wyvrnpm 2.12.2 → 2.13.11

package/src/commands/install.js

@@ -6,6 +6,7 @@ const path = require('path');
 const { normalizeDependencies }                             = require('../manifest');
 const { resolveDependencies }                               = require('../resolve');
 const { downloadDependencies }                              = require('../download');
+const { resolveSigningContext }                             = require('../signing/resolve-context');
 const { wyvrnFetch }                                        = require('../http-fetch');
 const { resolveEffectiveConf, cmakeCacheVariables, unflattenConf } = require('../conf');
 const { resolveBinaryDirRoot }                              = require('../binary-dir');
@@ -350,6 +351,47 @@ async function install(argv) {
 
   const razerDir = path.join(rootDir, 'wyvrn_internal');
 
+  // ── Resolve requestConfigs for per-config dep slicing ─────────────────────
+  // Precedence: CLI > wyvrn.local.json > consumer's recipe build.configs.
+  // When all three are absent, falls through to null which means "download
+  // every config the dep author published" (preserves pre-feature semantics
+  // for fat-zip deps; for sliced deps, equivalent to "no override, fetch all").
+  let requestConfigs = null;
+  const cliRaw = typeof argv.requestConfigs === 'string' ? argv.requestConfigs.trim() : null;
+  if (cliRaw) {
+    requestConfigs = cliRaw.split(',').map((s) => s.trim()).filter(Boolean);
+    if (requestConfigs.length === 0) {
+      log.error('--request-configs was empty after parsing');
+      process.exit(1);
+    }
+  } else if (effectiveConfResult.localRequestConfigs) {
+    requestConfigs = effectiveConfResult.localRequestConfigs.slice();
+  } else if (manifest && manifest.build && (Array.isArray(manifest.build.configs) || typeof manifest.build.configs === 'string')) {
+    // Read configs directly from the consumer's manifest. Avoid normalizeRecipe
+    // here because it can throw on `${options.X}` references that this caller
+    // hasn't resolved yet — request-configs only depends on the configs field.
+    const raw = manifest.build.configs;
+    requestConfigs = (typeof raw === 'string' ? [raw] : raw)
+      .filter((s) => typeof s === 'string' && s.trim())
+      .slice();
+    if (requestConfigs.length === 0) requestConfigs = null;
+  }
+  if (requestConfigs) {
+    log.info(`Request configs: ${requestConfigs.join(', ')}`);
+  }
+
+  // Per-dep override map (wyvrn.local.json: depRequestConfigs). When a
+  // dep is named in this map, its slice selection is the listed configs;
+  // otherwise it inherits the global `requestConfigs`. Use case: "fetch
+  // all four configs of fmt + zlib, but only MinSizeRel of grpc."
+  const depRequestConfigs = effectiveConfResult.localDepRequestConfigs ?? null;
+  if (depRequestConfigs && Object.keys(depRequestConfigs).length > 0) {
+    const summary = Object.entries(depRequestConfigs)
+      .map(([n, c]) => `${n}=[${c.join(',')}]`)
+      .join(' ');
+    log.info(`Per-dep request configs: ${summary}`);
+  }
+
   // Extract auth from the first install source (if any). Prefer
   // `tokenEnv` over a literal `token` stored in config — closes
   // EVALUATION.md S8 (no plaintext secret persisted, value is looked up
@@ -360,6 +402,12 @@ async function install(argv) {
     token:      ctx.auth.for(firstInstallSrc).token,
     buildMode,
     profileName,
+    // S1: forwarded straight through to download.js's verify tail.
+    requireSignatures: Boolean(argv.requireSignatures),
+    // Per-config slice selection. null = "no override, fetch all available".
+    requestConfigs,
+    // Per-dep override; null when the overlay omits it.
+    depRequestConfigs,
   };
 
   // ── Resolve upload destination up-front when --upload-built is set ──────
@@ -387,6 +435,33 @@ async function install(argv) {
     downloadOptions.uploadAuth   = resolved.uploadAuth;
     downloadOptions.uploadStats  = createUploadStats();
 
+    // S1: resolve signing context for the consumer-upload tail. Same
+    // precedence as `wyvrnpm publish` — per-source signing on the
+    // resolved upload entry, then defaultSigning, then CLI overrides.
+    // When null, the upload is unsigned and downstream consumers warn /
+    // abort per the destination registry's mode.json.
+    const uploadSourceEntry = (config.publishSources ?? [])
+      .find((s) => s.url === resolved.uploadSource || s.name === argv.uploadSource) ?? null;
+    let uploadSigningContext = null;
+    try {
+      const ctxOrSkip = resolveSigningContext(
+        {
+          noSign:         argv.noSign,
+          signingKeyEnv:  argv.signingKeyEnv,
+          signingKeyFile: argv.signingKeyFile,
+        },
+        config,
+        uploadSourceEntry,
+      );
+      // `skip: true` (--no-sign) is treated identically to "no context"
+      // here — the consumer just doesn't sign.
+      uploadSigningContext = (ctxOrSkip && !ctxOrSkip.skip) ? ctxOrSkip : null;
+    } catch (err) {
+      log.error(`upload-built signing config invalid: ${err.message}`);
+      process.exit(1);
+    }
+    downloadOptions.uploadSigningContext = uploadSigningContext;
+
     if (resolved.uploadSource !== (packageSources[0] ?? '')) {
       log.info(
         `upload-built: install source(s) and upload source differ —\n` +
@@ -569,7 +644,7 @@ async function install(argv) {
   // here so CI doesn't take "Done — N installed" at face value when one of
   // the deps actually failed.
   const SUCCESS_RESOLVED = new Set([
-    'v1', 'v2', 'v2-compat', 'v2-source-build', 'cached', 'link',
+    'v1', 'v2', 'v2-slice', 'v2-compat', 'v2-source-build', 'cached', 'link',
   ]);
   const failed = [];
   for (const [name, entry] of lockEntries ?? []) {

