sliftutils 1.7.125 → 1.7.127

package/security/authorizedKeys/secureSSH.ts

@@ -4,24 +4,34 @@ import path from "path";
 import { DEFAULT_WEBHOOK_FILE_PATH, parseWebhookFile } from "../notifications/discord";
 import { normalizeKeys, readRepoKeys, summarizeKey } from "./authorizedKeys";
 import { sourceKeyPath, sourceRepoPath } from "./sources";
+import { deriveRevokeKey, REVOKE_KEY_LABEL, revokeRepoURL } from "./revokeSource";
+import { revokedKeysInRepo } from "./unrevoke";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
-import { readRemoteFile, remoteCommandExists, runOverSSH, SUDO_PREAMBLE, writeRemoteFile } from "../helpers/remoteSSH";
+import { describeHost, readRemoteFile, remoteCommandExists, runOverSSH, SUDO_PREAMBLE, THIS_MACHINE, writeRemoteFile } from "../helpers/remoteSSH";
 
-const DAEMON_SOURCE = path.join(__dirname, "daemon", "portsecureDaemon.js");
 const SERVICE_SOURCE = path.join(__dirname, "daemon", "portsecure.service");
-const REMOTE_DAEMON_PATH = "/opt/portsecure/portsecure-daemon.js";
+// The daemon runs from a checkout of this repo on the host, rather than from a copy we upload, so
+// a host updates itself from github the same way anything else does. sliftutils is public, so this
+// needs no key.
+const SLIFTUTILS_URL = "https://github.com/sliftist/sliftutils.git";
+const REMOTE_CHECKOUT_PATH = "/opt/portsecure/sliftutils";
 const REMOTE_SERVICE_PATH = "/etc/systemd/system/portsecure.service";
 const REMOTE_CONFIG_PATH = "/etc/portsecure/daemon.json";
 const ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
 const SERVICE_NAME = "portsecure";
 const MAX_ERROR_BODY_LENGTH = 500;
-const VERBS = ["add", "remove", "list"];
-// The repo url is optional, and defaults to the repo the command is run from.
+const VERBS = ["add", "remove", "list", "update"];
+// The host is optional, and without one everything happens on this machine. The repo url is
+// optional too, and defaults to the repo the command is run from.
 const USAGE = `Usage:
-  yarn securessh <host> add <repo-private-key> [repo-url]
-  yarn securessh <host> remove [repo-url]
-  yarn securessh <host> list`;
+  yarn securessh [host] add <repo-private-key> [repo-url]
+  yarn securessh [host] remove [repo-url]
+  yarn securessh [host] list
+  yarn securessh [host] update
+
+With no host it acts on this machine, and still installs from github rather than from wherever
+this was run.`;
 
 async function pathExists(filePath: string) {
     try {
@@ -41,7 +51,7 @@ async function runLocal(config: { command: string; args: string[]; cwd?: string;
     if (result.status !== 0 && !allowFailure) {
         throw new Error(
             `Expected ${command} ${args.join(" ")} to exit 0, was ${result.status}. `
-            + `${(result.stderr || "").slice(0, MAX_ERROR_BODY_LENGTH)}`
+            + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
         );
     }
     return result;
@@ -69,7 +79,7 @@ async function gitWithKey(config: { keyPath: string; args: string[]; cwd?: strin
     if (result.status !== 0 && !allowFailure) {
         throw new Error(
             `Expected git ${args.join(" ")} to exit 0, was ${result.status}. `
-            + `${(result.stderr || "").slice(0, MAX_ERROR_BODY_LENGTH)}`
+            + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
         );
     }
     return result;
@@ -158,6 +168,118 @@ async function resolveRepoURL(passedURL: string | undefined) {
     return repoURL;
 }
 
