sliftutils 1.7.133 → 1.7.134

package/security/authorizedKeys/unrevoke.ts

@@ -1,29 +1,13 @@
 import fs from "fs/promises";
 import os from "os";
 import path from "path";
-import { runPromise } from "socket-function/src/runPromise";
-import { allowAddresses, keyFingerprint, normalizeKeys, summarizeKey } from "./authorizedKeys";
+import { keyFingerprint, normalizeKeys } from "./authorizedKeys";
 import { deriveRevokeKey, revokeRepoURL } from "./revokeSource";
 import { findSourceKey } from "./sources";
-import { signRepo } from "../signedFiles/signFiles";
-import { readRepoKeys } from "./authorizedKeys";
-import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
-import { getMachines, setMachines } from "../machines/machines";
-import { resolveKeysRepo } from "./keysRepo";
 
-const UNREVOKES_DIR = "unrevoked";
+export const UNREVOKES_DIR = "unrevoked";
 const REVOCATIONS_DIR = "revocations";
-const GIT_KEYWORD = "git";
-const COMMIT_MESSAGE = "unrevoke keys";
-const USAGE = `Usage: yarn unrevoke [keys-repo] [${GIT_KEYWORD}]
-
-Run this in a keys repo, or name one. It reads that repo's revoke repo and writes one unrevoke file
-naming every revocation in it, so the keys are accepted again as each machine picks it up. It signs
-the result, and with ${GIT_KEYWORD} it commits and pushes it too.
-
-Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
-for a key you still want.`;
 
 /** One revocation event. Either an ssh key used from an address it is not allowed from, or a
     machine that talked to us from one. Both are the same shape - an identity and an address - and
@@ -126,183 +110,3 @@ export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: s
         .filter(revocation => keys.some(key => keyFingerprint(key) === revocation.fingerprint))
         .map(revocation => ({ revocation, key: keys.find(key => keyFingerprint(key) === revocation.fingerprint) || "" }));
 }
-
-/** Writes the addresses into the from= list of each key in the repo's authorized_keys, and says
-    which ones were actually new. Only the lines being changed are touched, so comments, ordering
-    and any key not involved come out of this byte for byte the same. */
-async function allowAddressesInRepo(config: {
-    repoPath: string;
-    addressesByFingerprint: Map<string, string[]>;
-}) {
-    let { repoPath, addressesByFingerprint } = config;
-    let added = new Map<string, string[]>();
-    let filePath = path.join(repoPath, "authorized_keys");
-    let contents;
-    try {
-        contents = await fs.readFile(filePath, "utf8");
-    } catch (e) {
-        // A repo holding its keys as separate .pub files. Nothing to edit in one place, so the
-        // caller's listing is all whoever ran this gets.
-        console.log(`No authorized_keys in ${repoPath}, so the addresses were not added to any key.`);
-        return added;
-    }
-    let lines = contents.split("\n");
-    for (let index = 0; index < lines.length; index++) {
-        let fingerprint = keyFingerprint(lines[index]);
-        let addresses = fingerprint && addressesByFingerprint.get(fingerprint);
-        if (!addresses || !addresses.length) {
-            continue;
-        }
-        let result = allowAddresses(lines[index], addresses);
-        lines[index] = result.keyLine;
-        added.set(fingerprint, [...(added.get(fingerprint) || []), ...result.added]);
-    }
-    if ([...added.values()].some(list => list.length)) {
-        await fs.writeFile(filePath, lines.join("\n"));
-    }
-    return added;
-}
-
-/** Puts each machine's addresses back into its own file, which is the machine equivalent of adding
-    an address to a key's from= list: without it the machine is allowed again in principle and
-    still rejected on sight, which revokes it once more. */
-async function allowAddressesForMachines(config: { repoPath: string; revocations: Revocation[] }) {
-    let { repoPath, revocations } = config;
-    let added = new Map<string, string[]>();
-    // Read the whole list, change what these revocations are about, write it back. Setting is by
-    // the whole set, so writing one machine at a time would delete every other machine.
-    let machines = await getMachines(repoPath);
-    for (let revocation of revocations) {
-        let machineId = revocation.machineId;
-        let ip = revocationIP(revocation);
-        if (!machineId || !ip) {
-            continue;
-        }
-        let existing = machines.find(machine => machine.machineId === machineId);
-        if (!existing) {
-            // Removed from the repo since it was revoked, so there is nothing to allow. Deleting a
-            // machine is the stronger statement and it stands.
-            console.log(`machines/${machineId}.json is not in this repo, so ${ip} was not added to it`);
-            continue;
-        }
-        if (existing.ips.includes(ip)) {
-            continue;
-        }
-        existing.ips = [...existing.ips, ip];
-        added.set(machineId, [...(added.get(machineId) || []), ip]);
-    }
-    if (added.size) {
-        await setMachines({ repoPath, machines });
-    }
-    return added;
-}
-
-
-export async function main() {
-    let argv = process.argv.slice(2);
-    let pushToGit = argv.includes(GIT_KEYWORD);
-    let positional = argv.filter(arg => arg !== GIT_KEYWORD);
-    if (positional.length > 1) {
-        throw new Error(`Expected at most a keys repo, was ${positional.length} argument(s)\n${USAGE}`);
-    }
-    let { repoPath, sourceURL: originURL } = await resolveKeysRepo(positional[0]);
-
-    let revocations = await readRemoteRevocations({ sourceURL: originURL });
-    if (!revocations.length) {
-        console.log(`${revokeRepoURL(originURL)} lists no revocations, so there is nothing to undo.`);
-        return;
-    }
-
-    let directory = path.join(repoPath, UNREVOKES_DIR);
-    await fs.mkdir(directory, { recursive: true });
-    let stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    let unrevokeId = `${stamp}-unrevoke`;
-    await fs.writeFile(path.join(directory, `${unrevokeId}.json`), JSON.stringify({
-        unrevokeId,
-        createdAt: new Date().toISOString(),
-        // What this file says: each of these keys is allowed from this address. Pairs, not keys,
-        // and not a blanket "allow everything again" - a key forgiven here for one address is
-        // still revoked the moment it is used from another.
-        allowed: revocations.map(revocation => ({
-            fingerprint: revocation.fingerprint,
-            machineId: revocation.machineId,
-            ip: revocationIP(revocation),
-        })),
-        revocations: revocations.map(revocation => ({
-            revocationId: revocation.revocationId,
-            fingerprint: revocation.fingerprint,
-            machineId: revocation.machineId,
-            ip: revocationIP(revocation),
-            revokedAt: revocation.revokedAt,
-            revokedBy: revocation.revokedBy,
-            attempt: revocation.attempt,
-        })),
-    }, undefined, 4) + "\n");
-
-    // Named the way the notifications name them. A fingerprint is not in authorized_keys and
-    // cannot be worked out by eye, so on its own it tells whoever is reading this nothing about
-    // which of their keys is being talked about.
-    let keysByFingerprint = new Map<string, string>();
-    for (let key of await readRepoKeys(repoPath).catch(() => [] as string[])) {
-        keysByFingerprint.set(keyFingerprint(key), key);
-    }
-    let describeKey = (revocation: Revocation) => {
-        let key = keysByFingerprint.get(revocation.fingerprint || "") || revocation.key || "";
-        return key && summarizeKey(key) || `a key no longer in this repo (${revocation.fingerprint})`;
-    };
-
-    let addressesByIdentity = new Map<string, string[]>();
-    for (let revocation of revocations) {
-        let ip = revocationIP(revocation);
-        let identity = revocationIdentity(revocation);
-        let existing = addressesByIdentity.get(identity) || [];
-        if (ip && !existing.includes(ip)) {
-            existing.push(ip);
-        }
-        addressesByIdentity.set(identity, existing);
-    }
-
-    // Cancelling the revocation on its own would leave sshd refusing that address, and the machines
-    // revoking all over again, so the addresses go into the key's from= list and into the machine's
-    // own file here. We are in the repo that owns both, so there is nothing to hand back to whoever
-    // ran this.
-    let added = await allowAddressesInRepo({ repoPath, addressesByFingerprint: addressesByIdentity });
-    let addedForMachines = await allowAddressesForMachines({ repoPath, revocations });
-
-    console.log("");
-    for (let [identity, addresses] of addressesByIdentity) {
-        let entries = revocations.filter(entry => revocationIdentity(entry) === identity);
-        let machineId = entries[0].machineId;
-        console.log(`Unfreezing ${machineId && `machine ${machineId}` || describeKey(entries[0])}`);
-        console.log(`Allowing IP ${addresses.join(", ") || "(no address recorded)"}`);
-        let addedHere = machineId && addedForMachines.get(machineId) || added.get(identity) || [];
-        if (addedHere.length) {
-            let where = machineId && `machines/${machineId}.json` || `that key's from= list in authorized_keys`;
-            console.log(`  added to ${where}: ${addedHere.join(", ")}`);
-        } else {
-            console.log(`  already allowed from ${addresses.join(", ") || "everywhere"}`);
-        }
-        for (let entry of entries) {
-            console.log(
-                `  frozen by ${entry.revokedBy || "?"} ${entry.revokedAt || "at an unrecorded time"}`
-            );
-        }
-        console.log("");
-    }
-    console.log(`Every other address stays frozen, and any of these used from anywhere else is`);
-    console.log(`frozen again.`);
-
-    // Signed here rather than left as a step to remember. An unrevoke nobody signed does nothing at
-    // all, and the repo would sit there looking done while every machine ignored it.
-    await signRepo({ repoPath });
-
-    if (!pushToGit) {
-        console.log(`\nCommit and push it, and those keys work again as each machine picks it up:`);
-        console.log(`\`\`\`\ngit add -A\ngit commit -m "${COMMIT_MESSAGE}"\ngit push\n\`\`\``);
-        return;
-    }
-    await runPromise(`git add -A`, { cwd: repoPath });
-    await runPromise(`git commit -m "${COMMIT_MESSAGE}"`, { cwd: repoPath });
-    await runPromise(`git push`, { cwd: repoPath });
-    console.log(`\nCommitted and pushed. Those keys work again as each machine picks it up.`);
-}

