var b=Object.defineProperty;var y=(s,e)=>b(s,"name",{value:e,configurable:!0});import{createRequire as N}from"node:module";import{m as x,D as B,g as E}from"./provenance-Cu6VR1Hy.js";import{i as M}from"../packem_chunks/bin.js";import{f as j}from"./registry-keys-CuBAVdsk.js";const P=N(import.meta.url),g=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,_=y(s=>{if(typeof g<"u"&&g.versions&&g.versions.node){const[e,i]=g.versions.node.split(".").map(Number);if(e>22||e===22&&i>=3||e===20&&i>=16)return g.getBuiltinModule(s)}return P(s)},"__cjs_getBuiltinModule"),{createPublicKey:S,createVerify:R}=_("node:crypto");var A=Object.defineProperty,h=y((s,e)=>A(s,"name",{value:e,configurable:!0}),"n");const C=h(s=>{const e=["-----BEGIN PUBLIC KEY-----"],i=s.replaceAll(/\s+/g,"");for(let t=0;t<i.length;t+=64)e.push(i.slice(t,t+64));return e.push("-----END PUBLIC KEY-----"),e.join(`
`)},"wrapSpkiPem"),D=h(({keyBase64:s,message:e,signatureBase64:i})=>{try{const t=S({format:"pem",key:C(s)}),o=R("SHA256");return o.update(e),o.end(),o.verify(t,Buffer.from(i,"base64"))}catch{return!1}},"verifyEcdsaSignature");var L=Object.defineProperty,f=y((s,e)=>L(s,"name",{value:e,configurable:!0}),"g");const U=f((s,e)=>{if(s.expires===void 0||s.expires==="")return!1;const i=Date.parse(s.expires);return Number.isNaN(i)?!1:i<=e},"isKeyExpired"),K=f((s,e,i)=>`${s}@${e}:${i}`,"buildSignedMessage"),T=f((s,e)=>e!==void 0&&s.includes(e)?e:s.at(-1),"resolveLatestVersion"),V=f(async(s,e={})=>{if(M("signatures"))return[];const i=new Set(e.allowlist),t=e.treatExpiredAs??"warning",o=e.concurrency??B,k=await j({keysUrl:e.keysUrl,signal:e.signal,ttlMs:e.keysTtlMs});if(k===void 0)return s.filter(({name:r})=>!i.has(r)).map(({name:r,version:a})=>({code:"fetch-failed",message:"Could not fetch registry signing keys.",packageName:r,severity:"warning",version:a}));const v=new Map;for(const r of k.keys)v.set(r.keyid,r);const w=Date.now();return(await x(s,o,async({name:r,version:a})=>{if(i.has(r))return[];const c=await E(r,{workspaceRoot:e.workspaceRoot});if(c===void 0)return[];const l=c.versions[a]??c.versions[T(Object.keys(c.versions),c["dist-tags"]?.latest)??""];if(l===void 0)return[];const p=l.dist?.signatures,m=l.dist?.integrity;if(p===void 0||p.length===0)return[{code:"missing-signature",message:`Package ${r}@${a} has no dist.signatures from the registry.`,packageName:r,severity:"warning",version:a}];if(typeof m!="string"||m==="")return[{code:"missing-signature",message:`Package ${r}@${a} has signatures but no dist.integrity to verify against.`,packageName:r,severity:"warning",version:a}];const $=K(r,a,m),u=[];for(const n of p){const d=v.get(n.keyid);if(d===void 0){u.push({code:"unknown-keyid",keyid:n.keyid,message:`Package ${r}@${a} was signed with an unrecognized keyid (${n.keyid}).`,packageName:r,severity:"error",version:a});continue}if(U(d,w)){u.push({code:"expired-key",keyid:n.keyid,message:`Package ${r}@${a} was signed with an expired key (${n.keyid}, expired ${d.expires??"unknown"}).`,packageName:r,severity:t,version:a});continue}D({keyBase64:d.key,message:$,signatureBase64:n.sig})||u.push({code:"invalid-signature",keyid:n.keyid,message:`Package ${r}@${a} signature did not verify against ${n.keyid}.`,packageName:r,severity:"error",version:a})}return u})).flat()},"runSignatureMarshall");export{V as r};
