihzc2gtfGVjZHNhLXxzay0pLy50ZXN0KHBhcnQpKTtcbiAgICBpZiAodHlwZUluZGV4IDwgMCkge1xuICAgICAgICByZXR1cm4ga2V5TGluZS5zbGljZSgwLCA2MCk7XG4gICAgfVxuICAgIGxldCB0eXBlID0gcGFydHNbdHlwZUluZGV4XTtcbiAgICBsZXQgYmxvYiA9IHBhcnRzW3R5cGVJbmRleCArIDFdIHx8IFwiXCI7XG4gICAgbGV0IGNvbW1lbnQgPSBwYXJ0cy5zbGljZSh0eXBlSW5kZXggKyAyKS5qb2luKFwiIFwiKTtcbiAgICByZXR1cm4gYCR7dHlwZX0gLi4uJHtibG9iLnNsaWNlKC0xMil9JHtjb21tZW50ICYmIGAgJHtjb21tZW50fWAgfHwgXCJcIn1gO1xufVxuXG4vKiogV2hhdCBhIHNldCBvZiBrZXlzIGhhcyB0byBzYXRpc2Z5IGJlZm9yZSBpdCBpcyB3b3J0aCBzaWduaW5nLCBhcyBhIGxpc3Qgb2YgY29tcGxhaW50cy5cblxuICAgIEV2ZXJ5IGtleSBuZWVkcyBhIGZyb209LCBiZWNhdXNlIGFuIHVucmVzdHJpY3RlZCBrZXkgY2FuIG5ldmVyIGJlIGNhdWdodCBiZWluZyB1c2VkIGZyb20gdGhlXG4gICAgd3JvbmcgcGxhY2UsIGFuZCBiZWluZyBjYXVnaHQgaXMgdGhlIG9ubHkgdGhpbmcgdGhhdCB0cmlnZ2VycyBhIHJldm9jYXRpb24uXG5cbiAgICBObyB0d28ga2V5cyBtYXkgYWxsb3cgdGhlIHNhbWUgYWRkcmVzc2VzLCBiZWNhdXNlIHRoYXQgaXMgb25lIHBlcnNvbiBob2xkaW5nIHR3byBrZXlzOiByZXZva2luZ1xuICAgIG9uZSBvZiB0aGVtIGxlYXZlcyB0aGUgb3RoZXIgd29ya2luZywgc28gdGhlIHJldm9jYXRpb24gYWNoaWV2ZXMgbm90aGluZy4gKi9cbmV4cG9ydCBmdW5jdGlvbiBmaW5kS2V5UHJvYmxlbXMoa2V5czogc3RyaW5nW10pIHtcbiAgICBsZXQgcHJvYmxlbXM6IHN0cmluZ1tdID0gW107XG4gICAgbGV0IGJ5UmVzdHJpY3Rpb24gPSBuZXcgTWFwPHN0cmluZywgc3RyaW5nW10+KCk7XG4gICAgZm9yIChsZXQga2V5IG9mIGtleXMpIHtcbiAgICAgICAgbGV0IHJlc3RyaWN0aW9uID0ga2V5UmVzdHJpY3Rpb25MaXN0KGtleSk7XG4gICAgICAgIGlmICghcmVzdHJpY3Rpb24pIHtcbiAgICAgICAgICAgIHByb2JsZW1zLnB1c2goYG5vIGZyb209IHJlc3RyaWN0aW9uLCBzbyBpdCBjYW4gYmUgdXNlZCBmcm9tIGFueXdoZXJlOlxcbiAgICAgICR7c3VtbWFyaXplS2V5KGtleSl9YCk7XG4gICAgICAgICAgICBjb250aW51ZTtcbiAgICAgICAgfVxuICAgICAgICAvLyBTb3J0ZWQsIHNvIHRoZSBzYW1lIGFkZHJlc3NlcyB3cml0dGVuIGluIGEgZGlmZmVyZW50IG9yZGVyIHN0aWxsIGNvdW50IGFzIHRoZSBzYW1lLlxuICAgICAgICBsZXQgaWRlbnRpdHkgPSBbLi4ucmVzdHJpY3Rpb25dLnNvcnQoKS5qb2luKFwiLFwiKTtcbiAgICAgICAgYnlSZXN0cmljdGlvbi5zZXQoaWRlbnRpdHksIFsuLi4oYnlSZXN0cmljdGlvbi5nZXQoaWRlbnRpdHkpIHx8IFtdKSwga2V5XSk7XG4gICAgfVxuICAgIGZvciAobGV0IFtyZXN0cmljdGlvbiwgc2hhcmluZ10gb2YgYnlSZXN0cmljdGlvbikge1xuICAgICAgICBpZiAoc2hhcmluZy5sZW5ndGggPCAyKSB7XG4gICAgICAgICAgICBjb250aW51ZTtcbiAgICAgICAgfVxuICAgICAgICBwcm9ibGVtcy5wdXNoKFxuICAgICAgICAgICAgYCR7c2hhcmluZy5sZW5ndGh9IGtleXMgYWxsb3cgZXhhY3RseSB0aGUgc2FtZSBhZGRyZXNzZXMgKCR7cmVzdHJpY3Rpb259KSwgd2hpY2ggaXMgb25lYFxuICAgICAgICAgICAgKyBgIHBlcnNvbiBob2xkaW5nIG1vcmUgdGhhbiBvbmUga2V5OlxcbmBcbiAgICAgICAgICAgICsgc2hhcmluZy5tYXAoa2V5ID0+IGAgICAgICAke3N1bW1hcml6ZUtleShrZXkpfWApLmpvaW4oXCJcXG5cIilcbiAgICAgICAgKTtcbiAgICB9XG4gICAgcmV0dXJuIHByb2JsZW1zO1xufVxuXG4vKiogUmVhZHMgdGhlIGF1dGhvcml6ZWQga2V5cyBhIHJlcG8gY2hlY2tvdXQgd2FudHMgYXBwbGllZC4gUHJlZmVycyBhIHRvcCBsZXZlbCBhdXRob3JpemVkX2tleXNcbiAgICBmaWxlIGFuZCBvdGhlcndpc2UgY29uY2F0ZW5hdGVzIGV2ZXJ5IC5wdWIgYXQgdGhlIHRvcCBsZXZlbC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVwb0tleXMocmVwb1BhdGg6IHN0cmluZykge1xuICAgIGxldCBjb21iaW5lZFBhdGggPSBwYXRoLmpvaW4ocmVwb1BhdGgsIFwiYXV0aG9yaXplZF9rZXlzXCIpO1xuICAgIGxldCBlbnRyaWVzID0gYXdhaXQgZnMucmVhZGRpcihyZXBvUGF0aCk7XG4gICAgaWYgKGVudHJpZXMuaW5jbHVkZXMoXCJhdXRob3JpemVkX2tleXNcIikpIHtcbiAgICAgICAgcmV0dXJuIG5vcm1hbGl6ZUtleXMoYXdhaXQgZnMucmVhZEZpbGUoY29tYmluZWRQYXRoLCBcInV0ZjhcIikpO1xuICAgIH1cbiAgICBsZXQgcHViRmlsZXMgPSBlbnRyaWVzLmZpbHRlcihuYW1lID0+IG5hbWUuZW5kc1dpdGgoXCIucHViXCIpKS5zb3J0KCk7XG4gICAgaWYgKCFwdWJGaWxlcy5sZW5ndGgpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhdXRob3JpemVkX2tleXMgb3IgYXQgbGVhc3Qgb25lIC5wdWIgZmlsZSBpbiAke3JlcG9QYXRofSwgZm91bmQgbmVpdGhlcmApO1xuICAgIH1cbiAgICBsZXQga2V5czogc3RyaW5nW10gPSBbXTtcbiAgICBmb3IgKGxldCBuYW1lIG9mIHB1YkZpbGVzKSB7XG4gICAgICAgIGtleXMucHVzaCguLi5ub3JtYWxpemVLZXlzKGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihyZXBvUGF0aCwgbmFtZSksIFwidXRmOFwiKSkpO1xuICAgIH1cbiAgICByZXR1cm4ga2V5cztcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "a5147a2eb954468a9ddfcac36189a744f5b17f944d7e837ce0a525c780093a26"; */

package/security/authorizedKeys/dist/revokeSource.ts.cache

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.deriveRevokeKey = exports.revokeRepoPath = exports.revokeKeyPath = exports.revokeRepoURL = exports.REVOKE_KEY_LABEL = void 0;
+const deriveKey_1 = require("../keys/deriveKey");
+const sshKeyFile_1 = require("../keys/sshKeyFile");
+const sources_1 = require("./sources");
+// A source's revocations live in a repo beside it. Derived rather than configured, so adding a
+// source brings its revoke repo with it and there is nothing extra to pass on the command line.
+const REVOKED_SUFFIX = "_revoked";
+// GitHub will not take the same public key as a deploy key on two repos, so the revoke repo is
+// reached with a key derived from the source's, under this label.
