sliftutils 1.7.127 → 1.7.129

package/security/authorizedKeys/daemon/daemon.ts

@@ -1,7 +1,7 @@
 import fs from "fs/promises";
 import os from "os";
 import { configureDiscordNotifications, DEFAULT_WEBHOOK_FILE_PATH } from "../../notifications/discord";
-import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { findSourceKey, legacySourceKeyPath, sourceKeyPath, sourceRepoPath } from "../sources";
 import { cloneRepo, syncRepo } from "./git";
 import {
     CHECK_INTERVAL,
@@ -15,7 +15,9 @@ import { enforceSSHDConfig } from "./sshdConfig";
 import { getState, loadState, saveState, sourceState } from "./state";
 import { resolveSourceKeys } from "./trust";
 import { parseAuthLog, readNewAuthLog, watchAuthLog } from "./authLog";
-import { absorbRevocations, applyUnrevokes, recordRevocation, removeRevokedKeys, syncRevokeRepo } from "./revocation";
+import { absorbRevocations, applyUnrevokes, pairKey, recordRevocation, removeRevokedKeys } from "./revocation";
+import { revokeRepo, syncRepoFiles } from "./repoFiles";
+import { revokeRepoURL } from "../revokeSource";
 import { keyFingerprint } from "../authorizedKeys";
 import { addChangeReason } from "./changes";
 import { checkOtherUserKeys, seedUserKeys } from "./userKeys";
@@ -42,6 +44,8 @@ import { checkOtherUserKeys, seedUserKeys } from "./userKeys";
 //   7. A source changed without its signature being updated, so the change is ignored.
 //   8. A source has a corrupted signature, so its contents are ignored.
 //   9. The webhook file itself changed, reported to the webhook being replaced.
+//  10. A trusted machine talked to us from an address it is not allowed from, so it was frozen
+//      everywhere. Sent by whichever machine wrote that revocation, from machines.ts.
 
 export type DaemonConfig = {
     repoSources: string[];
@@ -74,10 +78,11 @@ async function loadConfig(): Promise<DaemonConfig> {
         process.exit(1);
     }
     for (let repoURL of parsed.repoSources) {
-        try {
-            await fs.access(sourceKeyPath(repoURL));
-        } catch (e) {
-            console.error(`portsecure: expected the private key for ${repoURL} at ${sourceKeyPath(repoURL)}, ${e}`);
+        if (!await findSourceKey(repoURL)) {
+            console.error(
+                `portsecure: expected the private key for ${repoURL} at ${sourceKeyPath(repoURL)}`
+                + ` or ${legacySourceKeyPath(repoURL)}, neither exists`
+            );
             process.exit(1);
         }
     }
@@ -137,11 +142,13 @@ async function queueRefusedKeys(allowedKeys: string[]) {
     }
     let state = getState();
     for (let found of parseAuthLog(contents)) {
-        // One key is revoked once, no matter how many addresses it was tried from.
-        if (state.revocations[found.fingerprint]) {
+        // A key and the address it was used from. The same pair twice is one revocation, but the
+        // same key from somewhere else is a new event, whatever was forgiven before.
+        let pair = pairKey({ fingerprint: found.fingerprint, ip: found.attempt.ip });
+        if (Object.values(state.revocations).some(revocation => pairKey(revocation) === pair)) {
             continue;
         }
-        if (state.pendingRevocations.some(pending => pending.fingerprint === found.fingerprint)) {
+        if (state.pendingRevocations.some(pending => pairKey({ fingerprint: pending.fingerprint, ip: pending.attempt.ip }) === pair)) {
             continue;
         }
         let sourceURL = sourceOfFingerprint(found.fingerprint);
@@ -174,11 +181,13 @@ async function writeQueuedRevocations() {
     try {
         let remaining = [];
         for (let pending of state.pendingRevocations) {
-            if (state.revocations[pending.fingerprint]) {
+            let known = () => Object.values(state.revocations)
+                .some(revocation => pairKey(revocation) === pairKey({ fingerprint: pending.fingerprint, ip: pending.attempt.ip }));
+            if (known()) {
                 continue;
             }
             let recorded = await recordRevocation({ ...pending, hostLabel: config.hostLabel });
-            if (!recorded && !state.revocations[pending.fingerprint]) {
+            if (!recorded && !known()) {
                 remaining.push(pending);
             }
         }
@@ -213,7 +222,7 @@ async function pollSource(repoURL: string) {
         // Availability over tidiness: throw the working copy away and start again.
         console.log(`Discarding the checkout of ${repoURL} and cloning from scratch`);
         try {
-            await cloneRepo({ repoURL, repoPath: sourceRepoPath(repoURL), keyPath: sourceKeyPath(repoURL) });
+            await cloneRepo({ repoURL, repoPath: sourceRepoPath(repoURL), keyPath: await findSourceKey(repoURL) || sourceKeyPath(repoURL) });
             repoFailureCounts[repoURL] = 0;
             return true;
         } catch (cloneError) {
@@ -223,10 +232,11 @@ async function pollSource(repoURL: string) {
     }
 
     if (result.historyRewritten) {
-        await notify(
-            `the history of \`${repoURL}\` was rewritten. Commit \`${result.previousSha.slice(0, 12)}\` is no`
-            + ` longer an ancestor of \`${result.remoteSha.slice(0, 12)}\`, so history was force pushed or`
-            + ` tampered with. The new state has been applied.`
+        await notify(`KEY REPO HISTORY REWRITTEN`,
+            `Commits that used to be in \`${repoURL}\` are gone, so somebody force pushed over it`
+            + ` or tampered with it. Whatever it says now has been applied.`
+            + `\n\nwas at: \`${result.previousSha.slice(0, 12)}\``
+            + `\nnow at: \`${result.remoteSha.slice(0, 12)}\``
         );
     }
     if (!result.changed) {
@@ -234,11 +244,18 @@ async function pollSource(repoURL: string) {
     }
     // Said when the file is written, and only if it came out different. A commit that does not
     // touch the keys is not worth telling anyone about.
-    addChangeReason(`\`${repoURL}\` moved to \`${result.remoteSha.slice(0, 12)}\`.`);
+    addChangeReason(`The key repo \`${repoURL}\` moved to \`${result.remoteSha.slice(0, 12)}\`.`);
     sourceState(repoURL).lastSha = result.remoteSha;
     return true;
 }
 
+/** The one loop. Every repo this machine reads is brought up to date here: each source, and the
+    revoke repo beside it that says which of its keys are no longer accepted.
+
+    A repo that cannot be read is reported and skipped, and nothing downstream may read that as an
+    answer. An unreachable source keeps the keys it last gave us, and an unreachable revoke repo
+    keeps the revocations we already know - the alternative is one network failure emptying
+    authorized_keys, or handing a revoked key back to every machine. */
 async function everyCheck() {
     let anyChanged = false;
     for (let repoURL of config.repoSources) {
@@ -246,17 +263,20 @@ async function everyCheck() {
         try {
             anyChanged = await pollSource(repoURL) || anyChanged;
         } catch (e) {
-            console.log(`Polling ${repoURL} failed. ${e && (e as Error).stack || e}`);
+            console.error(`Polling ${repoURL} failed, its last known keys stay in place. ${e && (e as Error).stack || e}`);
+        }
+        try {
+            await syncRepoFiles(revokeRepo(repoURL));
+        } catch (e) {
+            console.error(
+                `Could not read ${revokeRepoURL(repoURL)}, the revocations already known stay in place. ${e}`
+            );
         }
     }
     if (anyChanged) {
         await saveState();
     }
 
-    // What other machines have revoked, and anything published to undo a revocation.
-    for (let repoURL of config.repoSources) {
-        await syncRevokeRepo(repoURL);
-    }
     await absorbRevocations(config.repoSources);
     await applyUnrevokes(config.repoSources);
 
@@ -298,28 +318,18 @@ export async function main() {
 
     console.log(`Starting, ${config.repoSources.length} source(s), keys applied to ${ROOT_AUTHORIZED_KEYS}`);
 
-    // A first pass has to happen before the intervals, so a machine is correct immediately after
-    // boot rather than a minute later.
-    for (let repoURL of config.repoSources) {
-        try {
-            sourceState(repoURL).lastSha = (await syncRepo(repoURL)).remoteSha;
-        } catch (e) {
-            console.log(`Initial sync of ${repoURL} failed, continuing with whatever is on disk. ${e}`);
-        }
-    }
-    await saveState();
+    // Whatever other users already have, before the first check, so what is there at startup is
+    // not reported as somebody having just changed it.
     await seedUserKeys();
 
-    for (let repoURL of config.repoSources) {
-        await syncRevokeRepo(repoURL);
-    }
-    await absorbRevocations(config.repoSources);
-    await enforceRootKeys(await removeRevokedKeys(await readAllowedKeys()));
-    await enforceSSHDConfig();
-
     // configureDiscordNotifications watches the webhook file on its own, so there is nothing to
     // schedule for it here.
-    startInterval({ name: "check", intervalTime: CHECK_INTERVAL, run: everyCheck });
+    let runCheck = startInterval({ name: "check", intervalTime: CHECK_INTERVAL, run: everyCheck });
+    // The same check as every other, run once now rather than a minute from now: a machine has to
+    // be correct immediately after boot. Running the one function, rather than a startup copy of
+    // it, is what keeps a step from being left out of one of them - the copy here had no
+    // applyUnrevokes, so every restart re-applied a revocation that had already been undone.
+    await runCheck();
 
     // A refused login is acted on when sshd writes it. The one pass here covers anything written
     // while the daemon was not running.