+/** Every source's revoke repo has to exist and hold at least one commit, or the hosts using it
+    cannot record a revocation. Checked with this machine's own git credentials, since update is
+    not given any deploy key, and an empty repo is initialised rather than merely complained about.
+
+    A host that cannot write a revocation silently keeps accepting a key it just saw being misused,
+    which is the one failure this whole thing exists to prevent, so it is checked on every deploy
+    and not only when a source is first added. */
+async function ensureRevokeReposExist(repoSources: string[]) {
+    for (let repoURL of repoSources) {
+        let revokeURL = revokeRepoURL(repoURL);
+        let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "portsecure-revoke-"));
+        let checkoutPath = path.join(temporaryDirectory, "repo");
+        // On a machine that is already a portsecure host, the source's deploy key is right there,
+        // and the key derived from it is the one credential that repo is guaranteed to accept.
+        // Anywhere else, a person is running this and has their own access.
+        let ownKey = "";
+        if (await pathExists(sourceKeyPath(repoURL))) {
+            let derived = deriveRevokeKey(await fs.readFile(sourceKeyPath(repoURL), "utf8"));
+            ownKey = path.join(temporaryDirectory, "key");
+            await fs.writeFile(ownKey, derived.privateKeyFile, { mode: 0o600 });
+        }
+        let cloneRevoke = async (allowFailure: boolean) => ownKey
+            && await gitWithKey({ keyPath: ownKey, args: ["clone", revokeURL, checkoutPath], allowFailure })
+            || await runLocal({ command: "git", args: ["clone", revokeURL, checkoutPath], allowFailure });
+        let clone = await cloneRevoke(true);
+        if (clone.status !== 0) {
+            await fs.rm(temporaryDirectory, { recursive: true, force: true });
+            throw new Error(
+                `Expected ${revokeURL} to exist, it does not, so ${repoURL} has nowhere to record a`
+                + ` revocation.\nCreate it, then run "yarn securessh <host> add" for that source to`
+                + ` register its deploy key.\n${(clone.stdout + clone.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
+            );
+        }
+        let head = await runLocal({ command: "git", args: ["-C", checkoutPath, "rev-parse", "HEAD"], allowFailure: true });
+        if (head.status !== 0) {
+            console.log(`${revokeURL} is empty, giving it a first commit`);
+            await fs.writeFile(path.join(checkoutPath, "README.md"),
+                `# revoked keys\n\nWritten by portsecure. Each file under revocations/ is one key that was used from an\n`
+                + `address it is not allowed from, and is no longer accepted anywhere.\n`);
+            for (let args of [
+                ["-C", checkoutPath, "add", "-A"],
+                ["-C", checkoutPath, "-c", "user.email=portsecure@localhost", "-c", "user.name=portsecure", "commit", "-m", "initialise revoke repo"],
+            ]) {
+                await runLocal({ command: "git", args });
+            }
+            let push = ["-C", checkoutPath, "push", "origin", "HEAD"];
+            if (ownKey) {
+                await gitWithKey({ keyPath: ownKey, args: push });
+            } else {
+                await runLocal({ command: "git", args: push });
+            }
+        }
+        await fs.rm(temporaryDirectory, { recursive: true, force: true });
+        console.log(`${revokeURL} is ready`);
+    }
+}
+
+/** The revoke repo has to exist and be writable before a host is set up, because a host that
+    cannot write a revocation cannot revoke a key that is being misused. The key for it is derived
+    from the source's, since github will not take one public key on two repos. */
+async function ensureRevokeRepo(config: { keyPath: string; repoURL: string }) {
+    let { keyPath, repoURL } = config;
+    let revokeURL = revokeRepoURL(repoURL);
+    let derived = deriveRevokeKey(await fs.readFile(keyPath, "utf8"));
+
+    let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "portsecure-revoke-"));
+    let derivedKeyPath = path.join(temporaryDirectory, "key");
+    await fs.writeFile(derivedKeyPath, derived.privateKeyFile, { mode: 0o600 });
+    let checkoutPath = path.join(temporaryDirectory, "repo");
+
+    let explain = (problem: string) => new Error(
+        `${problem}\n`
+        + `Create ${revokeURL} and add this as a deploy key WITH WRITE ACCESS:\n`
+        + `  ${derived.publicKey} ${REVOKE_KEY_LABEL}\n`
+        + `It has to be this key: it is derived from ${keyPath}, and github will not accept the same`
+        + ` public key on two repositories.`
+    );
+
+    console.log(`Checking ${revokeURL}`);
+    let clone = await gitWithKey({ keyPath: derivedKeyPath, args: ["clone", revokeURL, checkoutPath], allowFailure: true });
+    if (clone.status !== 0) {
+        throw explain(`Expected ${revokeURL} to be readable with the derived key, it is not.`);
+    }
+
+    // An empty repo has no branch for the daemon to clone, so it gets its first commit here. That
+    // doubles as the proof that we can write to it.
+    let head = await gitWithKey({ keyPath: derivedKeyPath, args: ["rev-parse", "HEAD"], cwd: checkoutPath, allowFailure: true });
+    if (head.status !== 0) {
+        await fs.writeFile(path.join(checkoutPath, "README.md"),
+            `# revoked keys\n\nWritten by portsecure. Each file under revocations/ is one key that was used from an\n`
+            + `address it is not allowed from, and is no longer accepted anywhere.\n`);
+        for (let args of [
+            ["add", "-A"],
+            ["-c", "user.email=portsecure@localhost", "-c", "user.name=portsecure", "commit", "-m", "initialise revoke repo"],
+        ]) {
+            await gitWithKey({ keyPath: derivedKeyPath, args, cwd: checkoutPath });
+        }
+        let push = await gitWithKey({ keyPath: derivedKeyPath, args: ["push", "origin", "HEAD"], cwd: checkoutPath, allowFailure: true });
+        if (push.status !== 0) {
+            throw explain(`Expected write access to ${revokeURL}, the first push was refused.\n${(push.stdout + push.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`);
+        }
+    } else {
+        let dryRun = await gitWithKey({ keyPath: derivedKeyPath, args: ["push", "--dry-run", "origin", "HEAD"], cwd: checkoutPath, allowFailure: true });
+        if (dryRun.status !== 0) {
+            throw explain(`Expected write access to ${revokeURL}, a dry run push was refused.\n${(dryRun.stdout + dryRun.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`);
+        }
+    }
+
+    await fs.rm(temporaryDirectory, { recursive: true, force: true });
+    console.log(`${revokeURL} is writable`);
+}
+
 async function readRemoteConfig(host: string) {
     let contents = await readRemoteFile({ host, filePath: REMOTE_CONFIG_PATH });
     if (!contents) {
@@ -187,11 +309,41 @@ fi`,
 