package/security/authorizedKeys/unrevokeCli.ts

@@ -0,0 +1,204 @@
+import fs from "fs/promises";
+import path from "path";
+import { runPromise } from "socket-function/src/runPromise";
+import { allowAddresses, keyFingerprint, readRepoKeys, summarizeKey } from "./authorizedKeys";
+import { revokeRepoURL } from "./revokeSource";
+import { signRepo } from "../signedFiles/signFiles";
+import { getMachines, setMachines } from "../machines/machines";
+import { resolveKeysRepo } from "./keysRepo";
+import { readRemoteRevocations, Revocation, revocationIdentity, revocationIP, UNREVOKES_DIR } from "./unrevoke";
+
+const GIT_KEYWORD = "git";
+const COMMIT_MESSAGE = "unrevoke keys";
+const USAGE = `Usage: yarn unrevoke [keys-repo] [${GIT_KEYWORD}]
+
+Run this in a keys repo, or name one. It reads that repo's revoke repo and writes one unrevoke file
+naming every revocation in it, so the keys are accepted again as each machine picks it up. It signs
+the result, and with ${GIT_KEYWORD} it commits and pushes it too.
+
+Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
+for a key you still want.`;
+
+/** Writes the addresses into the from= list of each key in the repo's authorized_keys, and says
+    which ones were actually new. Only the lines being changed are touched, so comments, ordering
+    and any key not involved come out of this byte for byte the same. */
+async function allowAddressesInRepo(config: {
+    repoPath: string;
+    addressesByFingerprint: Map<string, string[]>;
+}) {
+    let { repoPath, addressesByFingerprint } = config;
+    let added = new Map<string, string[]>();
+    let filePath = path.join(repoPath, "authorized_keys");
+    let contents;
+    try {
+        contents = await fs.readFile(filePath, "utf8");
+    } catch (e) {
+        // A repo holding its keys as separate .pub files. Nothing to edit in one place, so the
+        // caller's listing is all whoever ran this gets.
+        console.log(`No authorized_keys in ${repoPath}, so the addresses were not added to any key.`);
+        return added;
+    }
+    let lines = contents.split("\n");
+    for (let index = 0; index < lines.length; index++) {
+        let fingerprint = keyFingerprint(lines[index]);
+        let addresses = fingerprint && addressesByFingerprint.get(fingerprint);
+        if (!addresses || !addresses.length) {
+            continue;
+        }
+        let result = allowAddresses(lines[index], addresses);
+        lines[index] = result.keyLine;
+        added.set(fingerprint, [...(added.get(fingerprint) || []), ...result.added]);
+    }
+    if ([...added.values()].some(list => list.length)) {
+        await fs.writeFile(filePath, lines.join("\n"));
+    }
+    return added;
+}
+
+/** Puts each machine's addresses back into its own file, which is the machine equivalent of adding
+    an address to a key's from= list: without it the machine is allowed again in principle and
+    still rejected on sight, which revokes it once more. */
+async function allowAddressesForMachines(config: { repoPath: string; revocations: Revocation[] }) {
+    let { repoPath, revocations } = config;
+    let added = new Map<string, string[]>();
+    // Read the whole list, change what these revocations are about, write it back. Setting is by
+    // the whole set, so writing one machine at a time would delete every other machine.
+    let machines = await getMachines(repoPath);
+    for (let revocation of revocations) {
+        let machineId = revocation.machineId;
+        let ip = revocationIP(revocation);
+        if (!machineId || !ip) {
+            continue;
+        }
+        let existing = machines.find(machine => machine.machineId === machineId);
+        if (!existing) {
+            // Removed from the repo since it was revoked, so there is nothing to allow. Deleting a
+            // machine is the stronger statement and it stands.
+            console.log(`machines/${machineId}.json is not in this repo, so ${ip} was not added to it`);
+            continue;
+        }
+        if (existing.ips.includes(ip)) {
+            continue;
+        }
+        existing.ips = [...existing.ips, ip];
+        added.set(machineId, [...(added.get(machineId) || []), ip]);
+    }
+    if (added.size) {
+        await setMachines({ repoPath, machines });
+    }
+    return added;
+}
+
+async function main() {
+    let argv = process.argv.slice(2);
+    let pushToGit = argv.includes(GIT_KEYWORD);
+    let positional = argv.filter(arg => arg !== GIT_KEYWORD);
+    if (positional.length > 1) {
+        throw new Error(`Expected at most a keys repo, was ${positional.length} argument(s)\n${USAGE}`);
+    }
+    let { repoPath, sourceURL: originURL } = await resolveKeysRepo(positional[0]);
+
+    let revocations = await readRemoteRevocations({ sourceURL: originURL });
+    if (!revocations.length) {
+        console.log(`${revokeRepoURL(originURL)} lists no revocations, so there is nothing to undo.`);
+        return;
+    }
+
+    let directory = path.join(repoPath, UNREVOKES_DIR);
+    await fs.mkdir(directory, { recursive: true });
+    let stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    let unrevokeId = `${stamp}-unrevoke`;
+    await fs.writeFile(path.join(directory, `${unrevokeId}.json`), JSON.stringify({
+        unrevokeId,
+        createdAt: new Date().toISOString(),
+        // What this file says: each of these keys is allowed from this address. Pairs, not keys,
+        // and not a blanket "allow everything again" - a key forgiven here for one address is
+        // still revoked the moment it is used from another.
+        allowed: revocations.map(revocation => ({
+            fingerprint: revocation.fingerprint,
+            machineId: revocation.machineId,
+            ip: revocationIP(revocation),
+        })),
+        revocations: revocations.map(revocation => ({
+            revocationId: revocation.revocationId,
+            fingerprint: revocation.fingerprint,
+            machineId: revocation.machineId,
+            ip: revocationIP(revocation),
+            revokedAt: revocation.revokedAt,
+            revokedBy: revocation.revokedBy,
+            attempt: revocation.attempt,
+        })),
+    }, undefined, 4) + "\n");
+
+    // Named the way the notifications name them. A fingerprint is not in authorized_keys and
+    // cannot be worked out by eye, so on its own it tells whoever is reading this nothing about
+    // which of their keys is being talked about.
+    let keysByFingerprint = new Map<string, string>();
+    for (let key of await readRepoKeys(repoPath).catch(() => [] as string[])) {
+        keysByFingerprint.set(keyFingerprint(key), key);
+    }
+    let describeKey = (revocation: Revocation) => {
+        let key = keysByFingerprint.get(revocation.fingerprint || "") || revocation.key || "";
+        return key && summarizeKey(key) || `a key no longer in this repo (${revocation.fingerprint})`;
+    };
+
+    let addressesByIdentity = new Map<string, string[]>();
+    for (let revocation of revocations) {
+        let ip = revocationIP(revocation);
+        let identity = revocationIdentity(revocation);
+        let existing = addressesByIdentity.get(identity) || [];
+        if (ip && !existing.includes(ip)) {
+            existing.push(ip);
+        }
+        addressesByIdentity.set(identity, existing);
+    }
+
+    // Cancelling the revocation on its own would leave sshd refusing that address, and the machines
+    // revoking all over again, so the addresses go into the key's from= list and into the machine's
+    // own file here. We are in the repo that owns both, so there is nothing to hand back to whoever
+    // ran this.
+    let added = await allowAddressesInRepo({ repoPath, addressesByFingerprint: addressesByIdentity });
+    let addedForMachines = await allowAddressesForMachines({ repoPath, revocations });
+
+    console.log("");
+    for (let [identity, addresses] of addressesByIdentity) {
+        let entries = revocations.filter(entry => revocationIdentity(entry) === identity);
+        let machineId = entries[0].machineId;
+        console.log(`Unfreezing ${machineId && `machine ${machineId}` || describeKey(entries[0])}`);
+        console.log(`Allowing IP ${addresses.join(", ") || "(no address recorded)"}`);
+        let addedHere = machineId && addedForMachines.get(machineId) || added.get(identity) || [];
+        if (addedHere.length) {
+            let where = machineId && `machines/${machineId}.json` || `that key's from= list in authorized_keys`;
+            console.log(`  added to ${where}: ${addedHere.join(", ")}`);
+        } else {
+            console.log(`  already allowed from ${addresses.join(", ") || "everywhere"}`);
+        }
+        for (let entry of entries) {
+            console.log(
+                `  frozen by ${entry.revokedBy || "?"} ${entry.revokedAt || "at an unrecorded time"}`
+            );
+        }
+        console.log("");
+    }
+    console.log(`Every other address stays frozen, and any of these used from anywhere else is`);
+    console.log(`frozen again.`);
+
+    // Signed here rather than left as a step to remember. An unrevoke nobody signed does nothing at
+    // all, and the repo would sit there looking done while every machine ignored it.
+    await signRepo({ repoPath });
+
+    if (!pushToGit) {
+        console.log(`\nCommit and push it, and those keys work again as each machine picks it up:`);
+        console.log(`\`\`\`\ngit add -A\ngit commit -m "${COMMIT_MESSAGE}"\ngit push\n\`\`\``);
+        return;
+    }
+    await runPromise(`git add -A`, { cwd: repoPath });
+    await runPromise(`git commit -m "${COMMIT_MESSAGE}"`, { cwd: repoPath });
+    await runPromise(`git push`, { cwd: repoPath });
+    console.log(`\nCommitted and pushed. Those keys work again as each machine picks it up.`);
+}
+
+main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/security/helpers/dist/paths.ts.cache