package/security/authorizedKeys/daemon/dist/changes.ts.cache

@@ -0,0 +1,40 @@
+"use strict";
+// Why root's authorized_keys is about to change, collected as it happens.
+//
+// Nothing announces itself at the moment it decides something. A revocation arriving, a key being
+// revoked here, an unrevoke taking effect, a repo moving on: each of those says what it is and
+// leaves it here. The file is then written, and only if it actually came out different does any of
+// it get reported, in one message.
+//
+// Doing it the other way round is what produced several messages for one event, and messages about
+// removing a key that had already gone.
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.takeChangeReasons = exports.addLeadingChangeReason = exports.addChangeReason = void 0;
+let reasons = [];
+let leadingReasons = [];
+function addChangeReason(reason) {
+    // The same reason twice in one pass says nothing the once did not.
+    if (!reasons.includes(reason)) {
+        reasons.push(reason);
+    }
+}
+exports.addChangeReason = addChangeReason;
+/** For the one thing worth reading before anything else: somebody using a key from an address it
+    is not allowed from. */
+function addLeadingChangeReason(reason) {
+    if (!leadingReasons.some(existing => existing.headline === reason.headline)) {
+        leadingReasons.push(reason);
+    }
+}
+exports.addLeadingChangeReason = addLeadingChangeReason;
+/** The reasons gathered since the last write, and clears them. Called whether or not anything
+    changed, so reasons that came to nothing cannot show up against some later change. */
+function takeChangeReasons() {
+    let taken = { leading: leadingReasons, reasons };
+    leadingReasons = [];
+    reasons = [];
+    return taken;
+}
+exports.takeChangeReasons = takeChangeReasons;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbmdlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNoYW5nZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLDBFQUEwRTtBQUMxRSxFQUFFO0FBQ0Ysa0dBQWtHO0FBQ2xHLCtGQUErRjtBQUMvRixtR0FBbUc7QUFDbkcsbUNBQW1DO0FBQ25DLEVBQUU7QUFDRixtR0FBbUc7QUFDbkcsd0NBQXdDOzs7QUFPeEMsSUFBSSxPQUFPLEdBQWEsRUFBRSxDQUFDO0FBQzNCLElBQUksY0FBYyxHQUFvQixFQUFFLENBQUM7QUFFekMsU0FBZ0IsZUFBZSxDQUFDLE1BQWM7SUFDMUMsbUVBQW1FO0lBQ25FLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUIsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN6QixDQUFDO0FBQ0wsQ0FBQztBQUxELDBDQUtDO0FBRUQ7MkJBQzJCO0FBQzNCLFNBQWdCLHNCQUFzQixDQUFDLE1BQXFCO0lBQ3hELElBQUksQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsS0FBSyxNQUFNLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUMxRSxjQUFjLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ2hDLENBQUM7QUFDTCxDQUFDO0FBSkQsd0RBSUM7QUFFRDt5RkFDeUY7QUFDekYsU0FBZ0IsaUJBQWlCO0lBQzdCLElBQUksS0FBSyxHQUFHLEVBQUUsT0FBTyxFQUFFLGNBQWMsRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUNqRCxjQUFjLEdBQUcsRUFBRSxDQUFDO0lBQ3BCLE9BQU8sR0FBRyxFQUFFLENBQUM7SUFDYixPQUFPLEtBQUssQ0FBQztBQUNqQixDQUFDO0FBTEQsOENBS0MiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBXaHkgcm9vdCdzIGF1dGhvcml6ZWRfa2V5cyBpcyBhYm91dCB0byBjaGFuZ2UsIGNvbGxlY3RlZCBhcyBpdCBoYXBwZW5zLlxuLy9cbi8vIE5vdGhpbmcgYW5ub3VuY2VzIGl0c2VsZiBhdCB0aGUgbW9tZW50IGl0IGRlY2lkZXMgc29tZXRoaW5nLiBBIHJldm9jYXRpb24gYXJyaXZpbmcsIGEga2V5IGJlaW5nXG4vLyByZXZva2VkIGhlcmUsIGFuIHVucmV2b2tlIHRha2luZyBlZmZlY3QsIGEgcmVwbyBtb3Zpbmcgb246IGVhY2ggb2YgdGhvc2Ugc2F5cyB3aGF0IGl0IGlzIGFuZFxuLy8gbGVhdmVzIGl0IGhlcmUuIFRoZSBmaWxlIGlzIHRoZW4gd3JpdHRlbiwgYW5kIG9ubHkgaWYgaXQgYWN0dWFsbHkgY2FtZSBvdXQgZGlmZmVyZW50IGRvZXMgYW55IG9mXG4vLyBpdCBnZXQgcmVwb3J0ZWQsIGluIG9uZSBtZXNzYWdlLlxuLy9cbi8vIERvaW5nIGl0IHRoZSBvdGhlciB3YXkgcm91bmQgaXMgd2hhdCBwcm9kdWNlZCBzZXZlcmFsIG1lc3NhZ2VzIGZvciBvbmUgZXZlbnQsIGFuZCBtZXNzYWdlcyBhYm91dFxuLy8gcmVtb3ZpbmcgYSBrZXkgdGhhdCBoYWQgYWxyZWFkeSBnb25lLlxuXG4vKiogQSByZWFzb24gaW1wb3J0YW50IGVub3VnaCB0byBuYW1lIHRoZSB3aG9sZSBtZXNzYWdlLiBJdHMgaGVhZGxpbmUgcmVwbGFjZXMgdGhlIG9uZSB0aGUgY2hhbmdlXG4gICAgaXRzZWxmIHdvdWxkIGhhdmUgZ290LCBiZWNhdXNlIFwic29tZWJvZHkgaXMgdXNpbmcgYSBrZXkgdGhleSBzaG91bGQgbm90XCIgb3V0cmFua3MgXCJ0aGUga2V5c1xuICAgIGNoYW5nZWRcIiBpbiB0aGUgb25lIGxpbmUgYSBwaG9uZSBzaG93cy4gKi9cbmV4cG9ydCB0eXBlIExlYWRpbmdSZWFzb24gPSB7IGhlYWRsaW5lOiBzdHJpbmc7IGJvZHk6IHN0cmluZyB9O1xuXG5sZXQgcmVhc29uczogc3RyaW5nW10gPSBbXTtcbmxldCBsZWFkaW5nUmVhc29uczogTGVhZGluZ1JlYXNvbltdID0gW107XG5cbmV4cG9ydCBmdW5jdGlvbiBhZGRDaGFuZ2VSZWFzb24ocmVhc29uOiBzdHJpbmcpIHtcbiAgICAvLyBUaGUgc2FtZSByZWFzb24gdHdpY2UgaW4gb25lIHBhc3Mgc2F5cyBub3RoaW5nIHRoZSBvbmNlIGRpZCBub3QuXG4gICAgaWYgKCFyZWFzb25zLmluY2x1ZGVzKHJlYXNvbikpIHtcbiAgICAgICAgcmVhc29ucy5wdXNoKHJlYXNvbik7XG4gICAgfVxufVxuXG4vKiogRm9yIHRoZSBvbmUgdGhpbmcgd29ydGggcmVhZGluZyBiZWZvcmUgYW55dGhpbmcgZWxzZTogc29tZWJvZHkgdXNpbmcgYSBrZXkgZnJvbSBhbiBhZGRyZXNzIGl0XG4gICAgaXMgbm90IGFsbG93ZWQgZnJvbS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBhZGRMZWFkaW5nQ2hhbmdlUmVhc29uKHJlYXNvbjogTGVhZGluZ1JlYXNvbikge1xuICAgIGlmICghbGVhZGluZ1JlYXNvbnMuc29tZShleGlzdGluZyA9PiBleGlzdGluZy5oZWFkbGluZSA9PT0gcmVhc29uLmhlYWRsaW5lKSkge1xuICAgICAgICBsZWFkaW5nUmVhc29ucy5wdXNoKHJlYXNvbik7XG4gICAgfVxufVxuXG4vKiogVGhlIHJlYXNvbnMgZ2F0aGVyZWQgc2luY2UgdGhlIGxhc3Qgd3JpdGUsIGFuZCBjbGVhcnMgdGhlbS4gQ2FsbGVkIHdoZXRoZXIgb3Igbm90IGFueXRoaW5nXG4gICAgY2hhbmdlZCwgc28gcmVhc29ucyB0aGF0IGNhbWUgdG8gbm90aGluZyBjYW5ub3Qgc2hvdyB1cCBhZ2FpbnN0IHNvbWUgbGF0ZXIgY2hhbmdlLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHRha2VDaGFuZ2VSZWFzb25zKCkge1xuICAgIGxldCB0YWtlbiA9IHsgbGVhZGluZzogbGVhZGluZ1JlYXNvbnMsIHJlYXNvbnMgfTtcbiAgICBsZWFkaW5nUmVhc29ucyA9IFtdO1xuICAgIHJlYXNvbnMgPSBbXTtcbiAgICByZXR1cm4gdGFrZW47XG59XG4iXX0=
+ /* _JS_SOURCE_HASH = "6d0282fa2244057d7a106dc14b6b13dd37ddc1ba1ecc4a44b33dfd51c3e409a5"; */