 async function installDaemon(config: { host: string; hostLabel: string; repoSources: string[] }) {
     let { host, hostLabel, repoSources } = config;
-    for (let command of ["node", "git"]) {
+    for (let command of ["node", "git", "yarn"]) {
         if (!await remoteCommandExists({ host, command })) {
             throw new Error(`Expected ${command} to be installed on ${host}, it is not. Install it and rerun.`);
         }
     }
+
+    // The checkout is brought to the latest commit rather than a copy being pushed, so what runs on
+    // the host is exactly what is on github.
+    console.log(`Updating ${REMOTE_CHECKOUT_PATH} on ${describeHost(host)}`);
+    await runOverSSH({
+        host,
+        script: `${SUDO_PREAMBLE}
+set -e
+$SUDO mkdir -p "${path.posix.dirname(REMOTE_CHECKOUT_PATH)}"
+if $SUDO test -d "${REMOTE_CHECKOUT_PATH}/.git"; then
+    # Stashed first, the way machine-alwaysup does it. Anything sitting modified in a host's
+    # checkout is either an accident or somebody editing the daemon in place, and either way it is
+    # worth keeping rather than quietly erasing. The identity is passed inline because a host has
+    # no git config of its own and stash writes a commit.
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" add --all
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" -c user.email=portsecure@localhost -c user.name=portsecure stash
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" fetch --prune origin
+    # A stash and a pull cannot cross a branch that has diverged, and a drifted checkout must not be
+    # able to leave a host running old code, so it is put on the remote's state rather than merged
+    # with it. set-head so that is the remote's default branch now, not the one it had at clone.
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" remote set-head origin --auto
+    $SUDO git -C "${REMOTE_CHECKOUT_PATH}" reset --hard origin/HEAD
+else
+    $SUDO rm -rf "${REMOTE_CHECKOUT_PATH}"
+    $SUDO git clone "${SLIFTUTILS_URL}" "${REMOTE_CHECKOUT_PATH}"
+fi
+$SUDO yarn --cwd "${REMOTE_CHECKOUT_PATH}" install --production --non-interactive
+# The single file daemon this replaced, left over on a host set up by an older version.
+$SUDO rm -f /opt/portsecure/portsecure-daemon.js`,
+    });
     await writeRemoteFile({
         host,
         filePath: REMOTE_CONFIG_PATH,
@@ -201,13 +353,6 @@ async function installDaemon(config: { host: string; hostLabel: string; repoSour
         fileMode: "600",
         directoryMode: "700",
     });
-    await writeRemoteFile({
-        host,
-        filePath: REMOTE_DAEMON_PATH,
-        contents: await fs.readFile(DAEMON_SOURCE, "utf8"),
-        fileMode: "755",
-        directoryMode: "755",
-    });
     await writeRemoteFile({
         host,
         filePath: REMOTE_SERVICE_PATH,
@@ -254,7 +399,7 @@ async function requireRemoteWebhook(host: string) {
         throw new Error(
             `Expected a Discord webhook at ${DEFAULT_WEBHOOK_FILE_PATH} on ${host}, no such file exists.`
             + ` The daemon will not start without one.\n`
-            + `Set it up first:\n  yarn setupnotify ${host} <discord-webhook-url>`
+            + `Set it up first:\n  yarn setupnotify ${host} <discord-webhook-url>`.replace(" <discord", host && " <discord" || "<discord")
         );
     }
     return parseWebhookFile({ contents, sourceName: `${host}:${DEFAULT_WEBHOOK_FILE_PATH}` });
@@ -271,24 +416,29 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
     if (reachable.status !== 0) {
         throw new Error(
             `Expected ${repoURL} to be reachable with ${keyPath}, git ls-remote failed.`
-            + ` The daemon would have no way to fetch keys.\n${reachable.stderr.slice(0, MAX_ERROR_BODY_LENGTH)}`
+            + ` The daemon would have no way to fetch keys.\n`
+            + `${(reachable.stdout + reachable.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
         );
     }
 