@@ -1,4 +1,4 @@
-"use strict";
+"use strict"; var console = (function shimConsole() {             let baseConsole = globalThis.console;             if (typeof window !== "undefined")                 return baseConsole;             let name = __filename.replaceAll("\\", "/").split("/").pop();             let dirName = __dirname.replaceAll("\\", "/").split("/").pop();             let context = {                 __FILE__: __filename,                 __DIR__: __dirname,                 __NAME__: name,                 __DIRNAME__: dirName             };             let newConsole = {                 ...baseConsole             };             for (let shim of ["log", "info", "warn", "error"]) {                 newConsole[shim] = (...args) => {                     args.push(context);                     baseConsole[shim](...args);                 };             }             newConsole.__context = context;             return newConsole;         })(); "use strict";
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
 };
@@ -25,4 +25,4 @@ function expandHome(filePath) {
 }
 exports.expandHome = expandHome;
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGF0aHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwYXRocy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSw0Q0FBb0I7QUFDcEIsZ0RBQXdCO0FBRXhCOztnQ0FFZ0M7QUFDaEMsU0FBZ0IsVUFBVSxDQUFDLFFBQWdCO0lBQ3ZDLElBQUksUUFBUSxLQUFLLEdBQUcsRUFBRSxDQUFDO1FBQ25CLE9BQU8sWUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ3hCLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzFELE9BQU8sY0FBSSxDQUFDLElBQUksQ0FBQyxZQUFFLENBQUMsT0FBTyxFQUFFLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMzQix5RkFBeUY7UUFDekYsa0RBQWtEO1FBQ2xELE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLFFBQVEsaUVBQWlFLENBQUMsQ0FBQztJQUN0SSxDQUFDO0lBQ0QsT0FBTyxjQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2xDLENBQUM7QUFiRCxnQ0FhQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBvcyBmcm9tIFwib3NcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5cbi8qKiBXaW5kb3dzIHNoZWxscyBkbyBub3QgZXhwYW5kIH4gdGhlbXNlbHZlcywgYW5kIGh1bnRpbmcgZG93biB5b3VyIGhvbWUgZm9sZGVyIGJ5IGhhbmQgaXNcbiAgICBhbm5veWluZywgc28gd2UgZXhwYW5kIGl0IG9uIGV2ZXJ5IHBsYXRmb3JtLiBCb3RoIHNlcGFyYXRvcnMgYXJlIGFjY2VwdGVkLCBiZWNhdXNlIGEgV2luZG93c1xuICAgIHVzZXIgbWF5IHR5cGUgZWl0aGVyIG9uZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBleHBhbmRIb21lKGZpbGVQYXRoOiBzdHJpbmcpIHtcbiAgICBpZiAoZmlsZVBhdGggPT09IFwiflwiKSB7XG4gICAgICAgIHJldHVybiBvcy5ob21lZGlyKCk7XG4gICAgfVxuICAgIGlmIChmaWxlUGF0aC5zdGFydHNXaXRoKFwifi9cIikgfHwgZmlsZVBhdGguc3RhcnRzV2l0aChcIn5cXFxcXCIpKSB7XG4gICAgICAgIHJldHVybiBwYXRoLmpvaW4ob3MuaG9tZWRpcigpLCBmaWxlUGF0aC5zbGljZSgyKSk7XG4gICAgfVxuICAgIGlmIChmaWxlUGF0aC5zdGFydHNXaXRoKFwiflwiKSkge1xuICAgICAgICAvLyB+b3RoZXJ1c2VyIG5lZWRzIGFuIGFjY291bnQgZGF0YWJhc2Ugd2UgY2Fubm90IHJlYWQgcG9ydGFibHksIGFuZCBxdWlldGx5IHJlc29sdmluZyBpdFxuICAgICAgICAvLyB0byB0aGUgd3JvbmcgaG9tZSB3b3VsZCBiZSB3b3JzZSB0aGFuIHJlZnVzaW5nLlxuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIH4gb3IgYW4gb3JkaW5hcnkgcGF0aCwgd2FzICR7ZmlsZVBhdGh9LiBSZWZlcnJpbmcgdG8gYW5vdGhlciB1c2VyJ3MgaG9tZSB3aXRoIH5uYW1lIGlzIG5vdCBzdXBwb3J0ZWQuYCk7XG4gICAgfVxuICAgIHJldHVybiBwYXRoLnJlc29sdmUoZmlsZVBhdGgpO1xufVxuIl19
- /* _JS_SOURCE_HASH = "aa5698729d5def416d177e211ac514eed7d8c8fcb796c68dcc520ddf0d83526b"; */
+ /* _JS_SOURCE_HASH = "493654cc4781cc00e46bb1f87e8f539ef3884ca93d7ce6173bbd46a2bd648be8"; */