+exports.REVOKE_KEY_LABEL = "revokegithubkey";
+function revokeRepoURL(sourceURL) {
+    let withoutGit = sourceURL.replace(/\.git$/, "");
+    return `${withoutGit}${REVOKED_SUFFIX}.git`;
+}
+exports.revokeRepoURL = revokeRepoURL;
+function revokeKeyPath(sourceURL) {
+    return `${sources_1.REPO_KEYS_DIR}/${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`;
+}
+exports.revokeKeyPath = revokeKeyPath;
+function revokeRepoPath(sourceURL) {
+    return `${sources_1.REPOS_DIR}/${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`;
+}
+exports.revokeRepoPath = revokeRepoPath;
+/** The revoke repo's key, worked out from the source repo's key. Anything holding the source key
+    can produce it, so it never has to be stored anywhere separately or handed around. */
+function deriveRevokeKey(sourcePrivateKey) {
+    let source = (0, sshKeyFile_1.parseOpenSSHPrivateKey)(sourcePrivateKey);
+    let derived = (0, deriveKey_1.deriveEd25519Key)({ seed: source.seed, label: exports.REVOKE_KEY_LABEL });
+    return {
+        publicKey: `ssh-ed25519 ${Buffer.concat([
+            Buffer.from([0, 0, 0, 11]), Buffer.from("ssh-ed25519"),
+            Buffer.from([0, 0, 0, 32]), derived.publicKey,
+        ]).toString("base64")}`,
+        privateKeyFile: (0, sshKeyFile_1.formatOpenSSHPrivateKey)({
+            seed: derived.seed,
+            comment: `${source.comment || "portsecure"} ${exports.REVOKE_KEY_LABEL}`,
+        }),
+    };
+}
+exports.deriveRevokeKey = deriveRevokeKey;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlU291cmNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmV2b2tlU291cmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLGlEQUFxRDtBQUNyRCxtREFBcUY7QUFDckYsdUNBQWlFO0FBRWpFLCtGQUErRjtBQUMvRixnR0FBZ0c7QUFDaEcsTUFBTSxjQUFjLEdBQUcsVUFBVSxDQUFDO0FBQ2xDLCtGQUErRjtBQUMvRixrRUFBa0U7QUFDckQsUUFBQSxnQkFBZ0IsR0FBRyxpQkFBaUIsQ0FBQztBQUVsRCxTQUFnQixhQUFhLENBQUMsU0FBaUI7SUFDM0MsSUFBSSxVQUFVLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDakQsT0FBTyxHQUFHLFVBQVUsR0FBRyxjQUFjLE1BQU0sQ0FBQztBQUNoRCxDQUFDO0FBSEQsc0NBR0M7QUFFRCxTQUFnQixhQUFhLENBQUMsU0FBaUI7SUFDM0MsT0FBTyxHQUFHLHVCQUFhLElBQUksSUFBQSxvQkFBVSxFQUFDLFNBQVMsQ0FBQyxHQUFHLGNBQWMsRUFBRSxDQUFDO0FBQ3hFLENBQUM7QUFGRCxzQ0FFQztBQUVELFNBQWdCLGNBQWMsQ0FBQyxTQUFpQjtJQUM1QyxPQUFPLEdBQUcsbUJBQVMsSUFBSSxJQUFBLG9CQUFVLEVBQUMsU0FBUyxDQUFDLEdBQUcsY0FBYyxFQUFFLENBQUM7QUFDcEUsQ0FBQztBQUZELHdDQUVDO0FBRUQ7eUZBQ3lGO0FBQ3pGLFNBQWdCLGVBQWUsQ0FBQyxnQkFBd0I7SUFDcEQsSUFBSSxNQUFNLEdBQUcsSUFBQSxtQ0FBc0IsRUFBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3RELElBQUksT0FBTyxHQUFHLElBQUEsNEJBQWdCLEVBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsd0JBQWdCLEVBQUUsQ0FBQyxDQUFDO0lBQy9FLE9BQU87UUFDSCxTQUFTLEVBQUUsZUFBZSxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQ3BDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO1lBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1NBQ2hELENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFDdkIsY0FBYyxFQUFFLElBQUEsb0NBQXVCLEVBQUM7WUFDcEMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ2xCLE9BQU8sRUFBRSxHQUFHLE1BQU0sQ0FBQyxPQUFPLElBQUksWUFBWSxJQUFJLHdCQUFnQixFQUFFO1NBQ25FLENBQUM7S0FDTCxDQUFDO0FBQ04sQ0FBQztBQWJELDBDQWFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZGVyaXZlRWQyNTUxOUtleSB9IGZyb20gXCIuLi9rZXlzL2Rlcml2ZUtleVwiO1xuaW1wb3J0IHsgZm9ybWF0T3BlblNTSFByaXZhdGVLZXksIHBhcnNlT3BlblNTSFByaXZhdGVLZXkgfSBmcm9tIFwiLi4va2V5cy9zc2hLZXlGaWxlXCI7XG5pbXBvcnQgeyBSRVBPX0tFWVNfRElSLCBSRVBPU19ESVIsIHNvdXJjZU5hbWUgfSBmcm9tIFwiLi9zb3VyY2VzXCI7XG5cbi8vIEEgc291cmNlJ3MgcmV2b2NhdGlvbnMgbGl2ZSBpbiBhIHJlcG8gYmVzaWRlIGl0LiBEZXJpdmVkIHJhdGhlciB0aGFuIGNvbmZpZ3VyZWQsIHNvIGFkZGluZyBhXG4vLyBzb3VyY2UgYnJpbmdzIGl0cyByZXZva2UgcmVwbyB3aXRoIGl0IGFuZCB0aGVyZSBpcyBub3RoaW5nIGV4dHJhIHRvIHBhc3Mgb24gdGhlIGNvbW1hbmQgbGluZS5cbmNvbnN0IFJFVk9LRURfU1VGRklYID0gXCJfcmV2b2tlZFwiO1xuLy8gR2l0SHViIHdpbGwgbm90IHRha2UgdGhlIHNhbWUgcHVibGljIGtleSBhcyBhIGRlcGxveSBrZXkgb24gdHdvIHJlcG9zLCBzbyB0aGUgcmV2b2tlIHJlcG8gaXNcbi8vIHJlYWNoZWQgd2l0aCBhIGtleSBkZXJpdmVkIGZyb20gdGhlIHNvdXJjZSdzLCB1bmRlciB0aGlzIGxhYmVsLlxuZXhwb3J0IGNvbnN0IFJFVk9LRV9LRVlfTEFCRUwgPSBcInJldm9rZWdpdGh1YmtleVwiO1xuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlUmVwb1VSTChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIGxldCB3aXRob3V0R2l0ID0gc291cmNlVVJMLnJlcGxhY2UoL1xcLmdpdCQvLCBcIlwiKTtcbiAgICByZXR1cm4gYCR7d2l0aG91dEdpdH0ke1JFVk9LRURfU1VGRklYfS5naXRgO1xufVxuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlS2V5UGF0aChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPX0tFWVNfRElSfS8ke3NvdXJjZU5hbWUoc291cmNlVVJMKX0ke1JFVk9LRURfU1VGRklYfWA7XG59XG5cbmV4cG9ydCBmdW5jdGlvbiByZXZva2VSZXBvUGF0aChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPU19ESVJ9LyR7c291cmNlTmFtZShzb3VyY2VVUkwpfSR7UkVWT0tFRF9TVUZGSVh9YDtcbn1cblxuLyoqIFRoZSByZXZva2UgcmVwbydzIGtleSwgd29ya2VkIG91dCBmcm9tIHRoZSBzb3VyY2UgcmVwbydzIGtleS4gQW55dGhpbmcgaG9sZGluZyB0aGUgc291cmNlIGtleVxuICAgIGNhbiBwcm9kdWNlIGl0LCBzbyBpdCBuZXZlciBoYXMgdG8gYmUgc3RvcmVkIGFueXdoZXJlIHNlcGFyYXRlbHkgb3IgaGFuZGVkIGFyb3VuZC4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkZXJpdmVSZXZva2VLZXkoc291cmNlUHJpdmF0ZUtleTogc3RyaW5nKSB7XG4gICAgbGV0IHNvdXJjZSA9IHBhcnNlT3BlblNTSFByaXZhdGVLZXkoc291cmNlUHJpdmF0ZUtleSk7XG4gICAgbGV0IGRlcml2ZWQgPSBkZXJpdmVFZDI1NTE5S2V5KHsgc2VlZDogc291cmNlLnNlZWQsIGxhYmVsOiBSRVZPS0VfS0VZX0xBQkVMIH0pO1xuICAgIHJldHVybiB7XG4gICAgICAgIHB1YmxpY0tleTogYHNzaC1lZDI1NTE5ICR7QnVmZmVyLmNvbmNhdChbXG4gICAgICAgICAgICBCdWZmZXIuZnJvbShbMCwgMCwgMCwgMTFdKSwgQnVmZmVyLmZyb20oXCJzc2gtZWQyNTUxOVwiKSxcbiAgICAgICAgICAgIEJ1ZmZlci5mcm9tKFswLCAwLCAwLCAzMl0pLCBkZXJpdmVkLnB1YmxpY0tleSxcbiAgICAgICAgXSkudG9TdHJpbmcoXCJiYXNlNjRcIil9YCxcbiAgICAgICAgcHJpdmF0ZUtleUZpbGU6IGZvcm1hdE9wZW5TU0hQcml2YXRlS2V5KHtcbiAgICAgICAgICAgIHNlZWQ6IGRlcml2ZWQuc2VlZCxcbiAgICAgICAgICAgIGNvbW1lbnQ6IGAke3NvdXJjZS5jb21tZW50IHx8IFwicG9ydHNlY3VyZVwifSAke1JFVk9LRV9LRVlfTEFCRUx9YCxcbiAgICAgICAgfSksXG4gICAgfTtcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "9f16cd6aea6e1f1a646eda715ac4cac70dc67579ce23c1e473bd371b7985b229"; */