     let remoteConfig = await readRemoteConfig(host);
     if (remoteConfig.repoSources.includes(repoURL)) {
-        console.log(`${host} already has ${repoURL}, refreshing its key and the daemon.`);
+        console.log(`${describeHost(host)} already has ${repoURL}, refreshing its key and the daemon.`);
     }
 
-    // The merged result is what root ends up with, so our own key has to be somewhere in it.
-    console.log(`Checking our access to ${host} survives the merged keys`);
-    let ourFingerprint = await findAuthenticatingFingerprint(host);
+    // The merged result is what root ends up with, so our own key has to be somewhere in it. On
+    // this machine there is no ssh session to preserve, so there is nothing to check.
+    let ourFingerprint = "";
+    if (host) {
+        console.log(`Checking our access to ${describeHost(host)} survives the merged keys`);
+        ourFingerprint = await findAuthenticatingFingerprint(host);
+    }
     let inspectionPath = await cloneRepoForInspection({ repoURL, keyPath });
     let newKeys = await readRepoKeys(inspectionPath);
     // Whatever is applied on the host came from the existing sources, so it stays in the merge.
     let existingKeys = normalizeKeys(await readRemoteFile({ host, filePath: ROOT_AUTHORIZED_KEYS }) || "");
     let mergedFingerprints = await fingerprintKeys([...existingKeys, ...newKeys]);
-    if (!mergedFingerprints.includes(ourFingerprint)) {
+    if (ourFingerprint && !mergedFingerprints.includes(ourFingerprint)) {
         throw new Error(
             `Expected the key we use for ${host} to be in the merged keys, it is not.\n`
             + `Ours:   ${ourFingerprint}\n`
@@ -297,10 +447,25 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
             + ` lock you out of ${host}. Add your public key to ${repoURL} first.`
         );
     }
-    console.log(`Our key ${ourFingerprint} is in the merged keys, access will survive.`);
+    if (ourFingerprint) {
+        console.log(`Our key ${ourFingerprint} is in the merged keys, access will survive.`);
+    }
+
+    await ensureRevokeRepo({ keyPath, repoURL });
+
+    // Deploying a repo that still holds a revoked key would hand it back to every machine.
+    let revoked = await revokedKeysInRepo({ repoPath: inspectionPath, sourceURL: repoURL });
+    if (revoked.length) {
+        throw new Error(
+            `Expected ${repoURL} to hold no revoked keys, it holds ${revoked.length}:\n`
+            + revoked.map(entry => `  ${entry.revocation.fingerprint} revoked by`
+                + ` ${entry.revocation.revokedBy || "?"} after use from ${entry.revocation.attempt?.ip || "?"}`).join("\n")
+            + `\nDelete them from the repo, or run "yarn unrevoke" there to allow them again.`
+        );
+    }
 
     let webhookURL = await requireRemoteWebhook(host);
-    console.log(`${host} notifies ${webhookURL}`);
+    console.log(`${describeHost(host)} notifies ${webhookURL}`);
 
     await writeRemoteFile({
         host,
@@ -313,7 +478,7 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
     let repoSources = remoteConfig.repoSources.filter(source => source !== repoURL);
     repoSources.push(repoURL);
     await installDaemon({ host, hostLabel: remoteConfig.hostLabel, repoSources });
-    console.log(`${repoURL} added to ${host}. ${repoSources.length} source(s) now merged.`);
+    console.log(`${repoURL} added to ${describeHost(host)}. ${repoSources.length} source(s) now merged.`);
 }
 
 async function removeSource(config: { host: string; repoURL: string }) {
@@ -327,9 +492,10 @@ async function removeSource(config: { host: string; repoURL: string }) {
     }
     let repoSources = remoteConfig.repoSources.filter(source => source !== repoURL);
 