package/security/helpers/dist/remoteSSH.ts.cache

@@ -1,4 +1,4 @@
-"use strict";
+"use strict"; var console = (function shimConsole() {             let baseConsole = globalThis.console;             if (typeof window !== "undefined")                 return baseConsole;             let name = __filename.replaceAll("\\", "/").split("/").pop();             let dirName = __dirname.replaceAll("\\", "/").split("/").pop();             let context = {                 __FILE__: __filename,                 __DIR__: __dirname,                 __NAME__: name,                 __DIRNAME__: dirName             };             let newConsole = {                 ...baseConsole             };             for (let shim of ["log", "info", "warn", "error"]) {                 newConsole[shim] = (...args) => {                     args.push(context);                     baseConsole[shim](...args);                 };             }             newConsole.__context = context;             return newConsole;         })(); "use strict";
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
 //exports.remoteCommandExists = exports.writeRemoteFile = exports.readRemoteFile = exports.runOverSSH = exports.describeHost = exports.THIS_MACHINE = exports.SUDO_PREAMBLE = void 0;
 const spawn_1 = require("./spawn");
@@ -97,4 +97,4 @@ async function remoteCommandExists(config) {
 }
 exports.remoteCommandExists = remoteCommandExists;
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlU1NILmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmVtb3RlU1NILnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUF1QztBQUV2QyxNQUFNLG1CQUFtQixHQUFHLEVBQUUsQ0FBQztBQUMvQixNQUFNLGFBQWEsR0FBRyx1QkFBdUIsQ0FBQztBQUM5QyxNQUFNLGNBQWMsR0FBRyx3QkFBd0IsQ0FBQztBQUNoRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQztBQUVsQyw4RUFBOEU7QUFDakUsUUFBQSxhQUFhLEdBQUcsMkRBQTJELENBQUM7QUFFekY7OzZCQUU2QjtBQUNoQixRQUFBLFlBQVksR0FBRyxFQUFFLENBQUM7QUFFL0IsU0FBZ0IsWUFBWSxDQUFDLElBQVk7SUFDckMsT0FBTyxJQUFJLElBQUksY0FBYyxDQUFDO0FBQ2xDLENBQUM7QUFGRCxvQ0FFQztBQUVEO3dGQUN3RjtBQUNqRixLQUFLLFVBQVUsVUFBVSxDQUFDLE1BQWdGO0lBQzdHLElBQUksRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDbkQsSUFBSSxNQUFNLEdBQUcsTUFBTSxJQUFBLG9CQUFZLEVBQUM7UUFDNUIsT0FBTyxFQUFFLElBQUksSUFBSSxLQUFLLElBQUksSUFBSTtRQUM5QixJQUFJLEVBQUUsSUFBSSxJQUFJO1lBQ1YsSUFBSSxFQUFFLGVBQWU7WUFDckIsSUFBSSxFQUFFLGtCQUFrQixtQkFBbUIsRUFBRTtZQUM3QyxJQUFJO1lBQ0osTUFBTTtTQUNULElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDO1FBQ25CLEtBQUs7UUFDTCxhQUFhLEVBQUUsQ0FBQyxZQUFZO0tBQy9CLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsWUFBWSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkMsSUFBSSxNQUFNLEdBQUcsSUFBSTtlQUNWLGtDQUFrQyxJQUFJLHNEQUFzRDtlQUM1RixFQUFFLENBQUM7UUFDVixNQUFNLElBQUksS0FBSyxDQUNYLDBCQUEwQixZQUFZLENBQUMsSUFBSSxDQUFDLG1CQUFtQixNQUFNLENBQUMsTUFBTSxJQUFJLE1BQU0sSUFBSTtjQUN4RixHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLENBQ2hGLENBQUM7SUFDTixDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxJQUFJLEVBQUUsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUMvRixDQUFDO0FBMUJELGdDQTBCQztBQUVEO2lCQUNpQjtBQUNWLEtBQUssVUFBVSxjQUFjLENBQUMsTUFBMEM7SUFDM0UsSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDaEMsSUFBSSxNQUFNLEdBQUcsQ0FBQyxNQUFNLFVBQVUsQ0FBQztRQUMzQixJQUFJO1FBQ0osTUFBTSxFQUFFLEdBQUcscUJBQWE7b0JBQ1osUUFBUTtZQUNoQixhQUFhO2lCQUNSLFFBQVE7O1lBRWIsY0FBYztHQUN2QjtLQUNFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUNYLElBQUksWUFBWSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDeEMsSUFBSSxNQUFNLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDbEQsSUFBSSxNQUFNLEtBQUssY0FBYyxFQUFFLENBQUM7UUFDNUIsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELElBQUksTUFBTSxLQUFLLGFBQWEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxLQUFLLENBQUMsWUFBWSxhQUFhLE9BQU8sY0FBYyxTQUFTLElBQUksU0FBUyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNsSSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLFlBQVksR0FBRyxDQUFDLENBQUMsQ0FBQztBQUMxQyxDQUFDO0FBckJELHdDQXFCQztBQUVNLEtBQUssVUFBVSxlQUFlLENBQUMsTUFNckM7SUFDRyxJQUFJLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNuRSxJQUFJLFNBQVMsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxRQUFRLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDN0QsTUFBTSxVQUFVLENBQUM7UUFDYixJQUFJO1FBQ0osc0ZBQXNGO1FBQ3RGLGtEQUFrRDtRQUNsRCxLQUFLLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDO1FBQ3RDLE1BQU0sRUFBRSxHQUFHLHFCQUFhOztrQkFFZCxTQUFTO2NBQ2IsYUFBYSxLQUFLLFNBQVM7YUFDNUIsUUFBUTtjQUNQLFFBQVEsS0FBSyxRQUFRLEdBQUc7S0FDakMsQ0FBQyxDQUFDO0FBQ1AsQ0FBQztBQXJCRCwwQ0FxQkM7QUFFTSxLQUFLLFVBQVUsbUJBQW1CLENBQUMsTUFBeUM7SUFDL0UsSUFBSSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDL0IsSUFBSSxNQUFNLEdBQUcsTUFBTSxVQUFVLENBQUM7UUFDMUIsSUFBSTtRQUNKLE1BQU0sRUFBRSxlQUFlLE9BQU8sMkNBQTJDO1FBQ3pFLFlBQVksRUFBRSxJQUFJO0tBQ3JCLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxLQUFLLENBQUM7QUFDMUMsQ0FBQztBQVJELGtEQVFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgc3Bhd25Qcm9taXNlIH0gZnJvbSBcIi4vc3Bhd25cIjtcblxuY29uc3QgU1NIX0NPTk5FQ1RfVElNRU9VVCA9IDEwO1xuY29uc3QgRVhJU1RTX01BUktFUiA9IFwiX19QT1JUU0VDVVJFX0VYSVNUU19fXCI7XG5jb25zdCBNSVNTSU5HX01BUktFUiA9IFwiX19QT1JUU0VDVVJFX01JU1NJTkdfX1wiO1xuY29uc3QgTUFYX0VSUk9SX0JPRFlfTEVOR1RIID0gNTAwO1xuXG4vLyAvZXRjIGlzIHJvb3Qgb3duZWQsIHNvIGZhbGwgYmFjayB0byBzdWRvIHdoZW5ldmVyIHRoZSBTU0ggdXNlciBpcyBub3Qgcm9vdC5cbmV4cG9ydCBjb25zdCBTVURPX1BSRUFNQkxFID0gYFNVRE89XCJcIjsgaWYgWyBcIiQoaWQgLXUpXCIgLW5lIDAgXTsgdGhlbiBTVURPPVwic3VkbyAtblwiOyBmaWA7XG5cbi8qKiBObyBob3N0IG1lYW5zIHRoaXMgbWFjaGluZSwgc28gdGhlIHZlcnkgc2FtZSBzY3JpcHQgcnVucyB3aXRoIG5vdGhpbmcgaW4gZnJvbnQgb2YgaXQuIExvY2FsIGFuZFxuICAgIHJlbW90ZSB0aGVuIGRvIGV4YWN0bHkgdGhlIHNhbWUgdGhpbmcsIHJhdGhlciB0aGFuIGJlaW5nIHR3byBwaWVjZXMgb2YgY29kZSB0aGF0IGhhdmUgdG8gYmUga2VwdFxuICAgIHNheWluZyB0aGUgc2FtZSB0aGluZy4gKi9cbmV4cG9ydCBjb25zdCBUSElTX01BQ0hJTkUgPSBcIlwiO1xuXG5leHBvcnQgZnVuY3Rpb24gZGVzY3JpYmVIb3N0KGhvc3Q6IHN0cmluZykge1xuICAgIHJldHVybiBob3N0IHx8IFwidGhpcyBtYWNoaW5lXCI7XG59XG5cbi8qKiBUaGUgaG9zdCBzdHJpbmcgaXMgaGFuZGVkIHRvIHNzaCB1bnRvdWNoZWQuIFVzZXJzLCBrZXlzIGFuZCBwb3J0cyBiZWxvbmcgaW4gdGhlIGNhbGxlcidzIHNzaFxuICAgIGNvbmZpZywgc28gQmF0Y2hNb2RlIG1ha2VzIGEgbWlzc2luZyBzZXR1cCBmYWlsIGltbWVkaWF0ZWx5IGluc3RlYWQgb2YgcHJvbXB0aW5nLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJ1bk92ZXJTU0goY29uZmlnOiB7IGhvc3Q6IHN0cmluZzsgc2NyaXB0OiBzdHJpbmc7IGlucHV0Pzogc3RyaW5nOyBhbGxvd0ZhaWx1cmU/OiBib29sZWFuIH0pIHtcbiAgICBsZXQgeyBob3N0LCBzY3JpcHQsIGlucHV0LCBhbGxvd0ZhaWx1cmUgfSA9IGNvbmZpZztcbiAgICBsZXQgcmVzdWx0ID0gYXdhaXQgc3Bhd25Qcm9taXNlKHtcbiAgICAgICAgY29tbWFuZDogaG9zdCAmJiBcInNzaFwiIHx8IFwic2hcIixcbiAgICAgICAgYXJnczogaG9zdCAmJiBbXG4gICAgICAgICAgICBcIi1vXCIsIFwiQmF0Y2hNb2RlPXllc1wiLFxuICAgICAgICAgICAgXCItb1wiLCBgQ29ubmVjdFRpbWVvdXQ9JHtTU0hfQ09OTkVDVF9USU1FT1VUfWAsXG4gICAgICAgICAgICBob3N0LFxuICAgICAgICAgICAgc2NyaXB0LFxuICAgICAgICBdIHx8IFtcIi1jXCIsIHNjcmlwdF0sXG4gICAgICAgIGlucHV0LFxuICAgICAgICBpbmhlcml0U3RkZXJyOiAhYWxsb3dGYWlsdXJlLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuZXJyb3IpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCB0byBydW4gYWdhaW5zdCAke2Rlc2NyaWJlSG9zdChob3N0KX0sIGZhaWxlZCB3aXRoICR7cmVzdWx0LmVycm9yLm1lc3NhZ2V9YCk7XG4gICAgfVxuICAgIGlmIChyZXN1bHQuc3RhdHVzICE9PSAwICYmICFhbGxvd0ZhaWx1cmUpIHtcbiAgICAgICAgbGV0IGFkdmljZSA9IGhvc3RcbiAgICAgICAgICAgICYmIGAgTm9uLWludGVyYWN0aXZlIHNzaCBhY2Nlc3MgdG8gJHtob3N0fSBoYXMgdG8gd29yayBvbiBpdHMgb3duIC0gZml4IGl0IGluIHlvdXIgc3NoIGNvbmZpZy5gXG4gICAgICAgICAgICB8fCBcIlwiO1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgdGhlIHNjcmlwdCBvbiAke2Rlc2NyaWJlSG9zdChob3N0KX0gdG8gZXhpdCAwLCB3YXMgJHtyZXN1bHQuc3RhdHVzfS4ke2FkdmljZX1cXG5gXG4gICAgICAgICAgICArIGAkeyhyZXN1bHQuc3Rkb3V0ICsgcmVzdWx0LnN0ZGVycikudHJpbSgpLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICByZXR1cm4geyBzdGRvdXQ6IHJlc3VsdC5zdGRvdXQgfHwgXCJcIiwgc3RkZXJyOiByZXN1bHQuc3RkZXJyIHx8IFwiXCIsIHN0YXR1czogcmVzdWx0LnN0YXR1cyB9O1xufVxuXG4vKiogUmV0dXJucyB1bmRlZmluZWQgd2hlbiB0aGUgZmlsZSBkb2VzIG5vdCBleGlzdCwgc28gYSBtaXNzaW5nIGZpbGUgcmVhZHMgZGlmZmVyZW50bHkgZnJvbSBhblxuICAgIGVtcHR5IG9uZS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVtb3RlRmlsZShjb25maWc6IHsgaG9zdDogc3RyaW5nOyBmaWxlUGF0aDogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBob3N0LCBmaWxlUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBvdXRwdXQgPSAoYXdhaXQgcnVuT3ZlclNTSCh7XG4gICAgICAgIGhvc3QsXG4gICAgICAgIHNjcmlwdDogYCR7U1VET19QUkVBTUJMRX1cbmlmICRTVURPIHRlc3QgLWYgXCIke2ZpbGVQYXRofVwiOyB0aGVuXG4gICAgZWNobyBcIiR7RVhJU1RTX01BUktFUn1cIlxuICAgICRTVURPIGNhdCBcIiR7ZmlsZVBhdGh9XCJcbmVsc2VcbiAgICBlY2hvIFwiJHtNSVNTSU5HX01BUktFUn1cIlxuZmlgLFxuICAgIH0pKS5zdGRvdXQ7XG4gICAgbGV0IG5ld2xpbmVJbmRleCA9IG91dHB1dC5pbmRleE9mKFwiXFxuXCIpO1xuICAgIGxldCBtYXJrZXIgPSBvdXRwdXQuc2xpY2UoMCwgbmV3bGluZUluZGV4KS50cmltKCk7XG4gICAgaWYgKG1hcmtlciA9PT0gTUlTU0lOR19NQVJLRVIpIHtcbiAgICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9XG4gICAgaWYgKG1hcmtlciAhPT0gRVhJU1RTX01BUktFUikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7RVhJU1RTX01BUktFUn0gb3IgJHtNSVNTSU5HX01BUktFUn0gZnJvbSAke2hvc3R9LCB3YXMgJHtvdXRwdXQuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIG91dHB1dC5zbGljZShuZXdsaW5lSW5kZXggKyAxKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdyaXRlUmVtb3RlRmlsZShjb25maWc6IHtcbiAgICBob3N0OiBzdHJpbmc7XG4gICAgZmlsZVBhdGg6IHN0cmluZztcbiAgICBjb250ZW50czogc3RyaW5nO1xuICAgIGZpbGVNb2RlOiBzdHJpbmc7XG4gICAgZGlyZWN0b3J5TW9kZTogc3RyaW5nO1xufSkge1xuICAgIGxldCB7IGhvc3QsIGZpbGVQYXRoLCBjb250ZW50cywgZmlsZU1vZGUsIGRpcmVjdG9yeU1vZGUgfSA9IGNvbmZpZztcbiAgICBsZXQgZGlyZWN0b3J5ID0gZmlsZVBhdGguc2xpY2UoMCwgZmlsZVBhdGgubGFzdEluZGV4T2YoXCIvXCIpKTtcbiAgICBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgLy8gRGVwbG95aW5nIGZyb20gV2luZG93cyBtdXN0IG5vdCBjYXJyeSBDUkxGIG9udG8gdGhlIHRhcmdldCwgd2hlcmUgaXQgYnJlYWtzIHN5c3RlbWRcbiAgICAgICAgLy8gdW5pdHMgYW5kIG1ha2VzIHByaXZhdGUga2V5cyB1bnJlYWRhYmxlIHRvIHNzaC5cbiAgICAgICAgaW5wdXQ6IGNvbnRlbnRzLnJlcGxhY2UoL1xcclxcbi9nLCBcIlxcblwiKSxcbiAgICAgICAgc2NyaXB0OiBgJHtTVURPX1BSRUFNQkxFfVxuc2V0IC1lXG4kU1VETyBta2RpciAtcCBcIiR7ZGlyZWN0b3J5fVwiXG4kU1VETyBjaG1vZCAke2RpcmVjdG9yeU1vZGV9IFwiJHtkaXJlY3Rvcnl9XCJcbiRTVURPIHRlZSBcIiR7ZmlsZVBhdGh9XCIgPiAvZGV2L251bGxcbiRTVURPIGNobW9kICR7ZmlsZU1vZGV9IFwiJHtmaWxlUGF0aH1cImAsXG4gICAgfSk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZW1vdGVDb21tYW5kRXhpc3RzKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IGNvbW1hbmQ6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgaG9zdCwgY29tbWFuZCB9ID0gY29uZmlnO1xuICAgIGxldCByZXN1bHQgPSBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgc2NyaXB0OiBgY29tbWFuZCAtdiBcIiR7Y29tbWFuZH1cIiA+IC9kZXYvbnVsbCAyPiYxICYmIGVjaG8geWVzIHx8IGVjaG8gbm9gLFxuICAgICAgICBhbGxvd0ZhaWx1cmU6IHRydWUsXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlc3VsdC5zdGRvdXQudHJpbSgpID09PSBcInllc1wiO1xufVxuIl19
- /* _JS_SOURCE_HASH = "50b1a08f2aa4b96f04f676f20c516bc6c2897a47ad7c12729c0f651735c71057"; */
+ /* _JS_SOURCE_HASH = "2bb084f8935f8ec03fde1d65be1a14ffcc51f8bbfefc04b9363fea0639a2a721"; */