package/src/commands/key.js

@@ -0,0 +1,112 @@
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+
+const ed25519 = require('../signing/ed25519');
+const log     = require('../logger');
+
+/**
+ * `wyvrnpm key gen --out <dir> [--id <publisher-id>]`
+ *
+ * Generates a fresh Ed25519 keypair and writes:
+ *   <dir>/<id>.priv.pem   — PKCS#8 private key (publisher keeps secret)
+ *   <dir>/<id>.pub.pem    — SPKI PEM public key (paste into trust anchor)
+ *   <dir>/<id>.pub.b64    — Base64 SPKI DER (the literal value for keys.json)
+ *
+ * Refuses to overwrite existing files — rotation events are rare and
+ * destructive enough that the user should explicitly remove the old keys
+ * (or pick a fresh `--id`) rather than have the command stomp them.
+ */
+async function gen(argv) {
+  const outDir = argv.out;
+  const id     = argv.id ?? 'wyvrnpm';
+  if (!outDir) { log.error('--out <dir> is required'); process.exit(1); }
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(id)) {
+    log.error(`--id must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/ (got "${id}")`);
+    process.exit(1);
+  }
+
+  const privPath = path.join(outDir, `${id}.priv.pem`);
+  const pubPath  = path.join(outDir, `${id}.pub.pem`);
+  const b64Path  = path.join(outDir, `${id}.pub.b64`);
+
+  for (const p of [privPath, pubPath, b64Path]) {
+    if (fs.existsSync(p)) {
+      log.error(`refusing to overwrite existing file: ${p}`);
+      process.exit(1);
+    }
+  }
+
+  fs.mkdirSync(outDir, { recursive: true });
+  const k = ed25519.generateKeyPair();
+  // Private key permissions: chmod 0600 on POSIX so a stray process or
+  // backup tool doesn't accidentally include it. No-op on Windows.
+  fs.writeFileSync(privPath, k.privateKeyPem, { mode: 0o600 });
+  fs.writeFileSync(pubPath,  k.publicKeyPem);
+  fs.writeFileSync(b64Path,  k.publicKeyB64 + '\n');
+
+  if (argv.format === 'json') {
+    process.stdout.write(JSON.stringify({
+      command:        'key gen',
+      wyvrnpmVersion: require('../../package.json').version,
+      id,
+      out:            outDir,
+      privateKeyFile: privPath,
+      publicKeyPem:   pubPath,
+      publicKeyB64:   b64Path,
+      publicKey:      k.publicKeyB64,
+    }, null, 2) + '\n');
+  } else {
+    log.success(`Generated ed25519 keypair "${id}"`);
+    log.info(`  private key : ${privPath}`);
+    log.info(`  public PEM  : ${pubPath}`);
+    log.info(`  public b64  : ${b64Path}`);
+    console.log();
+    console.log('Add this entry to your registry\'s `.trust/keys.json`:');
+    console.log(JSON.stringify({
+      id, alg: 'ed25519',
+      publicKey:    k.publicKeyB64,
+      identityHint: '<your.email@example.com>',
+      addedAt:      new Date().toISOString(),
+      retiredAt:    null,
+    }, null, 2));
+  }
+}
+
+/**
+ * `wyvrnpm key show-pub --in <priv-file>`
+ *
+ * Re-derives the public key from a private key file. Handy for verifying
+ * that a CI-supplied key matches the keyId pinned in `keys.json` before
+ * publishing — derives + prints, without ever writing back to disk.
+ */
+async function showPub(argv) {
+  const inPath = argv.in;
+  if (!inPath) { log.error('--in <priv-file> is required'); process.exit(1); }
+  if (!fs.existsSync(inPath)) {
+    log.error(`private key file not found: ${inPath}`);
+    process.exit(1);
+  }
+  let derived;
+  try {
+    derived = ed25519.derivePublicKey(fs.readFileSync(inPath, 'utf8'));
+  } catch (err) {
+    log.error(err.message);
+    process.exit(1);
+  }
+  if (argv.format === 'json') {
+    process.stdout.write(JSON.stringify({
+      command:        'key show-pub',
+      wyvrnpmVersion: require('../../package.json').version,
+      in:             inPath,
+      publicKeyPem:   derived.publicKeyPem,
+      publicKey:      derived.publicKeyB64,
+    }, null, 2) + '\n');
+  } else {
+    process.stdout.write(derived.publicKeyPem);
+    process.stdout.write(`\nbase64: ${derived.publicKeyB64}\n`);
+  }
+}
+
+module.exports = { gen, showPub };