package/security/authorizedKeys/daemon/dist/git.ts.cache

@@ -0,0 +1,121 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.syncRepo = exports.currentBranch = exports.cloneRepo = exports.repoIsUsable = exports.runGit = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const spawn_1 = require("../../helpers/spawn");
+const sources_1 = require("../sources");
+const paths_1 = require("./paths");
+const state_1 = require("./state");
+async function pathExists(filePath) {
+    try {
+        await promises_1.default.access(filePath);
+        return true;
+    }
+    catch (e) {
+        return false;
+    }
+}
+/** core.sshCommand keeps the key selection with the command instead of in the environment. */
+async function runGit(config) {
+    let { args, cwd, keyPath, allowFailure } = config;
+    let sshCommand = `ssh -i ${keyPath} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new`;
+    let result = await (0, spawn_1.spawnPromise)({
+        command: "git",
+        args: ["-c", `core.sshCommand=${sshCommand}`, ...args],
+        cwd,
+        timeoutTime: paths_1.GIT_TIMEOUT,
+    });
+    if (result.error) {
+        throw new Error(`Expected git ${args.join(" ")} to run, failed with ${result.error.message}`);
+    }
+    if (result.status !== 0 && !allowFailure) {
+        throw new Error(`Expected git ${args.join(" ")} to exit 0, was ${result.status}. `
+            + `${(result.stdout + result.stderr).trim().slice(0, paths_1.MAX_ERROR_BODY_LENGTH)}`);
+    }
+    return result;
+}
+exports.runGit = runGit;
+async function repoIsUsable(config) {
+    let { repoPath, keyPath } = config;
+    if (!await pathExists(path_1.default.join(repoPath, ".git"))) {
+        return false;
+    }
+    let result = await runGit({ args: ["rev-parse", "--git-dir"], cwd: repoPath, keyPath, allowFailure: true });
+    if (result.status !== 0) {
+        console.log(`Repo at ${repoPath} is not usable. ${(result.stdout + result.stderr).trim()}`);
+        return false;
+    }
+    return true;
+}
+exports.repoIsUsable = repoIsUsable;
+/** Cloned beside the old checkout and swapped in, so a clone that fails leaves the copy we are
+    already using untouched rather than deleting the only keys we have. */
+async function cloneRepo(config) {
+    let { repoURL, repoPath, keyPath } = config;
+    let incomingPath = `${repoPath}.incoming`;
+    await promises_1.default.rm(incomingPath, { recursive: true, force: true });
+    await promises_1.default.mkdir(path_1.default.dirname(repoPath), { recursive: true });
+    await runGit({ args: ["clone", repoURL, incomingPath], keyPath });
+    await promises_1.default.rm(repoPath, { recursive: true, force: true });
+    await promises_1.default.rename(incomingPath, repoPath);
+    console.log(`Cloned ${repoURL} into ${repoPath}`);
+}
+exports.cloneRepo = cloneRepo;
+async function currentBranch(config) {
+    return (await runGit({ args: ["rev-parse", "--abbrev-ref", "HEAD"], ...config })).stdout.trim();
+}
+exports.currentBranch = currentBranch;
+async function ensureSourceRepo(repoURL) {
+    let repoPath = (0, sources_1.sourceRepoPath)(repoURL);
+    let keyPath = await (0, sources_1.findSourceKey)(repoURL) || (0, sources_1.sourceKeyPath)(repoURL);
+    if (!await repoIsUsable({ repoPath, keyPath })) {
+        await cloneRepo({ repoURL, repoPath, keyPath });
+    }
+    if (!(0, state_1.sourceState)(repoURL).branch) {
+        (0, state_1.sourceState)(repoURL).branch = await currentBranch({ repoPath, keyPath });
+    }
+}
+/** Returns what changed, so the caller can report it. A rewritten history is called out
+    separately - it means the remote no longer contains the commits we already had. */
+async function syncRepo(repoURL) {
+    await ensureSourceRepo(repoURL);
+    let repoPath = (0, sources_1.sourceRepoPath)(repoURL);
+    let keyPath = await (0, sources_1.findSourceKey)(repoURL) || (0, sources_1.sourceKeyPath)(repoURL);
+    let branch = (0, state_1.sourceState)(repoURL).branch;
+    let localSha = (await runGit({ args: ["rev-parse", "HEAD"], cwd: repoPath, keyPath })).stdout.trim();
+    // A ref listing is a few hundred bytes and no objects, so the usual case of nothing having
+    // changed costs almost nothing and we only fetch when there is something to fetch.
+    let listing = (await runGit({ args: ["ls-remote", "origin", branch], cwd: repoPath, keyPath })).stdout;
+    let remoteSha = (listing.split(/\s+/)[0] || "").trim();
+    if (!remoteSha) {
+        throw new Error(`Expected origin to report a sha for ${branch}, listed ${listing.slice(0, paths_1.MAX_ERROR_BODY_LENGTH)}`);
+    }
+    if (remoteSha === localSha && remoteSha === (0, state_1.sourceState)(repoURL).lastSha) {
+        return { changed: false, historyRewritten: false, remoteSha, previousSha: localSha };
+    }
+    await runGit({ args: ["fetch", "--prune", "origin", branch], cwd: repoPath, keyPath });
+    remoteSha = (await runGit({ args: ["rev-parse", `origin/${branch}`], cwd: repoPath, keyPath })).stdout.trim();
+    let previousSha = (0, state_1.sourceState)(repoURL).lastSha || localSha;
+    let historyRewritten = false;
+    if (previousSha && previousSha !== remoteSha) {
+        // If what we already had is no longer an ancestor of the remote tip, commits were removed
+        // or rewritten rather than added.
+        let ancestry = await runGit({
+            args: ["merge-base", "--is-ancestor", previousSha, remoteSha],
+            cwd: repoPath,
+            keyPath,
+            allowFailure: true,
+        });
+        historyRewritten = ancestry.status !== 0;
+    }
+    await runGit({ args: ["reset", "--hard", `origin/${branch}`], cwd: repoPath, keyPath });
+    await runGit({ args: ["clean", "-fdx"], cwd: repoPath, keyPath });
+    return { changed: true, historyRewritten, remoteSha, previousSha };
+}
+exports.syncRepo = syncRepo;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2l0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiZ2l0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLDJEQUE2QjtBQUM3QixnREFBd0I7QUFDeEIsK0NBQW1EO0FBQ25ELHdDQUEwRTtBQUMxRSxtQ0FBNkQ7QUFDN0QsbUNBQXNDO0FBRXRDLEtBQUssVUFBVSxVQUFVLENBQUMsUUFBZ0I7SUFDdEMsSUFBSSxDQUFDO1FBQ0QsTUFBTSxrQkFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMxQixPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7QUFDTCxDQUFDO0FBRUQsOEZBQThGO0FBQ3ZGLEtBQUssVUFBVSxNQUFNLENBQUMsTUFBaUY7SUFDMUcsSUFBSSxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNsRCxJQUFJLFVBQVUsR0FBRyxVQUFVLE9BQU8sNkVBQTZFLENBQUM7SUFDaEgsSUFBSSxNQUFNLEdBQUcsTUFBTSxJQUFBLG9CQUFZLEVBQUM7UUFDNUIsT0FBTyxFQUFFLEtBQUs7UUFDZCxJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsbUJBQW1CLFVBQVUsRUFBRSxFQUFFLEdBQUcsSUFBSSxDQUFDO1FBQ3RELEdBQUc7UUFDSCxXQUFXLEVBQUUsbUJBQVc7S0FDM0IsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLElBQUksS0FBSyxDQUFDLGdCQUFnQixJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyx3QkFBd0IsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkMsTUFBTSxJQUFJLEtBQUssQ0FDWCxnQkFBZ0IsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsbUJBQW1CLE1BQU0sQ0FBQyxNQUFNLElBQUk7Y0FDaEUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsNkJBQXFCLENBQUMsRUFBRSxDQUNoRixDQUFDO0lBQ04sQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2xCLENBQUM7QUFuQkQsd0JBbUJDO0FBRU0sS0FBSyxVQUFVLFlBQVksQ0FBQyxNQUE2QztJQUM1RSxJQUFJLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNuQyxJQUFJLENBQUMsTUFBTSxVQUFVLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2pELE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFDRCxJQUFJLE1BQU0sR0FBRyxNQUFNLE1BQU0sQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxXQUFXLENBQUMsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUM1RyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDdEIsT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLFFBQVEsbUJBQW1CLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzVGLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNoQixDQUFDO0FBWEQsb0NBV0M7QUFFRDswRUFDMEU7QUFDbkUsS0FBSyxVQUFVLFNBQVMsQ0FBQyxNQUE4RDtJQUMxRixJQUFJLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDNUMsSUFBSSxZQUFZLEdBQUcsR0FBRyxRQUFRLFdBQVcsQ0FBQztJQUMxQyxNQUFNLGtCQUFFLENBQUMsRUFBRSxDQUFDLFlBQVksRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDNUQsTUFBTSxrQkFBRSxDQUFDLEtBQUssQ0FBQyxjQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDNUQsTUFBTSxNQUFNLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLFlBQVksQ0FBQyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDbEUsTUFBTSxrQkFBRSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ3hELE1BQU0sa0JBQUUsQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3hDLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxPQUFPLFNBQVMsUUFBUSxFQUFFLENBQUMsQ0FBQztBQUN0RCxDQUFDO0FBVEQsOEJBU0M7QUFFTSxLQUFLLFVBQVUsYUFBYSxDQUFDLE1BQTZDO0lBQzdFLE9BQU8sQ0FBQyxNQUFNLE1BQU0sQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxjQUFjLEVBQUUsTUFBTSxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0FBQ3BHLENBQUM7QUFGRCxzQ0FFQztBQUVELEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxPQUFlO0lBQzNDLElBQUksUUFBUSxHQUFHLElBQUEsd0JBQWMsRUFBQyxPQUFPLENBQUMsQ0FBQztJQUN2QyxJQUFJLE9BQU8sR0FBRyxNQUFNLElBQUEsdUJBQWEsRUFBQyxPQUFPLENBQUMsSUFBSSxJQUFBLHVCQUFhLEVBQUMsT0FBTyxDQUFDLENBQUM7SUFDckUsSUFBSSxDQUFDLE1BQU0sWUFBWSxDQUFDLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUM3QyxNQUFNLFNBQVMsQ0FBQyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBQ0QsSUFBSSxDQUFDLElBQUEsbUJBQVcsRUFBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUMvQixJQUFBLG1CQUFXLEVBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxHQUFHLE1BQU0sYUFBYSxDQUFDLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDN0UsQ0FBQztBQUNMLENBQUM7QUFFRDtzRkFDc0Y7QUFDL0UsS0FBSyxVQUFVLFFBQVEsQ0FBQyxPQUFlO0lBQzFDLE1BQU0sZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDaEMsSUFBSSxRQUFRLEdBQUcsSUFBQSx3QkFBYyxFQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3ZDLElBQUksT0FBTyxHQUFHLE1BQU0sSUFBQSx1QkFBYSxFQUFDLE9BQU8sQ0FBQyxJQUFJLElBQUEsdUJBQWEsRUFBQyxPQUFPLENBQUMsQ0FBQztJQUNyRSxJQUFJLE1BQU0sR0FBRyxJQUFBLG1CQUFXLEVBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQ3pDLElBQUksUUFBUSxHQUFHLENBQUMsTUFBTSxNQUFNLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsTUFBTSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBRXJHLDJGQUEyRjtJQUMzRixtRkFBbUY7SUFDbkYsSUFBSSxPQUFPLEdBQUcsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQ3ZHLElBQUksU0FBUyxHQUFHLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN2RCxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDYixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxNQUFNLFlBQVksT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsNkJBQXFCLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDeEgsQ0FBQztJQUNELElBQUksU0FBUyxLQUFLLFFBQVEsSUFBSSxTQUFTLEtBQUssSUFBQSxtQkFBVyxFQUFDLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3ZFLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLFFBQVEsRUFBRSxDQUFDO0lBQ3pGLENBQUM7SUFFRCxNQUFNLE1BQU0sQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLE9BQU8sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUN2RixTQUFTLEdBQUcsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxVQUFVLE1BQU0sRUFBRSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBRTlHLElBQUksV0FBVyxHQUFHLElBQUEsbUJBQVcsRUFBQyxPQUFPLENBQUMsQ0FBQyxPQUFPLElBQUksUUFBUSxDQUFDO0lBQzNELElBQUksZ0JBQWdCLEdBQUcsS0FBSyxDQUFDO0lBQzdCLElBQUksV0FBVyxJQUFJLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMzQywwRkFBMEY7UUFDMUYsa0NBQWtDO1FBQ2xDLElBQUksUUFBUSxHQUFHLE1BQU0sTUFBTSxDQUFDO1lBQ3hCLElBQUksRUFBRSxDQUFDLFlBQVksRUFBRSxlQUFlLEVBQUUsV0FBVyxFQUFFLFNBQVMsQ0FBQztZQUM3RCxHQUFHLEVBQUUsUUFBUTtZQUNiLE9BQU87WUFDUCxZQUFZLEVBQUUsSUFBSTtTQUNyQixDQUFDLENBQUM7UUFDSCxnQkFBZ0IsR0FBRyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQztJQUM3QyxDQUFDO0lBQ0QsTUFBTSxNQUFNLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLFVBQVUsTUFBTSxFQUFFLENBQUMsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDeEYsTUFBTSxNQUFNLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ2xFLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUN2RSxDQUFDO0FBckNELDRCQXFDQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBmcyBmcm9tIFwiZnMvcHJvbWlzZXNcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5pbXBvcnQgeyBzcGF3blByb21pc2UgfSBmcm9tIFwiLi4vLi4vaGVscGVycy9zcGF3blwiO1xuaW1wb3J0IHsgZmluZFNvdXJjZUtleSwgc291cmNlS2V5UGF0aCwgc291cmNlUmVwb1BhdGggfSBmcm9tIFwiLi4vc291cmNlc1wiO1xuaW1wb3J0IHsgR0lUX1RJTUVPVVQsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCB9IGZyb20gXCIuL3BhdGhzXCI7XG5pbXBvcnQgeyBzb3VyY2VTdGF0ZSB9IGZyb20gXCIuL3N0YXRlXCI7XG5cbmFzeW5jIGZ1bmN0aW9uIHBhdGhFeGlzdHMoZmlsZVBhdGg6IHN0cmluZykge1xuICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IGZzLmFjY2VzcyhmaWxlUGF0aCk7XG4gICAgICAgIHJldHVybiB0cnVlO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cbn1cblxuLyoqIGNvcmUuc3NoQ29tbWFuZCBrZWVwcyB0aGUga2V5IHNlbGVjdGlvbiB3aXRoIHRoZSBjb21tYW5kIGluc3RlYWQgb2YgaW4gdGhlIGVudmlyb25tZW50LiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJ1bkdpdChjb25maWc6IHsgYXJnczogc3RyaW5nW107IGN3ZD86IHN0cmluZzsga2V5UGF0aDogc3RyaW5nOyBhbGxvd0ZhaWx1cmU/OiBib29sZWFuIH0pIHtcbiAgICBsZXQgeyBhcmdzLCBjd2QsIGtleVBhdGgsIGFsbG93RmFpbHVyZSB9ID0gY29uZmlnO1xuICAgIGxldCBzc2hDb21tYW5kID0gYHNzaCAtaSAke2tleVBhdGh9IC1vIElkZW50aXRpZXNPbmx5PXllcyAtbyBCYXRjaE1vZGU9eWVzIC1vIFN0cmljdEhvc3RLZXlDaGVja2luZz1hY2NlcHQtbmV3YDtcbiAgICBsZXQgcmVzdWx0ID0gYXdhaXQgc3Bhd25Qcm9taXNlKHtcbiAgICAgICAgY29tbWFuZDogXCJnaXRcIixcbiAgICAgICAgYXJnczogW1wiLWNcIiwgYGNvcmUuc3NoQ29tbWFuZD0ke3NzaENvbW1hbmR9YCwgLi4uYXJnc10sXG4gICAgICAgIGN3ZCxcbiAgICAgICAgdGltZW91dFRpbWU6IEdJVF9USU1FT1VULFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuZXJyb3IpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBnaXQgJHthcmdzLmpvaW4oXCIgXCIpfSB0byBydW4sIGZhaWxlZCB3aXRoICR7cmVzdWx0LmVycm9yLm1lc3NhZ2V9YCk7XG4gICAgfVxuICAgIGlmIChyZXN1bHQuc3RhdHVzICE9PSAwICYmICFhbGxvd0ZhaWx1cmUpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAgICAgYEV4cGVjdGVkIGdpdCAke2FyZ3Muam9pbihcIiBcIil9IHRvIGV4aXQgMCwgd2FzICR7cmVzdWx0LnN0YXR1c30uIGBcbiAgICAgICAgICAgICsgYCR7KHJlc3VsdC5zdGRvdXQgKyByZXN1bHQuc3RkZXJyKS50cmltKCkuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gXG4gICAgICAgICk7XG4gICAgfVxuICAgIHJldHVybiByZXN1bHQ7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZXBvSXNVc2FibGUoY29uZmlnOiB7IHJlcG9QYXRoOiBzdHJpbmc7IGtleVBhdGg6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgcmVwb1BhdGgsIGtleVBhdGggfSA9IGNvbmZpZztcbiAgICBpZiAoIWF3YWl0IHBhdGhFeGlzdHMocGF0aC5qb2luKHJlcG9QYXRoLCBcIi5naXRcIikpKSB7XG4gICAgICAgIHJldHVybiBmYWxzZTtcbiAgICB9XG4gICAgbGV0IHJlc3VsdCA9IGF3YWl0IHJ1bkdpdCh7IGFyZ3M6IFtcInJldi1wYXJzZVwiLCBcIi0tZ2l0LWRpclwiXSwgY3dkOiByZXBvUGF0aCwga2V5UGF0aCwgYWxsb3dGYWlsdXJlOiB0cnVlIH0pO1xuICAgIGlmIChyZXN1bHQuc3RhdHVzICE9PSAwKSB7XG4gICAgICAgIGNvbnNvbGUubG9nKGBSZXBvIGF0ICR7cmVwb1BhdGh9IGlzIG5vdCB1c2FibGUuICR7KHJlc3VsdC5zdGRvdXQgKyByZXN1bHQuc3RkZXJyKS50cmltKCl9YCk7XG4gICAgICAgIHJldHVybiBmYWxzZTtcbiAgICB9XG4gICAgcmV0dXJuIHRydWU7XG59XG5cbi8qKiBDbG9uZWQgYmVzaWRlIHRoZSBvbGQgY2hlY2tvdXQgYW5kIHN3YXBwZWQgaW4sIHNvIGEgY2xvbmUgdGhhdCBmYWlscyBsZWF2ZXMgdGhlIGNvcHkgd2UgYXJlXG4gICAgYWxyZWFkeSB1c2luZyB1bnRvdWNoZWQgcmF0aGVyIHRoYW4gZGVsZXRpbmcgdGhlIG9ubHkga2V5cyB3ZSBoYXZlLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGNsb25lUmVwbyhjb25maWc6IHsgcmVwb1VSTDogc3RyaW5nOyByZXBvUGF0aDogc3RyaW5nOyBrZXlQYXRoOiBzdHJpbmcgfSkge1xuICAgIGxldCB7IHJlcG9VUkwsIHJlcG9QYXRoLCBrZXlQYXRoIH0gPSBjb25maWc7XG4gICAgbGV0IGluY29taW5nUGF0aCA9IGAke3JlcG9QYXRofS5pbmNvbWluZ2A7XG4gICAgYXdhaXQgZnMucm0oaW5jb21pbmdQYXRoLCB7IHJlY3Vyc2l2ZTogdHJ1ZSwgZm9yY2U6IHRydWUgfSk7XG4gICAgYXdhaXQgZnMubWtkaXIocGF0aC5kaXJuYW1lKHJlcG9QYXRoKSwgeyByZWN1cnNpdmU6IHRydWUgfSk7XG4gICAgYXdhaXQgcnVuR2l0KHsgYXJnczogW1wiY2xvbmVcIiwgcmVwb1VSTCwgaW5jb21pbmdQYXRoXSwga2V5UGF0aCB9KTtcbiAgICBhd2FpdCBmcy5ybShyZXBvUGF0aCwgeyByZWN1cnNpdmU6IHRydWUsIGZvcmNlOiB0cnVlIH0pO1xuICAgIGF3YWl0IGZzLnJlbmFtZShpbmNvbWluZ1BhdGgsIHJlcG9QYXRoKTtcbiAgICBjb25zb2xlLmxvZyhgQ2xvbmVkICR7cmVwb1VSTH0gaW50byAke3JlcG9QYXRofWApO1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gY3VycmVudEJyYW5jaChjb25maWc6IHsgcmVwb1BhdGg6IHN0cmluZzsga2V5UGF0aDogc3RyaW5nIH0pIHtcbiAgICByZXR1cm4gKGF3YWl0IHJ1bkdpdCh7IGFyZ3M6IFtcInJldi1wYXJzZVwiLCBcIi0tYWJicmV2LXJlZlwiLCBcIkhFQURcIl0sIC4uLmNvbmZpZyB9KSkuc3Rkb3V0LnRyaW0oKTtcbn1cblxuYXN5bmMgZnVuY3Rpb24gZW5zdXJlU291cmNlUmVwbyhyZXBvVVJMOiBzdHJpbmcpIHtcbiAgICBsZXQgcmVwb1BhdGggPSBzb3VyY2VSZXBvUGF0aChyZXBvVVJMKTtcbiAgICBsZXQga2V5UGF0aCA9IGF3YWl0IGZpbmRTb3VyY2VLZXkocmVwb1VSTCkgfHwgc291cmNlS2V5UGF0aChyZXBvVVJMKTtcbiAgICBpZiAoIWF3YWl0IHJlcG9Jc1VzYWJsZSh7IHJlcG9QYXRoLCBrZXlQYXRoIH0pKSB7XG4gICAgICAgIGF3YWl0IGNsb25lUmVwbyh7IHJlcG9VUkwsIHJlcG9QYXRoLCBrZXlQYXRoIH0pO1xuICAgIH1cbiAgICBpZiAoIXNvdXJjZVN0YXRlKHJlcG9VUkwpLmJyYW5jaCkge1xuICAgICAgICBzb3VyY2VTdGF0ZShyZXBvVVJMKS5icmFuY2ggPSBhd2FpdCBjdXJyZW50QnJhbmNoKHsgcmVwb1BhdGgsIGtleVBhdGggfSk7XG4gICAgfVxufVxuXG4vKiogUmV0dXJucyB3aGF0IGNoYW5nZWQsIHNvIHRoZSBjYWxsZXIgY2FuIHJlcG9ydCBpdC4gQSByZXdyaXR0ZW4gaGlzdG9yeSBpcyBjYWxsZWQgb3V0XG4gICAgc2VwYXJhdGVseSAtIGl0IG1lYW5zIHRoZSByZW1vdGUgbm8gbG9uZ2VyIGNvbnRhaW5zIHRoZSBjb21taXRzIHdlIGFscmVhZHkgaGFkLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHN5bmNSZXBvKHJlcG9VUkw6IHN0cmluZykge1xuICAgIGF3YWl0IGVuc3VyZVNvdXJjZVJlcG8ocmVwb1VSTCk7XG4gICAgbGV0IHJlcG9QYXRoID0gc291cmNlUmVwb1BhdGgocmVwb1VSTCk7XG4gICAgbGV0IGtleVBhdGggPSBhd2FpdCBmaW5kU291cmNlS2V5KHJlcG9VUkwpIHx8IHNvdXJjZUtleVBhdGgocmVwb1VSTCk7XG4gICAgbGV0IGJyYW5jaCA9IHNvdXJjZVN0YXRlKHJlcG9VUkwpLmJyYW5jaDtcbiAgICBsZXQgbG9jYWxTaGEgPSAoYXdhaXQgcnVuR2l0KHsgYXJnczogW1wicmV2LXBhcnNlXCIsIFwiSEVBRFwiXSwgY3dkOiByZXBvUGF0aCwga2V5UGF0aCB9KSkuc3Rkb3V0LnRyaW0oKTtcblxuICAgIC8vIEEgcmVmIGxpc3RpbmcgaXMgYSBmZXcgaHVuZHJlZCBieXRlcyBhbmQgbm8gb2JqZWN0cywgc28gdGhlIHVzdWFsIGNhc2Ugb2Ygbm90aGluZyBoYXZpbmdcbiAgICAvLyBjaGFuZ2VkIGNvc3RzIGFsbW9zdCBub3RoaW5nIGFuZCB3ZSBvbmx5IGZldGNoIHdoZW4gdGhlcmUgaXMgc29tZXRoaW5nIHRvIGZldGNoLlxuICAgIGxldCBsaXN0aW5nID0gKGF3YWl0IHJ1bkdpdCh7IGFyZ3M6IFtcImxzLXJlbW90ZVwiLCBcIm9yaWdpblwiLCBicmFuY2hdLCBjd2Q6IHJlcG9QYXRoLCBrZXlQYXRoIH0pKS5zdGRvdXQ7XG4gICAgbGV0IHJlbW90ZVNoYSA9IChsaXN0aW5nLnNwbGl0KC9cXHMrLylbMF0gfHwgXCJcIikudHJpbSgpO1xuICAgIGlmICghcmVtb3RlU2hhKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgb3JpZ2luIHRvIHJlcG9ydCBhIHNoYSBmb3IgJHticmFuY2h9LCBsaXN0ZWQgJHtsaXN0aW5nLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YCk7XG4gICAgfVxuICAgIGlmIChyZW1vdGVTaGEgPT09IGxvY2FsU2hhICYmIHJlbW90ZVNoYSA9PT0gc291cmNlU3RhdGUocmVwb1VSTCkubGFzdFNoYSkge1xuICAgICAgICByZXR1cm4geyBjaGFuZ2VkOiBmYWxzZSwgaGlzdG9yeVJld3JpdHRlbjogZmFsc2UsIHJlbW90ZVNoYSwgcHJldmlvdXNTaGE6IGxvY2FsU2hhIH07XG4gICAgfVxuXG4gICAgYXdhaXQgcnVuR2l0KHsgYXJnczogW1wiZmV0Y2hcIiwgXCItLXBydW5lXCIsIFwib3JpZ2luXCIsIGJyYW5jaF0sIGN3ZDogcmVwb1BhdGgsIGtleVBhdGggfSk7XG4gICAgcmVtb3RlU2hhID0gKGF3YWl0IHJ1bkdpdCh7IGFyZ3M6IFtcInJldi1wYXJzZVwiLCBgb3JpZ2luLyR7YnJhbmNofWBdLCBjd2Q6IHJlcG9QYXRoLCBrZXlQYXRoIH0pKS5zdGRvdXQudHJpbSgpO1xuXG4gICAgbGV0IHByZXZpb3VzU2hhID0gc291cmNlU3RhdGUocmVwb1VSTCkubGFzdFNoYSB8fCBsb2NhbFNoYTtcbiAgICBsZXQgaGlzdG9yeVJld3JpdHRlbiA9IGZhbHNlO1xuICAgIGlmIChwcmV2aW91c1NoYSAmJiBwcmV2aW91c1NoYSAhPT0gcmVtb3RlU2hhKSB7XG4gICAgICAgIC8vIElmIHdoYXQgd2UgYWxyZWFkeSBoYWQgaXMgbm8gbG9uZ2VyIGFuIGFuY2VzdG9yIG9mIHRoZSByZW1vdGUgdGlwLCBjb21taXRzIHdlcmUgcmVtb3ZlZFxuICAgICAgICAvLyBvciByZXdyaXR0ZW4gcmF0aGVyIHRoYW4gYWRkZWQuXG4gICAgICAgIGxldCBhbmNlc3RyeSA9IGF3YWl0IHJ1bkdpdCh7XG4gICAgICAgICAgICBhcmdzOiBbXCJtZXJnZS1iYXNlXCIsIFwiLS1pcy1hbmNlc3RvclwiLCBwcmV2aW91c1NoYSwgcmVtb3RlU2hhXSxcbiAgICAgICAgICAgIGN3ZDogcmVwb1BhdGgsXG4gICAgICAgICAgICBrZXlQYXRoLFxuICAgICAgICAgICAgYWxsb3dGYWlsdXJlOiB0cnVlLFxuICAgICAgICB9KTtcbiAgICAgICAgaGlzdG9yeVJld3JpdHRlbiA9IGFuY2VzdHJ5LnN0YXR1cyAhPT0gMDtcbiAgICB9XG4gICAgYXdhaXQgcnVuR2l0KHsgYXJnczogW1wicmVzZXRcIiwgXCItLWhhcmRcIiwgYG9yaWdpbi8ke2JyYW5jaH1gXSwgY3dkOiByZXBvUGF0aCwga2V5UGF0aCB9KTtcbiAgICBhd2FpdCBydW5HaXQoeyBhcmdzOiBbXCJjbGVhblwiLCBcIi1mZHhcIl0sIGN3ZDogcmVwb1BhdGgsIGtleVBhdGggfSk7XG4gICAgcmV0dXJuIHsgY2hhbmdlZDogdHJ1ZSwgaGlzdG9yeVJld3JpdHRlbiwgcmVtb3RlU2hhLCBwcmV2aW91c1NoYSB9O1xufVxuIl19
+ /* _JS_SOURCE_HASH = "da70130786edfd6c82adec69297c753d740fb3477e29daf0f2670052fa21b0fd"; */