package/security/helpers/dist/spawn.ts.cache

@@ -1,4 +1,4 @@
-"use strict";
+"use strict"; var console = (function shimConsole() {             let baseConsole = globalThis.console;             if (typeof window !== "undefined")                 return baseConsole;             let name = __filename.replaceAll("\\", "/").split("/").pop();             let dirName = __dirname.replaceAll("\\", "/").split("/").pop();             let context = {                 __FILE__: __filename,                 __DIR__: __dirname,                 __NAME__: name,                 __DIRNAME__: dirName             };             let newConsole = {                 ...baseConsole             };             for (let shim of ["log", "info", "warn", "error"]) {                 newConsole[shim] = (...args) => {                     args.push(context);                     baseConsole[shim](...args);                 };             }             newConsole.__context = context;             return newConsole;         })(); "use strict";
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
 //exports.spawnPromise = void 0;
 const child_process_1 = require("child_process");
@@ -31,4 +31,4 @@ function spawnPromise(config) {
 }
 exports.spawnPromise = spawnPromise;
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3Bhd24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJzcGF3bi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxpREFBc0M7QUFFdEMsMEhBQTBIO0FBQzFILGtGQUFrRjtBQUVsRjs7MEZBRTBGO0FBQzFGLFNBQWdCLFlBQVksQ0FBQyxNQU81QjtJQUNHLElBQUksRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLFdBQVcsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUN2RSxPQUFPLElBQUksT0FBTyxDQUEyRixPQUFPLENBQUMsRUFBRTs7UUFDbkgsSUFBSSxLQUFLLEdBQUcsSUFBQSxxQkFBSyxFQUFDLE9BQU8sRUFBRSxJQUFJLEVBQUU7WUFDN0IsR0FBRztZQUNILEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsYUFBYSxJQUFJLFNBQVMsSUFBSSxNQUFNLENBQUM7U0FDaEUsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxNQUFNLEdBQUcsRUFBRSxDQUFDO1FBQ2hCLElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztRQUNoQiw2RUFBNkU7UUFDN0UsSUFBSSxLQUFLLEdBQUcsV0FBVyxJQUFJLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxJQUFJLFNBQVMsQ0FBQztRQUM3RixLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxLQUFLLElBQUksWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDdEQsTUFBQSxLQUFLLENBQUMsTUFBTSwwQ0FBRSxFQUFFLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxDQUFDO1FBQ25ELE1BQUEsS0FBSyxDQUFDLE1BQU0sMENBQUUsRUFBRSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQztRQUNuRCxLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDbEYsS0FBSyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLGFBQU4sTUFBTSxjQUFOLE1BQU0sR0FBSSxTQUFTLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN4Ryw0RUFBNEU7UUFDNUUsTUFBQSxLQUFLLENBQUMsS0FBSywwQ0FBRSxFQUFFLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzFDLE1BQUEsS0FBSyxDQUFDLEtBQUssMENBQUUsR0FBRyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNsQyxDQUFDLENBQUMsQ0FBQztBQUNQLENBQUM7QUEzQkQsb0NBMkJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgc3Bhd24gfSBmcm9tIFwiY2hpbGRfcHJvY2Vzc1wiO1xuXG4vLyBQT1JURUQgQ09ERTogc2VjdXJpdHkvYXV0aG9yaXplZEtleXMvZGFlbW9uL3BvcnRzZWN1cmVEYWVtb24uanMgY29udGFpbnMgYSBwbGFpbiBKUyBwb3J0IG9mIHNwYXduUHJvbWlzZSwgc28gaXQgY2FuIHJ1blxuLy8gd2l0aCBubyBkZXBlbmRlbmNpZXMuIElmIHlvdSBjaGFuZ2Ugb25lLCBtYWtlIHRoZSBtYXRjaGluZyBjaGFuZ2UgaW4gdGhlIG90aGVyLlxuXG4vKiogQW4gYXJndW1lbnQgbGlzdCByYXRoZXIgdGhhbiBhIHNoZWxsIHN0cmluZywgc28gaG9zdG5hbWVzIGFuZCBwYXRocyBjYW4gbmV2ZXIgYmUgcGFyc2VkIGFzXG4gICAgc2hlbGwgc3ludGF4LiBSZXNvbHZlcyB3aXRoIHRoZSBleGl0IGNvZGUgaW5zdGVhZCBvZiB0aHJvd2luZywgY2FsbGVycyBkZWNpZGUgd2hhdCBhIGZhaWx1cmVcbiAgICBtZWFucy4gYGluaGVyaXRTdGRlcnJgIGxldHMgYSBjaGlsZCdzIG93biBlcnJvcnMgcmVhY2ggdGhlIHRlcm1pbmFsIGFzIHRoZXkgaGFwcGVuLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHNwYXduUHJvbWlzZShjb25maWc6IHtcbiAgICBjb21tYW5kOiBzdHJpbmc7XG4gICAgYXJnczogc3RyaW5nW107XG4gICAgY3dkPzogc3RyaW5nO1xuICAgIGlucHV0Pzogc3RyaW5nO1xuICAgIGluaGVyaXRTdGRlcnI/OiBib29sZWFuO1xuICAgIHRpbWVvdXRUaW1lPzogbnVtYmVyO1xufSkge1xuICAgIGxldCB7IGNvbW1hbmQsIGFyZ3MsIGN3ZCwgaW5wdXQsIGluaGVyaXRTdGRlcnIsIHRpbWVvdXRUaW1lIH0gPSBjb25maWc7XG4gICAgcmV0dXJuIG5ldyBQcm9taXNlPHsgc3Rkb3V0OiBzdHJpbmc7IHN0ZGVycjogc3RyaW5nOyBzdGF0dXM6IG51bWJlciB8IHVuZGVmaW5lZDsgZXJyb3I6IEVycm9yIHwgdW5kZWZpbmVkIH0+KHJlc29sdmUgPT4ge1xuICAgICAgICBsZXQgY2hpbGQgPSBzcGF3bihjb21tYW5kLCBhcmdzLCB7XG4gICAgICAgICAgICBjd2QsXG4gICAgICAgICAgICBzdGRpbzogW1wicGlwZVwiLCBcInBpcGVcIiwgaW5oZXJpdFN0ZGVyciAmJiBcImluaGVyaXRcIiB8fCBcInBpcGVcIl0sXG4gICAgICAgIH0pO1xuICAgICAgICBsZXQgc3Rkb3V0ID0gXCJcIjtcbiAgICAgICAgbGV0IHN0ZGVyciA9IFwiXCI7XG4gICAgICAgIC8vIEEgY29tbWFuZCB0aGF0IG5ldmVyIHJldHVybnMgd291bGQgb3RoZXJ3aXNlIGhvbGQgdXAgZXZlcnl0aGluZyBiZWhpbmQgaXQuXG4gICAgICAgIGxldCB0aW1lciA9IHRpbWVvdXRUaW1lICYmIHNldFRpbWVvdXQoKCkgPT4gY2hpbGQua2lsbChcIlNJR0tJTExcIiksIHRpbWVvdXRUaW1lKSB8fCB1bmRlZmluZWQ7XG4gICAgICAgIGNoaWxkLm9uKFwiY2xvc2VcIiwgKCkgPT4gdGltZXIgJiYgY2xlYXJUaW1lb3V0KHRpbWVyKSk7XG4gICAgICAgIGNoaWxkLnN0ZG91dD8ub24oXCJkYXRhXCIsIGNodW5rID0+IHN0ZG91dCArPSBjaHVuayk7XG4gICAgICAgIGNoaWxkLnN0ZGVycj8ub24oXCJkYXRhXCIsIGNodW5rID0+IHN0ZGVyciArPSBjaHVuayk7XG4gICAgICAgIGNoaWxkLm9uKFwiZXJyb3JcIiwgZXJyb3IgPT4gcmVzb2x2ZSh7IHN0ZG91dCwgc3RkZXJyLCBzdGF0dXM6IHVuZGVmaW5lZCwgZXJyb3IgfSkpO1xuICAgICAgICBjaGlsZC5vbihcImNsb3NlXCIsIHN0YXR1cyA9PiByZXNvbHZlKHsgc3Rkb3V0LCBzdGRlcnIsIHN0YXR1czogc3RhdHVzID8/IHVuZGVmaW5lZCwgZXJyb3I6IHVuZGVmaW5lZCB9KSk7XG4gICAgICAgIC8vIEEgY2hpbGQgdGhhdCBleGl0cyBiZWZvcmUgcmVhZGluZyBldmVyeXRoaW5nIHdvdWxkIG90aGVyd2lzZSByYWlzZSBFUElQRS5cbiAgICAgICAgY2hpbGQuc3RkaW4/Lm9uKFwiZXJyb3JcIiwgKCkgPT4gdW5kZWZpbmVkKTtcbiAgICAgICAgY2hpbGQuc3RkaW4/LmVuZChpbnB1dCB8fCBcIlwiKTtcbiAgICB9KTtcbn1cbiJdfQ==
- /* _JS_SOURCE_HASH = "148887f3afb42a330df49eb955396403fab2e558c30741383b1a17b19a134288"; */
+ /* _JS_SOURCE_HASH = "d2f47a3b98d8645feac1558871c6670685fd9583f40bccb7d60d8f0ced0051ac"; */