-    if (repoSources.length) {
+    // On this machine there is no ssh session to preserve, so there is nothing to check.
+    if (repoSources.length && host) {
         // The keys left over are what root gets, so our own key has to be among them.
-        console.log(`Checking our access to ${host} survives without ${repoURL}`);
+        console.log(`Checking our access to ${describeHost(host)} survives without ${repoURL}`);
         let ourFingerprint = await findAuthenticatingFingerprint(host);
         let remainingKeys: string[] = [];
         for (let source of repoSources) {
@@ -357,18 +523,42 @@ $SUDO rm -f "${sourceKeyPath(repoURL)}"
 $SUDO rm -rf "${sourceRepoPath(repoURL)}"`,
     });
     await installDaemon({ host, hostLabel: remoteConfig.hostLabel, repoSources });
-    console.log(`${repoURL} removed from ${host}. ${repoSources.length} source(s) left.`);
+    console.log(`${repoURL} removed from ${describeHost(host)}. ${repoSources.length} source(s) left.`);
 }
 
 /** Answers "who can log into this box, and which repo says so". The paths the daemon uses are
     left out on purpose, they are plumbing rather than something to act on. */
+
+/** Pushes the current daemon onto a host that already has one, for when this code has moved on.
+    Nothing about which keys the host trusts is touched. */
+async function updateDaemon(host: string) {
+    let contents = await readRemoteFile({ host, filePath: REMOTE_CONFIG_PATH });
+    if (!contents) {
+        throw new Error(
+            `Expected ${host} to already have portsecure, ${REMOTE_CONFIG_PATH} does not exist.\n`
+            + `Set it up with:\n  yarn securessh ${host} add <repo-private-key> [repo-url]`
+        );
+    }
+    let parsed = JSON.parse(contents) as { hostLabel?: string; repoSources?: string[] };
+    let repoSources = parsed.repoSources || [];
+    await requireRemoteWebhook(host);
+    await ensureRevokeReposExist(repoSources);
+    await installDaemon({ host, hostLabel: parsed.hostLabel || host, repoSources });
+    console.log(`Updated the daemon on ${describeHost(host)}, and restarted it.`);
+    console.log(`Its ${repoSources.length} key source(s) were left as they are, along with the keys and`);
+    console.log(`signers it has already accepted. Only the daemon itself changed:`);
+    for (let repoURL of repoSources) {
+        console.log(`  ${repoURL}`);
+    }
+}
+
 async function listSources(host: string) {
     let remoteConfig = await readRemoteConfig(host);
     if (!remoteConfig.repoSources.length) {
-        console.log(`${host} has no key sources. root's authorized_keys is left exactly as it is.`);
+        console.log(`${describeHost(host)} has no key sources. root's authorized_keys is left exactly as it is.`);
         return;
     }
-    console.log(`${host} lets root log in with the keys from ${remoteConfig.repoSources.length} repo(s):`);
+    console.log(`${describeHost(host)} lets root log in with the keys from ${remoteConfig.repoSources.length} repo(s):`);
     let merged = new Set<string>();
     for (let repoURL of remoteConfig.repoSources) {
         let keys = await readRemoteSourceKeys({ host, repoURL });
@@ -399,11 +589,16 @@ function parseArgs(argv: string[]) {
         throw new Error(`Expected one of ${VERBS.join(", ")}, was ${verbs.join(" and ")}\n${USAGE}`);
     }
     let verb = verbs[0];
-    let [host, ...rest] = argv.filter(arg => arg !== verb);
-    if (!host) {
-        throw new Error(`Expected a host, was nothing\n${USAGE}`);
-    }
-    return { verb, host, rest };
+    let positional = argv.filter(arg => arg !== verb);
+    // A host, when there is one, comes first and is a bare name or address. Everything else that
+    // can appear here is a path or a repo url, and those all carry a slash, which is what tells
+    // them apart. So no host at all means this machine.
+    let host = THIS_MACHINE;
+    if (positional.length && !/[\/~\\]/.test(positional[0])) {
+        host = positional[0];
+        positional = positional.slice(1);
+    }
+    return { verb, host, rest: positional };
 }
 