package/security/authorizedKeys/daemon/dist/notify.ts.cache

@@ -0,0 +1,39 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.notify = exports.setHostLabel = void 0;
+const os_1 = __importDefault(require("os"));
+const discord_1 = require("../../notifications/discord");
+let hostLabelValue = "";
+function setHostLabel(value) {
+    hostLabelValue = value;
+}
+exports.setHostLabel = setHostLabel;
+// DO NOT add new calls to this. Every message goes to a real Discord server someone reads, so a
+// notification is only ever added when the user explicitly asks for that specific case. Startup,
+// success, errors, retries and recoveries all belong in console.log instead. The complete list of
+// cases that are allowed to notify is at the top of daemon.ts.
+/** A headline and the rest.
+
+    The headline is all a phone shows. It gets the whole preview to itself: no product name, no
+    host, no timestamp in front of it, because a person glancing at their lock screen needs to read
+    what happened, not which machine said it or when. Those go at the end, where they are there for
+    whoever opens the message and out of the way of whoever does not. */
+async function notify(headline, body) {
+    let full = `**${headline}**\n\n${body}\n\n${hostLabelValue || os_1.default.hostname()}`;
+    // Logged before it is sent, and whether or not it arrives, so the journal is a complete record
+    // of what this machine had to say even when Discord is unreachable or the webhook is wrong.
+    console.log(`Discord: ${full}`);
+    try {
+        await (0, discord_1.sendDiscordNotification)(full);
+    }
+    catch (e) {
+        // A failed notification must never take the daemon down, the local log is the fallback.
+        console.log(`Failed to send the Discord notification above. ${e}`);
+    }
+}
+exports.notify = notify;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm90aWZ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsibm90aWZ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLDRDQUFvQjtBQUNwQix5REFBc0U7QUFFdEUsSUFBSSxjQUFjLEdBQUcsRUFBRSxDQUFDO0FBRXhCLFNBQWdCLFlBQVksQ0FBQyxLQUFhO0lBQ3RDLGNBQWMsR0FBRyxLQUFLLENBQUM7QUFDM0IsQ0FBQztBQUZELG9DQUVDO0FBRUQsZ0dBQWdHO0FBQ2hHLGlHQUFpRztBQUNqRyxrR0FBa0c7QUFDbEcsK0RBQStEO0FBQy9EOzs7Ozt3RUFLd0U7QUFDakUsS0FBSyxVQUFVLE1BQU0sQ0FBQyxRQUFnQixFQUFFLElBQVk7SUFDdkQsSUFBSSxJQUFJLEdBQUcsS0FBSyxRQUFRLFNBQVMsSUFBSSxPQUFPLGNBQWMsSUFBSSxZQUFFLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQztJQUM5RSwrRkFBK0Y7SUFDL0YsNEZBQTRGO0lBQzVGLE9BQU8sQ0FBQyxHQUFHLENBQUMsWUFBWSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ2hDLElBQUksQ0FBQztRQUNELE1BQU0sSUFBQSxpQ0FBdUIsRUFBQyxJQUFJLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULHdGQUF3RjtRQUN4RixPQUFPLENBQUMsR0FBRyxDQUFDLGtEQUFrRCxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7QUFDTCxDQUFDO0FBWEQsd0JBV0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgb3MgZnJvbSBcIm9zXCI7XG5pbXBvcnQgeyBzZW5kRGlzY29yZE5vdGlmaWNhdGlvbiB9IGZyb20gXCIuLi8uLi9ub3RpZmljYXRpb25zL2Rpc2NvcmRcIjtcblxubGV0IGhvc3RMYWJlbFZhbHVlID0gXCJcIjtcblxuZXhwb3J0IGZ1bmN0aW9uIHNldEhvc3RMYWJlbCh2YWx1ZTogc3RyaW5nKSB7XG4gICAgaG9zdExhYmVsVmFsdWUgPSB2YWx1ZTtcbn1cblxuLy8gRE8gTk9UIGFkZCBuZXcgY2FsbHMgdG8gdGhpcy4gRXZlcnkgbWVzc2FnZSBnb2VzIHRvIGEgcmVhbCBEaXNjb3JkIHNlcnZlciBzb21lb25lIHJlYWRzLCBzbyBhXG4vLyBub3RpZmljYXRpb24gaXMgb25seSBldmVyIGFkZGVkIHdoZW4gdGhlIHVzZXIgZXhwbGljaXRseSBhc2tzIGZvciB0aGF0IHNwZWNpZmljIGNhc2UuIFN0YXJ0dXAsXG4vLyBzdWNjZXNzLCBlcnJvcnMsIHJldHJpZXMgYW5kIHJlY292ZXJpZXMgYWxsIGJlbG9uZyBpbiBjb25zb2xlLmxvZyBpbnN0ZWFkLiBUaGUgY29tcGxldGUgbGlzdCBvZlxuLy8gY2FzZXMgdGhhdCBhcmUgYWxsb3dlZCB0byBub3RpZnkgaXMgYXQgdGhlIHRvcCBvZiBkYWVtb24udHMuXG4vKiogQSBoZWFkbGluZSBhbmQgdGhlIHJlc3QuXG5cbiAgICBUaGUgaGVhZGxpbmUgaXMgYWxsIGEgcGhvbmUgc2hvd3MuIEl0IGdldHMgdGhlIHdob2xlIHByZXZpZXcgdG8gaXRzZWxmOiBubyBwcm9kdWN0IG5hbWUsIG5vXG4gICAgaG9zdCwgbm8gdGltZXN0YW1wIGluIGZyb250IG9mIGl0LCBiZWNhdXNlIGEgcGVyc29uIGdsYW5jaW5nIGF0IHRoZWlyIGxvY2sgc2NyZWVuIG5lZWRzIHRvIHJlYWRcbiAgICB3aGF0IGhhcHBlbmVkLCBub3Qgd2hpY2ggbWFjaGluZSBzYWlkIGl0IG9yIHdoZW4uIFRob3NlIGdvIGF0IHRoZSBlbmQsIHdoZXJlIHRoZXkgYXJlIHRoZXJlIGZvclxuICAgIHdob2V2ZXIgb3BlbnMgdGhlIG1lc3NhZ2UgYW5kIG91dCBvZiB0aGUgd2F5IG9mIHdob2V2ZXIgZG9lcyBub3QuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbm90aWZ5KGhlYWRsaW5lOiBzdHJpbmcsIGJvZHk6IHN0cmluZykge1xuICAgIGxldCBmdWxsID0gYCoqJHtoZWFkbGluZX0qKlxcblxcbiR7Ym9keX1cXG5cXG4ke2hvc3RMYWJlbFZhbHVlIHx8IG9zLmhvc3RuYW1lKCl9YDtcbiAgICAvLyBMb2dnZWQgYmVmb3JlIGl0IGlzIHNlbnQsIGFuZCB3aGV0aGVyIG9yIG5vdCBpdCBhcnJpdmVzLCBzbyB0aGUgam91cm5hbCBpcyBhIGNvbXBsZXRlIHJlY29yZFxuICAgIC8vIG9mIHdoYXQgdGhpcyBtYWNoaW5lIGhhZCB0byBzYXkgZXZlbiB3aGVuIERpc2NvcmQgaXMgdW5yZWFjaGFibGUgb3IgdGhlIHdlYmhvb2sgaXMgd3JvbmcuXG4gICAgY29uc29sZS5sb2coYERpc2NvcmQ6ICR7ZnVsbH1gKTtcbiAgICB0cnkge1xuICAgICAgICBhd2FpdCBzZW5kRGlzY29yZE5vdGlmaWNhdGlvbihmdWxsKTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIC8vIEEgZmFpbGVkIG5vdGlmaWNhdGlvbiBtdXN0IG5ldmVyIHRha2UgdGhlIGRhZW1vbiBkb3duLCB0aGUgbG9jYWwgbG9nIGlzIHRoZSBmYWxsYmFjay5cbiAgICAgICAgY29uc29sZS5sb2coYEZhaWxlZCB0byBzZW5kIHRoZSBEaXNjb3JkIG5vdGlmaWNhdGlvbiBhYm92ZS4gJHtlfWApO1xuICAgIH1cbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "9fe72e2c338fa1d2d53a34b85265b997cc47def23f019ca77b8a3735088305e5"; */