package/security/helpers/remoteSSH.d.ts

@@ -0,0 +1,35 @@
+export declare const SUDO_PREAMBLE = "SUDO=\"\"; if [ \"$(id -u)\" -ne 0 ]; then SUDO=\"sudo -n\"; fi";
+/** No host means this machine, so the very same script runs with nothing in front of it. Local and
+    remote then do exactly the same thing, rather than being two pieces of code that have to be kept
+    saying the same thing. */
+export declare const THIS_MACHINE = "";
+export declare function describeHost(host: string): string;
+/** The host string is handed to ssh untouched. Users, keys and ports belong in the caller's ssh
+    config, so BatchMode makes a missing setup fail immediately instead of prompting. */
+export declare function runOverSSH(config: {
+    host: string;
+    script: string;
+    input?: string;
+    allowFailure?: boolean;
+}): Promise<{
+    stdout: string;
+    stderr: string;
+    status: number | undefined;
+}>;
+/** Returns undefined when the file does not exist, so a missing file reads differently from an
+    empty one. */
+export declare function readRemoteFile(config: {
+    host: string;
+    filePath: string;
+}): Promise<string | undefined>;
+export declare function writeRemoteFile(config: {
+    host: string;
+    filePath: string;
+    contents: string;
+    fileMode: string;
+    directoryMode: string;
+}): Promise<void>;
+export declare function remoteCommandExists(config: {
+    host: string;
+    command: string;
+}): Promise<boolean>;

package/security/keys/deriveKey.d.ts

@@ -13,4 +13,3 @@ export declare function deriveEd25519Key(config: {
     seed: Buffer;
     publicKey: Buffer;
 };
-export declare function main(): Promise<void>;

package/security/keys/deriveKey.ts

@@ -1,14 +1,5 @@
 import crypto from "crypto";
-import fs from "fs/promises";
-import { expandHome } from "../helpers/paths";
-import { formatOpenSSHPrivateKey, formatPublicKeyLine, parseOpenSSHPrivateKey, publicKeyFromSeed } from "./sshKeyFile";
-
-const USAGE = `Usage: yarn derivekey <label> <source-key> <derived-key>
-
-Derives a second ed25519 key from an existing one. The same label and source key always give the
-same derived key, so it can be worked out again rather than backed up.
-
-  yarn derivekey revokegithubkey ~/authorized_keys_access/id_ed25519 ~/authorized_keys_access/id_ed25519_revoke`;
+import { publicKeyFromSeed } from "./sshKeyFile";
 
 /** A label mixed into a key's secret to get another key, so one key can stand behind several
     identities without any of them being stored.
@@ -24,49 +15,3 @@ export function deriveEd25519Key(config: { seed: Buffer; label: string }) {
     let derivedSeed = crypto.createHmac("sha256", seed).update(label, "utf8").digest();
     return { seed: derivedSeed, publicKey: publicKeyFromSeed(derivedSeed) };
 }
-
-async function pathExists(filePath: string) {
-    try {
-        await fs.access(filePath);
-        return true;
-    } catch (e) {
-        return false;
-    }
-}
-
-function parseArgs(argv: string[]) {
-    if (argv.length !== 3) {
-        throw new Error(`Expected a label, a source key and a derived key, was ${argv.length} argument(s)\n${USAGE}`);
-    }
-    let [label, sourcePath, derivedPath] = argv;
-    return { label, sourcePath: expandHome(sourcePath), derivedPath: expandHome(derivedPath) };
-}
-
-export async function main() {
-    let { label, sourcePath, derivedPath } = parseArgs(process.argv.slice(2));
-
-    if (!await pathExists(sourcePath)) {
-        throw new Error(`Expected a source key at ${sourcePath}, no such file exists`);
-    }
-    // Writing over a key would strand whatever it already gives access to, and the derived key can
-    // always be worked out again, so there is never a reason to overwrite.
-    if (await pathExists(derivedPath)) {
-        throw new Error(
-            `Expected ${derivedPath} to not exist, it does. Deriving the same label again gives the`
-            + ` same key, so delete it first if you want it rewritten.`
-        );
-    }
-
-    let source = parseOpenSSHPrivateKey(await fs.readFile(sourcePath, "utf8"));
-    let derived = deriveEd25519Key({ seed: source.seed, label });
-    let comment = `${source.comment || sourcePath} ${label}`.trim();
-
-    await fs.writeFile(derivedPath, formatOpenSSHPrivateKey({ seed: derived.seed, comment }), { mode: 0o600 });
-    let publicLine = formatPublicKeyLine({ publicKey: derived.publicKey, comment });
-    await fs.writeFile(`${derivedPath}.pub`, publicLine, { mode: 0o644 });
-
-    console.log(`Derived "${label}" from ${sourcePath}`);
-    console.log(`  private ${derivedPath}`);
-    console.log(`  public  ${derivedPath}.pub`);
-    console.log(publicLine.trim());
-}