 export async function main() {
@@ -413,6 +608,13 @@ export async function main() {
         await listSources(host);
         return;
     }
+    if (verb === "update") {
+        if (rest.length) {
+            throw new Error(`Expected nothing after update, was ${rest.length} argument(s)\n${USAGE}`);
+        }
+        await updateDaemon(host);
+        return;
+    }
     if (verb === "add") {
         if (!rest.length || rest.length > 2) {
             throw new Error(`Expected a private key and optionally a repo url, was ${rest.length} argument(s)\n${USAGE}`);

package/security/authorizedKeys/unrevoke.ts

@@ -0,0 +1,175 @@
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
+import { runPromise } from "socket-function/src/runPromise";
+import { keyFingerprint, normalizeKeys } from "./authorizedKeys";
+import { revokeRepoURL } from "./revokeSource";
+import { signRepo } from "../signedFiles/signFiles";
+import { readRepoKeys } from "./authorizedKeys";
+import { expandHome } from "../helpers/paths";
+import { spawnPromise } from "../helpers/spawn";
+
+const UNREVOKES_DIR = "unrevoked";
+const REVOCATIONS_DIR = "revocations";
+const GIT_KEYWORD = "git";
+const COMMIT_MESSAGE = "unrevoke keys";
+const USAGE = `Usage: yarn unrevoke [keys-repo] [${GIT_KEYWORD}]
+
+Run this in a keys repo, or name one. It reads that repo's revoke repo and writes one unrevoke file
+naming every revocation in it, so the keys are accepted again once each machine's hour long wait
+passes. It signs the result, and with ${GIT_KEYWORD} it commits and pushes it too.
+
+Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
+for a key you still want.`;
+
+export type Revocation = {
+    revocationId: string;
+    fingerprint: string;
+    key?: string;
+    revokedAt?: string;
+    revokedBy?: string;
+    attempt?: { ip?: string; user?: string; required?: string };
+};
+
+/** Every revocation the revoke repo lists. Cloned read only into a temp directory, with whatever
+    credentials this machine already has - the derived deploy key is for servers, and a person
+    running this has their own access to the repo. */
+export async function readRemoteRevocations(config: { sourceURL: string }) {
+    let { sourceURL } = config;
+    let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "unrevoke-"));
+    let repoPath = path.join(temporaryDirectory, "repo");
+    let clone = await spawnPromise({
+        command: "git",
+        args: ["clone", "--depth", "1", revokeRepoURL(sourceURL), repoPath],
+    });
+    if (clone.status !== 0) {
+        await fs.rm(temporaryDirectory, { recursive: true, force: true });
+        throw new Error(
+            `Expected to be able to read ${revokeRepoURL(sourceURL)}.\n`
+            + `${(clone.stdout + clone.stderr).trim()}`
+        );
+    }
+    let revocations: Revocation[] = [];
+    let directory = path.join(repoPath, REVOCATIONS_DIR);
+    try {
+        for (let name of (await fs.readdir(directory)).sort()) {
+            if (name.endsWith(".json")) {
+                revocations.push(JSON.parse(await fs.readFile(path.join(directory, name), "utf8")));
+            }
+        }
+    } catch (e) {
+        // No revocations directory at all just means nothing has ever been revoked.
+    }
+    await fs.rm(temporaryDirectory, { recursive: true, force: true });
+    return revocations;
+}
+
+/** Which keys in a repo are revoked. What signfiles and securessh refuse over. */
+export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: string }) {
+    let { repoPath, sourceURL } = config;
+    let revocations = await readRemoteRevocations({ sourceURL });
+    let revokedFingerprints = new Set(revocations.map(revocation => revocation.fingerprint));
+    let unrevoked = new Set<string>();
+    try {
+        let directory = path.join(repoPath, UNREVOKES_DIR);
+        for (let name of await fs.readdir(directory)) {
+            if (!name.endsWith(".json")) {
+                continue;
+            }
+            let parsed = JSON.parse(await fs.readFile(path.join(directory, name), "utf8"));
+            for (let revocationId of parsed.revocationIds || []) {
+                unrevoked.add(revocationId);
+            }
+        }
+    } catch (e) {
+        // Nothing has been unrevoked.
+    }
+    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId));
+    let keys = normalizeKeys(await fs.readFile(path.join(repoPath, "authorized_keys"), "utf8").catch(() => ""));