package/security/authorizedKeys/daemon/dist/paths.ts.cache

@@ -0,0 +1,29 @@
+"use strict";
+// Locations the daemon owns. Fixed rather than configurable, so every machine looks the same and
+// the config file only carries what genuinely differs between them.
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.MAX_REPO_FAILURES_BEFORE_RECLONE = exports.UNREVOKE_DELAY = exports.SIGNER_CHANGE_DELAY = exports.MAX_ERROR_BODY_LENGTH = exports.GIT_TIMEOUT = exports.WEBHOOK_CHECK_INTERVAL = exports.CHECK_INTERVAL = exports.AUTH_LOG_PATH = exports.PASSWD_PATH = exports.SSHD_DROPIN_PATH = exports.SSHD_DROPIN_DIR = exports.SSHD_CONFIG_PATH = exports.ROOT_AUTHORIZED_KEYS = exports.KEYS_HISTORY_PATH = exports.STATE_PATH = exports.CONFIG_PATH = void 0;
+exports.CONFIG_PATH = "/etc/portsecure/daemon.json";
+exports.STATE_PATH = "/var/lib/portsecure/state.json";
+exports.KEYS_HISTORY_PATH = "/var/lib/portsecure/authorized-keys-history";
+exports.ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
+exports.SSHD_CONFIG_PATH = "/etc/ssh/sshd_config";
+exports.SSHD_DROPIN_DIR = "/etc/ssh/sshd_config.d";
+exports.SSHD_DROPIN_PATH = "/etc/ssh/sshd_config.d/00-portsecure.conf";
+exports.PASSWD_PATH = "/etc/passwd";
+exports.AUTH_LOG_PATH = "/var/log/auth.log";
+exports.CHECK_INTERVAL = 60 * 1000;
+exports.WEBHOOK_CHECK_INTERVAL = 5 * 60 * 1000;
+exports.GIT_TIMEOUT = 120 * 1000;
+exports.MAX_ERROR_BODY_LENGTH = 500;
+// A source that starts being signed by someone new is held at arm's length for this long, so a
+// stolen signing key cannot push keys onto a machine before anyone notices the warning.
+exports.SIGNER_CHANGE_DELAY = 24 * 60 * 60 * 1000;
+// An unrevoke waits this long before taking effect, so a compromised signing key cannot instantly
+// undo the revocation that locked it out.
+exports.UNREVOKE_DELAY = 60 * 60 * 1000;
+// After this many consecutive failures a repo is thrown away and cloned from scratch, which
+// recovers from corruption and interrupted fetches. Counted in checks, so about a quarter hour.
+exports.MAX_REPO_FAILURES_BEFORE_RECLONE = 15;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGF0aHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwYXRocy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUEsaUdBQWlHO0FBQ2pHLG9FQUFvRTs7O0FBRXZELFFBQUEsV0FBVyxHQUFHLDZCQUE2QixDQUFDO0FBQzVDLFFBQUEsVUFBVSxHQUFHLGdDQUFnQyxDQUFDO0FBQzlDLFFBQUEsaUJBQWlCLEdBQUcsNkNBQTZDLENBQUM7QUFDbEUsUUFBQSxvQkFBb0IsR0FBRyw0QkFBNEIsQ0FBQztBQUNwRCxRQUFBLGdCQUFnQixHQUFHLHNCQUFzQixDQUFDO0FBQzFDLFFBQUEsZUFBZSxHQUFHLHdCQUF3QixDQUFDO0FBQzNDLFFBQUEsZ0JBQWdCLEdBQUcsMkNBQTJDLENBQUM7QUFDL0QsUUFBQSxXQUFXLEdBQUcsYUFBYSxDQUFDO0FBQzVCLFFBQUEsYUFBYSxHQUFHLG1CQUFtQixDQUFDO0FBRXBDLFFBQUEsY0FBYyxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUM7QUFDM0IsUUFBQSxzQkFBc0IsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQUN2QyxRQUFBLFdBQVcsR0FBRyxHQUFHLEdBQUcsSUFBSSxDQUFDO0FBQ3pCLFFBQUEscUJBQXFCLEdBQUcsR0FBRyxDQUFDO0FBQ3pDLCtGQUErRjtBQUMvRix3RkFBd0Y7QUFDM0UsUUFBQSxtQkFBbUIsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUM7QUFDdkQsa0dBQWtHO0FBQ2xHLDBDQUEwQztBQUM3QixRQUFBLGNBQWMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQUM3Qyw0RkFBNEY7QUFDNUYsZ0dBQWdHO0FBQ25GLFFBQUEsZ0NBQWdDLEdBQUcsRUFBRSxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gTG9jYXRpb25zIHRoZSBkYWVtb24gb3ducy4gRml4ZWQgcmF0aGVyIHRoYW4gY29uZmlndXJhYmxlLCBzbyBldmVyeSBtYWNoaW5lIGxvb2tzIHRoZSBzYW1lIGFuZFxuLy8gdGhlIGNvbmZpZyBmaWxlIG9ubHkgY2FycmllcyB3aGF0IGdlbnVpbmVseSBkaWZmZXJzIGJldHdlZW4gdGhlbS5cblxuZXhwb3J0IGNvbnN0IENPTkZJR19QQVRIID0gXCIvZXRjL3BvcnRzZWN1cmUvZGFlbW9uLmpzb25cIjtcbmV4cG9ydCBjb25zdCBTVEFURV9QQVRIID0gXCIvdmFyL2xpYi9wb3J0c2VjdXJlL3N0YXRlLmpzb25cIjtcbmV4cG9ydCBjb25zdCBLRVlTX0hJU1RPUllfUEFUSCA9IFwiL3Zhci9saWIvcG9ydHNlY3VyZS9hdXRob3JpemVkLWtleXMtaGlzdG9yeVwiO1xuZXhwb3J0IGNvbnN0IFJPT1RfQVVUSE9SSVpFRF9LRVlTID0gXCIvcm9vdC8uc3NoL2F1dGhvcml6ZWRfa2V5c1wiO1xuZXhwb3J0IGNvbnN0IFNTSERfQ09ORklHX1BBVEggPSBcIi9ldGMvc3NoL3NzaGRfY29uZmlnXCI7XG5leHBvcnQgY29uc3QgU1NIRF9EUk9QSU5fRElSID0gXCIvZXRjL3NzaC9zc2hkX2NvbmZpZy5kXCI7XG5leHBvcnQgY29uc3QgU1NIRF9EUk9QSU5fUEFUSCA9IFwiL2V0Yy9zc2gvc3NoZF9jb25maWcuZC8wMC1wb3J0c2VjdXJlLmNvbmZcIjtcbmV4cG9ydCBjb25zdCBQQVNTV0RfUEFUSCA9IFwiL2V0Yy9wYXNzd2RcIjtcbmV4cG9ydCBjb25zdCBBVVRIX0xPR19QQVRIID0gXCIvdmFyL2xvZy9hdXRoLmxvZ1wiO1xuXG5leHBvcnQgY29uc3QgQ0hFQ0tfSU5URVJWQUwgPSA2MCAqIDEwMDA7XG5leHBvcnQgY29uc3QgV0VCSE9PS19DSEVDS19JTlRFUlZBTCA9IDUgKiA2MCAqIDEwMDA7XG5leHBvcnQgY29uc3QgR0lUX1RJTUVPVVQgPSAxMjAgKiAxMDAwO1xuZXhwb3J0IGNvbnN0IE1BWF9FUlJPUl9CT0RZX0xFTkdUSCA9IDUwMDtcbi8vIEEgc291cmNlIHRoYXQgc3RhcnRzIGJlaW5nIHNpZ25lZCBieSBzb21lb25lIG5ldyBpcyBoZWxkIGF0IGFybSdzIGxlbmd0aCBmb3IgdGhpcyBsb25nLCBzbyBhXG4vLyBzdG9sZW4gc2lnbmluZyBrZXkgY2Fubm90IHB1c2gga2V5cyBvbnRvIGEgbWFjaGluZSBiZWZvcmUgYW55b25lIG5vdGljZXMgdGhlIHdhcm5pbmcuXG5leHBvcnQgY29uc3QgU0lHTkVSX0NIQU5HRV9ERUxBWSA9IDI0ICogNjAgKiA2MCAqIDEwMDA7XG4vLyBBbiB1bnJldm9rZSB3YWl0cyB0aGlzIGxvbmcgYmVmb3JlIHRha2luZyBlZmZlY3QsIHNvIGEgY29tcHJvbWlzZWQgc2lnbmluZyBrZXkgY2Fubm90IGluc3RhbnRseVxuLy8gdW5kbyB0aGUgcmV2b2NhdGlvbiB0aGF0IGxvY2tlZCBpdCBvdXQuXG5leHBvcnQgY29uc3QgVU5SRVZPS0VfREVMQVkgPSA2MCAqIDYwICogMTAwMDtcbi8vIEFmdGVyIHRoaXMgbWFueSBjb25zZWN1dGl2ZSBmYWlsdXJlcyBhIHJlcG8gaXMgdGhyb3duIGF3YXkgYW5kIGNsb25lZCBmcm9tIHNjcmF0Y2gsIHdoaWNoXG4vLyByZWNvdmVycyBmcm9tIGNvcnJ1cHRpb24gYW5kIGludGVycnVwdGVkIGZldGNoZXMuIENvdW50ZWQgaW4gY2hlY2tzLCBzbyBhYm91dCBhIHF1YXJ0ZXIgaG91ci5cbmV4cG9ydCBjb25zdCBNQVhfUkVQT19GQUlMVVJFU19CRUZPUkVfUkVDTE9ORSA9IDE1O1xuIl19
+ /* _JS_SOURCE_HASH = "04c95747c8ff6d5611015502a598fe430e5fddd148541921318ff8e5ec0cbf25"; */

package/security/authorizedKeys/daemon/dist/repoFiles.ts.cache

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.listRepoDir = exports.readRepoFile = exports.syncRepoFiles = exports.ensureRevokeKey = exports.revokeRepo = exports.sourceRepo = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const revokeSource_1 = require("../revokeSource");
+const sources_1 = require("../sources");
+const git_1 = require("./git");
+function sourceRepo(sourceURL) {
+    return {
+        repoURL: sourceURL,
+        repoPath: (0, sources_1.sourceRepoPath)(sourceURL),
+        keyPath: async () => await (0, sources_1.findSourceKey)(sourceURL) || (0, sources_1.sourceKeyPath)(sourceURL),
+    };
+}
+exports.sourceRepo = sourceRepo;
+function revokeRepo(sourceURL) {
+    return {
+        repoURL: (0, revokeSource_1.revokeRepoURL)(sourceURL),
+        repoPath: (0, revokeSource_1.revokeRepoPath)(sourceURL),
+        keyPath: () => ensureRevokeKey(sourceURL),
+    };
+}
+exports.revokeRepo = revokeRepo;
+/** The revoke repo's key is worked out from the source's, so nothing extra had to be uploaded and
+    nothing extra is stored anywhere it could be taken from. */
+async function ensureRevokeKey(sourceURL) {
+    let existing = await (0, revokeSource_1.findRevokeKey)(sourceURL);
+    if (existing) {
+        return existing;
+    }
+    let sourceKey = await (0, sources_1.findSourceKey)(sourceURL);
+    if (!sourceKey) {
+        throw new Error(`Expected a key for ${sourceURL} at ${(0, sources_1.sourceKeyPath)(sourceURL)}, no such file exists`);
+    }
+    let derived = (0, revokeSource_1.deriveRevokeKey)(await promises_1.default.readFile(sourceKey, "utf8"));
+    let keyPath = (0, revokeSource_1.revokeKeyPath)(sourceURL);
+    await promises_1.default.mkdir(path_1.default.dirname(keyPath), { recursive: true, mode: 0o700 });
+    await promises_1.default.writeFile(keyPath, derived.privateKeyFile, { mode: 0o600 });
+    await promises_1.default.writeFile(`${keyPath}.pub`, `${derived.publicKey} ${revokeSource_1.REVOKE_KEY_LABEL}\n`, { mode: 0o644 });
+    console.log(`Derived the revoke key for ${sourceURL} into ${keyPath}`);
+    return keyPath;
+}
+exports.ensureRevokeKey = ensureRevokeKey;
+async function pathExists(filePath) {
+    try {
+        await promises_1.default.access(filePath);
+        return true;
+    }
+    catch (e) {
+        return false;
+    }
+}
+/** Brings the checkout in line with the remote. Cloned the first time, pulled after that, and the
+    usual case of nothing having changed costs one ref listing and no objects. Throws if the repo
+    cannot be read, so a caller cannot mistake that for an empty repo. */
+async function syncRepoFiles(repo) {
+    let { repoURL, repoPath } = repo;
+    let keyPath = await repo.keyPath();
+    if (!await (0, git_1.repoIsUsable)({ repoPath, keyPath })) {
+        await (0, git_1.cloneRepo)({ repoURL, repoPath, keyPath });
+        return;
+    }
+    let localHead = await (0, git_1.runGit)({ args: ["rev-parse", "HEAD"], cwd: repoPath, keyPath, allowFailure: true });
+    if (localHead.status !== 0) {
+        // A repo with no commits yet, which is the state every revoke repo starts in. There is
+        // nothing to pull and nothing to say.
+        return;
+    }
+    let branch = (await (0, git_1.runGit)({ args: ["rev-parse", "--abbrev-ref", "HEAD"], cwd: repoPath, keyPath })).stdout.trim();
+    let listing = (await (0, git_1.runGit)({ args: ["ls-remote", "origin", branch], cwd: repoPath, keyPath })).stdout;
+    let remoteSha = (listing.split(/\s+/)[0] || "").trim();
+    if (remoteSha && remoteSha === localHead.stdout.trim()) {
+        return;
+    }
+    await (0, git_1.runGit)({ args: ["fetch", "--prune", "origin"], cwd: repoPath, keyPath });
+    await (0, git_1.runGit)({ args: ["reset", "--hard", `origin/${branch}`], cwd: repoPath, keyPath });
+    await (0, git_1.runGit)({ args: ["clean", "-fdx"], cwd: repoPath, keyPath });
+}
+exports.syncRepoFiles = syncRepoFiles;
+/** Throws when there is no checkout at all. "I have never managed to read this repo" and "this
+    repo is empty" are different answers and must not collapse into one. */
+async function requireCheckout(repo) {
+    if (!await pathExists(path_1.default.join(repo.repoPath, ".git"))) {
+        throw new Error(`Expected a checkout of ${repo.repoURL} at ${repo.repoPath}, there is none`);
+    }
+}
+/** One file out of the repo, or undefined if the repo does not have that file. */
+async function readRepoFile(repo, filePath) {
+    await requireCheckout(repo);
+    try {
+        return await promises_1.default.readFile(path_1.default.join(repo.repoPath, filePath), "utf8");
+    }
+    catch (e) {
+        return undefined;
+    }
+}
+exports.readRepoFile = readRepoFile;
+/** The names in one of the repo's directories, or nothing if it has no such directory. */
+async function listRepoDir(repo, directory) {
+    await requireCheckout(repo);
+    try {
+        return (await promises_1.default.readdir(path_1.default.join(repo.repoPath, directory))).sort();
+    }
+    catch (e) {
+        return [];
+    }
+}
+exports.listRepoDir = listRepoDir;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVwb0ZpbGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmVwb0ZpbGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLDJEQUE2QjtBQUM3QixnREFBd0I7QUFDeEIsa0RBQWlJO0FBQ2pJLHdDQUEwRTtBQUMxRSwrQkFBd0Q7QUFleEQsU0FBZ0IsVUFBVSxDQUFDLFNBQWlCO0lBQ3hDLE9BQU87UUFDSCxPQUFPLEVBQUUsU0FBUztRQUNsQixRQUFRLEVBQUUsSUFBQSx3QkFBYyxFQUFDLFNBQVMsQ0FBQztRQUNuQyxPQUFPLEVBQUUsS0FBSyxJQUFJLEVBQUUsQ0FBQyxNQUFNLElBQUEsdUJBQWEsRUFBQyxTQUFTLENBQUMsSUFBSSxJQUFBLHVCQUFhLEVBQUMsU0FBUyxDQUFDO0tBQ2xGLENBQUM7QUFDTixDQUFDO0FBTkQsZ0NBTUM7QUFFRCxTQUFnQixVQUFVLENBQUMsU0FBaUI7SUFDeEMsT0FBTztRQUNILE9BQU8sRUFBRSxJQUFBLDRCQUFhLEVBQUMsU0FBUyxDQUFDO1FBQ2pDLFFBQVEsRUFBRSxJQUFBLDZCQUFjLEVBQUMsU0FBUyxDQUFDO1FBQ25DLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxlQUFlLENBQUMsU0FBUyxDQUFDO0tBQzVDLENBQUM7QUFDTixDQUFDO0FBTkQsZ0NBTUM7QUFFRDsrREFDK0Q7QUFDeEQsS0FBSyxVQUFVLGVBQWUsQ0FBQyxTQUFpQjtJQUNuRCxJQUFJLFFBQVEsR0FBRyxNQUFNLElBQUEsNEJBQWEsRUFBQyxTQUFTLENBQUMsQ0FBQztJQUM5QyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQ1gsT0FBTyxRQUFRLENBQUM7SUFDcEIsQ0FBQztJQUNELElBQUksU0FBUyxHQUFHLE1BQU0sSUFBQSx1QkFBYSxFQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQy9DLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNiLE1BQU0sSUFBSSxLQUFLLENBQUMsc0JBQXNCLFNBQVMsT0FBTyxJQUFBLHVCQUFhLEVBQUMsU0FBUyxDQUFDLHVCQUF1QixDQUFDLENBQUM7SUFDM0csQ0FBQztJQUNELElBQUksT0FBTyxHQUFHLElBQUEsOEJBQWUsRUFBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLElBQUksT0FBTyxHQUFHLElBQUEsNEJBQWEsRUFBQyxTQUFTLENBQUMsQ0FBQztJQUN2QyxNQUFNLGtCQUFFLENBQUMsS0FBSyxDQUFDLGNBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sa0JBQUUsQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxjQUFjLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUNyRSxNQUFNLGtCQUFFLENBQUMsU0FBUyxDQUFDLEdBQUcsT0FBTyxNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUMsU0FBUyxJQUFJLCtCQUFnQixJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUNwRyxPQUFPLENBQUMsR0FBRyxDQUFDLDhCQUE4QixTQUFTLFNBQVMsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUN2RSxPQUFPLE9BQU8sQ0FBQztBQUNuQixDQUFDO0FBaEJELDBDQWdCQztBQUVELEtBQUssVUFBVSxVQUFVLENBQUMsUUFBZ0I7SUFDdEMsSUFBSSxDQUFDO1FBQ0QsTUFBTSxrQkFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMxQixPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7QUFDTCxDQUFDO0FBRUQ7O3lFQUV5RTtBQUNsRSxLQUFLLFVBQVUsYUFBYSxDQUFDLElBQWE7SUFDN0MsSUFBSSxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFDakMsSUFBSSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7SUFDbkMsSUFBSSxDQUFDLE1BQU0sSUFBQSxrQkFBWSxFQUFDLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUM3QyxNQUFNLElBQUEsZUFBUyxFQUFDLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ2hELE9BQU87SUFDWCxDQUFDO0lBQ0QsSUFBSSxTQUFTLEdBQUcsTUFBTSxJQUFBLFlBQU0sRUFBQyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxNQUFNLENBQUMsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUMxRyxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekIsdUZBQXVGO1FBQ3ZGLHNDQUFzQztRQUN0QyxPQUFPO0lBQ1gsQ0FBQztJQUNELElBQUksTUFBTSxHQUFHLENBQUMsTUFBTSxJQUFBLFlBQU0sRUFBQyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxjQUFjLEVBQUUsTUFBTSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ25ILElBQUksT0FBTyxHQUFHLENBQUMsTUFBTSxJQUFBLFlBQU0sRUFBQyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQ3ZHLElBQUksU0FBUyxHQUFHLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN2RCxJQUFJLFNBQVMsSUFBSSxTQUFTLEtBQUssU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1FBQ3JELE9BQU87SUFDWCxDQUFDO0lBQ0QsTUFBTSxJQUFBLFlBQU0sRUFBQyxFQUFFLElBQUksRUFBRSxDQUFDLE9BQU8sRUFBRSxTQUFTLEVBQUUsUUFBUSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQy9FLE1BQU0sSUFBQSxZQUFNLEVBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLFVBQVUsTUFBTSxFQUFFLENBQUMsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDeEYsTUFBTSxJQUFBLFlBQU0sRUFBQyxFQUFFLElBQUksRUFBRSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7QUFDdEUsQ0FBQztBQXRCRCxzQ0FzQkM7QUFFRDsyRUFDMkU7QUFDM0UsS0FBSyxVQUFVLGVBQWUsQ0FBQyxJQUFhO0lBQ3hDLElBQUksQ0FBQyxNQUFNLFVBQVUsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3RELE1BQU0sSUFBSSxLQUFLLENBQUMsMEJBQTBCLElBQUksQ0FBQyxPQUFPLE9BQU8sSUFBSSxDQUFDLFFBQVEsaUJBQWlCLENBQUMsQ0FBQztJQUNqRyxDQUFDO0FBQ0wsQ0FBQztBQUVELGtGQUFrRjtBQUMzRSxLQUFLLFVBQVUsWUFBWSxDQUFDLElBQWEsRUFBRSxRQUFnQjtJQUM5RCxNQUFNLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM1QixJQUFJLENBQUM7UUFDRCxPQUFPLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1QsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztBQUNMLENBQUM7QUFQRCxvQ0FPQztBQUVELDBGQUEwRjtBQUNuRixLQUFLLFVBQVUsV0FBVyxDQUFDLElBQWEsRUFBRSxTQUFpQjtJQUM5RCxNQUFNLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM1QixJQUFJLENBQUM7UUFDRCxPQUFPLENBQUMsTUFBTSxrQkFBRSxDQUFDLE9BQU8sQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzFFLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1QsT0FBTyxFQUFFLENBQUM7SUFDZCxDQUFDO0FBQ0wsQ0FBQztBQVBELGtDQU9DIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGZzIGZyb20gXCJmcy9wcm9taXNlc1wiO1xuaW1wb3J0IHBhdGggZnJvbSBcInBhdGhcIjtcbmltcG9ydCB7IGRlcml2ZVJldm9rZUtleSwgZmluZFJldm9rZUtleSwgUkVWT0tFX0tFWV9MQUJFTCwgcmV2b2tlS2V5UGF0aCwgcmV2b2tlUmVwb1BhdGgsIHJldm9rZVJlcG9VUkwgfSBmcm9tIFwiLi4vcmV2b2tlU291cmNlXCI7XG5pbXBvcnQgeyBmaW5kU291cmNlS2V5LCBzb3VyY2VLZXlQYXRoLCBzb3VyY2VSZXBvUGF0aCB9IGZyb20gXCIuLi9zb3VyY2VzXCI7XG5pbXBvcnQgeyBjbG9uZVJlcG8sIHJlcG9Jc1VzYWJsZSwgcnVuR2l0IH0gZnJvbSBcIi4vZ2l0XCI7XG5cbi8qKiBSZWFkaW5nIGEgcmVwbywgbWFkZSB0byBsb29rIGxpa2UgcmVhZGluZyBhIGRpcmVjdG9yeS4gQSBjYWxsZXIgYXNrcyBmb3IgYSBmaWxlIGFuZCBnZXRzIGl0c1xuICAgIGNvbnRlbnRzOyBrZWVwaW5nIGEgY2hlY2tvdXQgb24gZGlzaywgY2xvbmluZyBpdCBvbmNlIGFuZCBwdWxsaW5nIGl0IHNpbmNlLCBpcyB0aGlzIG1vZHVsZSdzXG4gICAgYnVzaW5lc3MgYW5kIG5vYm9keSBlbHNlJ3MuXG5cbiAgICBOb3RoaW5nIGhlcmUgZXZlciBhbnN3ZXJzIFwidGhlcmUgaXMgbm90aGluZ1wiIHdoZW4gdGhlIHRydXRoIGlzIFwiSSBjb3VsZCBub3QgbG9va1wiLiBBIHJlcG8gdGhhdFxuICAgIGNhbm5vdCBiZSByZWFjaGVkIHRocm93cywgYW5kIHRoZSBjYWxsZXIgc2tpcHMgdGhhdCBzb3VyY2UsIGJlY2F1c2UgcmVhZGluZyBhbiB1bnJlYWNoYWJsZVxuICAgIHJldm9rZSByZXBvIGFzIGVtcHR5IHdvdWxkIHVuLXJldm9rZSBldmVyeSBrZXkgaW4gaXQuICovXG5leHBvcnQgdHlwZSBSZXBvUmVmID0ge1xuICAgIHJlcG9VUkw6IHN0cmluZztcbiAgICByZXBvUGF0aDogc3RyaW5nO1xuICAgIGtleVBhdGg6ICgpID0+IFByb21pc2U8c3RyaW5nPjtcbn07XG5cbmV4cG9ydCBmdW5jdGlvbiBzb3VyY2VSZXBvKHNvdXJjZVVSTDogc3RyaW5nKTogUmVwb1JlZiB7XG4gICAgcmV0dXJuIHtcbiAgICAgICAgcmVwb1VSTDogc291cmNlVVJMLFxuICAgICAgICByZXBvUGF0aDogc291cmNlUmVwb1BhdGgoc291cmNlVVJMKSxcbiAgICAgICAga2V5UGF0aDogYXN5bmMgKCkgPT4gYXdhaXQgZmluZFNvdXJjZUtleShzb3VyY2VVUkwpIHx8IHNvdXJjZUtleVBhdGgoc291cmNlVVJMKSxcbiAgICB9O1xufVxuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlUmVwbyhzb3VyY2VVUkw6IHN0cmluZyk6IFJlcG9SZWYge1xuICAgIHJldHVybiB7XG4gICAgICAgIHJlcG9VUkw6IHJldm9rZVJlcG9VUkwoc291cmNlVVJMKSxcbiAgICAgICAgcmVwb1BhdGg6IHJldm9rZVJlcG9QYXRoKHNvdXJjZVVSTCksXG4gICAgICAgIGtleVBhdGg6ICgpID0+IGVuc3VyZVJldm9rZUtleShzb3VyY2VVUkwpLFxuICAgIH07XG59XG5cbi8qKiBUaGUgcmV2b2tlIHJlcG8ncyBrZXkgaXMgd29ya2VkIG91dCBmcm9tIHRoZSBzb3VyY2Uncywgc28gbm90aGluZyBleHRyYSBoYWQgdG8gYmUgdXBsb2FkZWQgYW5kXG4gICAgbm90aGluZyBleHRyYSBpcyBzdG9yZWQgYW55d2hlcmUgaXQgY291bGQgYmUgdGFrZW4gZnJvbS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBlbnN1cmVSZXZva2VLZXkoc291cmNlVVJMOiBzdHJpbmcpIHtcbiAgICBsZXQgZXhpc3RpbmcgPSBhd2FpdCBmaW5kUmV2b2tlS2V5KHNvdXJjZVVSTCk7XG4gICAgaWYgKGV4aXN0aW5nKSB7XG4gICAgICAgIHJldHVybiBleGlzdGluZztcbiAgICB9XG4gICAgbGV0IHNvdXJjZUtleSA9IGF3YWl0IGZpbmRTb3VyY2VLZXkoc291cmNlVVJMKTtcbiAgICBpZiAoIXNvdXJjZUtleSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEga2V5IGZvciAke3NvdXJjZVVSTH0gYXQgJHtzb3VyY2VLZXlQYXRoKHNvdXJjZVVSTCl9LCBubyBzdWNoIGZpbGUgZXhpc3RzYCk7XG4gICAgfVxuICAgIGxldCBkZXJpdmVkID0gZGVyaXZlUmV2b2tlS2V5KGF3YWl0IGZzLnJlYWRGaWxlKHNvdXJjZUtleSwgXCJ1dGY4XCIpKTtcbiAgICBsZXQga2V5UGF0aCA9IHJldm9rZUtleVBhdGgoc291cmNlVVJMKTtcbiAgICBhd2FpdCBmcy5ta2RpcihwYXRoLmRpcm5hbWUoa2V5UGF0aCksIHsgcmVjdXJzaXZlOiB0cnVlLCBtb2RlOiAwbzcwMCB9KTtcbiAgICBhd2FpdCBmcy53cml0ZUZpbGUoa2V5UGF0aCwgZGVyaXZlZC5wcml2YXRlS2V5RmlsZSwgeyBtb2RlOiAwbzYwMCB9KTtcbiAgICBhd2FpdCBmcy53cml0ZUZpbGUoYCR7a2V5UGF0aH0ucHViYCwgYCR7ZGVyaXZlZC5wdWJsaWNLZXl9ICR7UkVWT0tFX0tFWV9MQUJFTH1cXG5gLCB7IG1vZGU6IDBvNjQ0IH0pO1xuICAgIGNvbnNvbGUubG9nKGBEZXJpdmVkIHRoZSByZXZva2Uga2V5IGZvciAke3NvdXJjZVVSTH0gaW50byAke2tleVBhdGh9YCk7XG4gICAgcmV0dXJuIGtleVBhdGg7XG59XG5cbmFzeW5jIGZ1bmN0aW9uIHBhdGhFeGlzdHMoZmlsZVBhdGg6IHN0cmluZykge1xuICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IGZzLmFjY2VzcyhmaWxlUGF0aCk7XG4gICAgICAgIHJldHVybiB0cnVlO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cbn1cblxuLyoqIEJyaW5ncyB0aGUgY2hlY2tvdXQgaW4gbGluZSB3aXRoIHRoZSByZW1vdGUuIENsb25lZCB0aGUgZmlyc3QgdGltZSwgcHVsbGVkIGFmdGVyIHRoYXQsIGFuZCB0aGVcbiAgICB1c3VhbCBjYXNlIG9mIG5vdGhpbmcgaGF2aW5nIGNoYW5nZWQgY29zdHMgb25lIHJlZiBsaXN0aW5nIGFuZCBubyBvYmplY3RzLiBUaHJvd3MgaWYgdGhlIHJlcG9cbiAgICBjYW5ub3QgYmUgcmVhZCwgc28gYSBjYWxsZXIgY2Fubm90IG1pc3Rha2UgdGhhdCBmb3IgYW4gZW1wdHkgcmVwby4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBzeW5jUmVwb0ZpbGVzKHJlcG86IFJlcG9SZWYpIHtcbiAgICBsZXQgeyByZXBvVVJMLCByZXBvUGF0aCB9ID0gcmVwbztcbiAgICBsZXQga2V5UGF0aCA9IGF3YWl0IHJlcG8ua2V5UGF0aCgpO1xuICAgIGlmICghYXdhaXQgcmVwb0lzVXNhYmxlKHsgcmVwb1BhdGgsIGtleVBhdGggfSkpIHtcbiAgICAgICAgYXdhaXQgY2xvbmVSZXBvKHsgcmVwb1VSTCwgcmVwb1BhdGgsIGtleVBhdGggfSk7XG4gICAgICAgIHJldHVybjtcbiAgICB9XG4gICAgbGV0IGxvY2FsSGVhZCA9IGF3YWl0IHJ1bkdpdCh7IGFyZ3M6IFtcInJldi1wYXJzZVwiLCBcIkhFQURcIl0sIGN3ZDogcmVwb1BhdGgsIGtleVBhdGgsIGFsbG93RmFpbHVyZTogdHJ1ZSB9KTtcbiAgICBpZiAobG9jYWxIZWFkLnN0YXR1cyAhPT0gMCkge1xuICAgICAgICAvLyBBIHJlcG8gd2l0aCBubyBjb21taXRzIHlldCwgd2hpY2ggaXMgdGhlIHN0YXRlIGV2ZXJ5IHJldm9rZSByZXBvIHN0YXJ0cyBpbi4gVGhlcmUgaXNcbiAgICAgICAgLy8gbm90aGluZyB0byBwdWxsIGFuZCBub3RoaW5nIHRvIHNheS5cbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBsZXQgYnJhbmNoID0gKGF3YWl0IHJ1bkdpdCh7IGFyZ3M6IFtcInJldi1wYXJzZVwiLCBcIi0tYWJicmV2LXJlZlwiLCBcIkhFQURcIl0sIGN3ZDogcmVwb1BhdGgsIGtleVBhdGggfSkpLnN0ZG91dC50cmltKCk7XG4gICAgbGV0IGxpc3RpbmcgPSAoYXdhaXQgcnVuR2l0KHsgYXJnczogW1wibHMtcmVtb3RlXCIsIFwib3JpZ2luXCIsIGJyYW5jaF0sIGN3ZDogcmVwb1BhdGgsIGtleVBhdGggfSkpLnN0ZG91dDtcbiAgICBsZXQgcmVtb3RlU2hhID0gKGxpc3Rpbmcuc3BsaXQoL1xccysvKVswXSB8fCBcIlwiKS50cmltKCk7XG4gICAgaWYgKHJlbW90ZVNoYSAmJiByZW1vdGVTaGEgPT09IGxvY2FsSGVhZC5zdGRvdXQudHJpbSgpKSB7XG4gICAgICAgIHJldHVybjtcbiAgICB9XG4gICAgYXdhaXQgcnVuR2l0KHsgYXJnczogW1wiZmV0Y2hcIiwgXCItLXBydW5lXCIsIFwib3JpZ2luXCJdLCBjd2Q6IHJlcG9QYXRoLCBrZXlQYXRoIH0pO1xuICAgIGF3YWl0IHJ1bkdpdCh7IGFyZ3M6IFtcInJlc2V0XCIsIFwiLS1oYXJkXCIsIGBvcmlnaW4vJHticmFuY2h9YF0sIGN3ZDogcmVwb1BhdGgsIGtleVBhdGggfSk7XG4gICAgYXdhaXQgcnVuR2l0KHsgYXJnczogW1wiY2xlYW5cIiwgXCItZmR4XCJdLCBjd2Q6IHJlcG9QYXRoLCBrZXlQYXRoIH0pO1xufVxuXG4vKiogVGhyb3dzIHdoZW4gdGhlcmUgaXMgbm8gY2hlY2tvdXQgYXQgYWxsLiBcIkkgaGF2ZSBuZXZlciBtYW5hZ2VkIHRvIHJlYWQgdGhpcyByZXBvXCIgYW5kIFwidGhpc1xuICAgIHJlcG8gaXMgZW1wdHlcIiBhcmUgZGlmZmVyZW50IGFuc3dlcnMgYW5kIG11c3Qgbm90IGNvbGxhcHNlIGludG8gb25lLiAqL1xuYXN5bmMgZnVuY3Rpb24gcmVxdWlyZUNoZWNrb3V0KHJlcG86IFJlcG9SZWYpIHtcbiAgICBpZiAoIWF3YWl0IHBhdGhFeGlzdHMocGF0aC5qb2luKHJlcG8ucmVwb1BhdGgsIFwiLmdpdFwiKSkpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhIGNoZWNrb3V0IG9mICR7cmVwby5yZXBvVVJMfSBhdCAke3JlcG8ucmVwb1BhdGh9LCB0aGVyZSBpcyBub25lYCk7XG4gICAgfVxufVxuXG4vKiogT25lIGZpbGUgb3V0IG9mIHRoZSByZXBvLCBvciB1bmRlZmluZWQgaWYgdGhlIHJlcG8gZG9lcyBub3QgaGF2ZSB0aGF0IGZpbGUuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcmVhZFJlcG9GaWxlKHJlcG86IFJlcG9SZWYsIGZpbGVQYXRoOiBzdHJpbmcpIHtcbiAgICBhd2FpdCByZXF1aXJlQ2hlY2tvdXQocmVwbyk7XG4gICAgdHJ5IHtcbiAgICAgICAgcmV0dXJuIGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihyZXBvLnJlcG9QYXRoLCBmaWxlUGF0aCksIFwidXRmOFwiKTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIHJldHVybiB1bmRlZmluZWQ7XG4gICAgfVxufVxuXG4vKiogVGhlIG5hbWVzIGluIG9uZSBvZiB0aGUgcmVwbydzIGRpcmVjdG9yaWVzLCBvciBub3RoaW5nIGlmIGl0IGhhcyBubyBzdWNoIGRpcmVjdG9yeS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBsaXN0UmVwb0RpcihyZXBvOiBSZXBvUmVmLCBkaXJlY3Rvcnk6IHN0cmluZykge1xuICAgIGF3YWl0IHJlcXVpcmVDaGVja291dChyZXBvKTtcbiAgICB0cnkge1xuICAgICAgICByZXR1cm4gKGF3YWl0IGZzLnJlYWRkaXIocGF0aC5qb2luKHJlcG8ucmVwb1BhdGgsIGRpcmVjdG9yeSkpKS5zb3J0KCk7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICByZXR1cm4gW107XG4gICAgfVxufVxuIl19
+ /* _JS_SOURCE_HASH = "7340581691819b6036825721d39ae6393118181e0730254e1cead9650e3aa91e"; */