+    return stillRevoked
+        .filter(revocation => keys.some(key => keyFingerprint(key) === revocation.fingerprint))
+        .map(revocation => ({ revocation, key: keys.find(key => keyFingerprint(key) === revocation.fingerprint) || "" }));
+}
+
+/** The repo named, or the one we are standing in. Checked the same way securessh checks it: a git
+    repo that actually holds keys and has an origin to clone from. */
+async function resolveKeysRepo(named: string | undefined) {
+    let cwd = named && expandHome(named) || undefined;
+    // spawnPromise rather than runPromise, because these two are read for their value. runPromise
+    // returns stdout and stderr joined, so one git warning ends up glued to the front of the path.
+    let topLevel = await spawnPromise({ command: "git", args: ["rev-parse", "--show-toplevel"], cwd });
+    let repoPath = topLevel.stdout.trim();
+    if (topLevel.status !== 0 || !repoPath) {
+        throw new Error(
+            `Expected ${named || "the current directory"} to be inside a git repo, it is not.\n`
+            + `${(topLevel.stdout + topLevel.stderr).trim()}\n${USAGE}`
+        );
+    }
+    try {
+        await readRepoKeys(repoPath);
+    } catch (e) {
+        throw new Error(`Expected ${repoPath} to be a keys repo, it holds no keys.\n${e}\n${USAGE}`);
+    }
+    let origin = await spawnPromise({ command: "git", args: ["remote", "get-url", "origin"], cwd: repoPath });
+    let originURL = origin.stdout.trim();
+    if (origin.status !== 0 || !originURL) {
+        throw new Error(`Expected ${repoPath} to have an origin remote, it has none.\n${USAGE}`);
+    }
+    return { repoPath, originURL };
+}
+
+export async function main() {
+    let argv = process.argv.slice(2);
+    let pushToGit = argv.includes(GIT_KEYWORD);
+    let positional = argv.filter(arg => arg !== GIT_KEYWORD);
+    if (positional.length > 1) {
+        throw new Error(`Expected at most a keys repo, was ${positional.length} argument(s)\n${USAGE}`);
+    }
+    let { repoPath, originURL } = await resolveKeysRepo(positional[0]);
+
+    let revocations = await readRemoteRevocations({ sourceURL: originURL });
+    if (!revocations.length) {
+        console.log(`${revokeRepoURL(originURL)} lists no revocations, so there is nothing to undo.`);
+        return;
+    }
+
+    let directory = path.join(repoPath, UNREVOKES_DIR);
+    await fs.mkdir(directory, { recursive: true });
+    let stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    let unrevokeId = `${stamp}-unrevoke`;
+    await fs.writeFile(path.join(directory, `${unrevokeId}.json`), JSON.stringify({
+        unrevokeId,
+        createdAt: new Date().toISOString(),
+        // Named one by one rather than as a blanket "allow everything again", so this file only
+        // ever undoes the revocations that existed when it was written.
+        revocationIds: revocations.map(revocation => revocation.revocationId),
+        revocations: revocations.map(revocation => ({
+            revocationId: revocation.revocationId,
+            fingerprint: revocation.fingerprint,
+            revokedAt: revocation.revokedAt,
+            revokedBy: revocation.revokedBy,
+            attempt: revocation.attempt,
+        })),
+    }, undefined, 4) + "\n");
+
+    console.log(`Wrote ${UNREVOKES_DIR}/${unrevokeId}.json covering ${revocations.length} revocation(s):`);
+    for (let revocation of revocations) {
+        console.log(`  ${revocation.fingerprint} revoked by ${revocation.revokedBy || "?"} from ${revocation.attempt?.ip || "?"}`);
+    }
+
+    // Signed here rather than left as a step to remember. An unrevoke nobody signed does nothing at
+    // all, and the repo would sit there looking done while every machine ignored it.
+    await signRepo({ repoPath });
+
+    if (!pushToGit) {
+        console.log(`\nCommit and push it, and each machine will wait an hour after seeing it before`);
+        console.log(`those keys work again:`);
+        console.log(`\`\`\`\ngit add -A\ngit commit -m "${COMMIT_MESSAGE}"\ngit push\n\`\`\``);
+        return;
+    }
+    await runPromise(`git add -A`, { cwd: repoPath });
+    await runPromise(`git commit -m "${COMMIT_MESSAGE}"`, { cwd: repoPath });
+    await runPromise(`git push`, { cwd: repoPath });
+    console.log(`\nCommitted and pushed. Each machine waits an hour after seeing it before those`);
+    console.log(`keys work again.`);
+}

package/security/helpers/dist/paths.ts.cache

@@ -0,0 +1,28 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.expandHome = void 0;
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+/** Windows shells do not expand ~ themselves, and hunting down your home folder by hand is
+    annoying, so we expand it on every platform. Both separators are accepted, because a Windows
+    user may type either one. */
+function expandHome(filePath) {
+    if (filePath === "~") {
+        return os_1.default.homedir();
+    }
+    if (filePath.startsWith("~/") || filePath.startsWith("~\\")) {
+        return path_1.default.join(os_1.default.homedir(), filePath.slice(2));
+    }
+    if (filePath.startsWith("~")) {
+        // ~otheruser needs an account database we cannot read portably, and quietly resolving it
+        // to the wrong home would be worse than refusing.
+        throw new Error(`Expected ~ or an ordinary path, was ${filePath}. Referring to another user's home with ~name is not supported.`);
+    }
+    return path_1.default.resolve(filePath);
+}
+exports.expandHome = expandHome;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGF0aHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwYXRocy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSw0Q0FBb0I7QUFDcEIsZ0RBQXdCO0FBRXhCOztnQ0FFZ0M7QUFDaEMsU0FBZ0IsVUFBVSxDQUFDLFFBQWdCO0lBQ3ZDLElBQUksUUFBUSxLQUFLLEdBQUcsRUFBRSxDQUFDO1FBQ25CLE9BQU8sWUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ3hCLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzFELE9BQU8sY0FBSSxDQUFDLElBQUksQ0FBQyxZQUFFLENBQUMsT0FBTyxFQUFFLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMzQix5RkFBeUY7UUFDekYsa0RBQWtEO1FBQ2xELE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLFFBQVEsaUVBQWlFLENBQUMsQ0FBQztJQUN0SSxDQUFDO0lBQ0QsT0FBTyxjQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2xDLENBQUM7QUFiRCxnQ0FhQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBvcyBmcm9tIFwib3NcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5cbi8qKiBXaW5kb3dzIHNoZWxscyBkbyBub3QgZXhwYW5kIH4gdGhlbXNlbHZlcywgYW5kIGh1bnRpbmcgZG93biB5b3VyIGhvbWUgZm9sZGVyIGJ5IGhhbmQgaXNcbiAgICBhbm5veWluZywgc28gd2UgZXhwYW5kIGl0IG9uIGV2ZXJ5IHBsYXRmb3JtLiBCb3RoIHNlcGFyYXRvcnMgYXJlIGFjY2VwdGVkLCBiZWNhdXNlIGEgV2luZG93c1xuICAgIHVzZXIgbWF5IHR5cGUgZWl0aGVyIG9uZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBleHBhbmRIb21lKGZpbGVQYXRoOiBzdHJpbmcpIHtcbiAgICBpZiAoZmlsZVBhdGggPT09IFwiflwiKSB7XG4gICAgICAgIHJldHVybiBvcy5ob21lZGlyKCk7XG4gICAgfVxuICAgIGlmIChmaWxlUGF0aC5zdGFydHNXaXRoKFwifi9cIikgfHwgZmlsZVBhdGguc3RhcnRzV2l0aChcIn5cXFxcXCIpKSB7XG4gICAgICAgIHJldHVybiBwYXRoLmpvaW4ob3MuaG9tZWRpcigpLCBmaWxlUGF0aC5zbGljZSgyKSk7XG4gICAgfVxuICAgIGlmIChmaWxlUGF0aC5zdGFydHNXaXRoKFwiflwiKSkge1xuICAgICAgICAvLyB+b3RoZXJ1c2VyIG5lZWRzIGFuIGFjY291bnQgZGF0YWJhc2Ugd2UgY2Fubm90IHJlYWQgcG9ydGFibHksIGFuZCBxdWlldGx5IHJlc29sdmluZyBpdFxuICAgICAgICAvLyB0byB0aGUgd3JvbmcgaG9tZSB3b3VsZCBiZSB3b3JzZSB0aGFuIHJlZnVzaW5nLlxuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIH4gb3IgYW4gb3JkaW5hcnkgcGF0aCwgd2FzICR7ZmlsZVBhdGh9LiBSZWZlcnJpbmcgdG8gYW5vdGhlciB1c2VyJ3MgaG9tZSB3aXRoIH5uYW1lIGlzIG5vdCBzdXBwb3J0ZWQuYCk7XG4gICAgfVxuICAgIHJldHVybiBwYXRoLnJlc29sdmUoZmlsZVBhdGgpO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "aa5698729d5def416d177e211ac514eed7d8c8fcb796c68dcc520ddf0d83526b"; */