77 lines
2.4 KiB
TypeScript
77 lines
2.4 KiB
TypeScript
import { createHash } from "node:crypto";
|
|
import { readdirSync, readFileSync } from "node:fs";
|
|
import { basename, join, relative } from "node:path";
|
|
|
|
export interface StagedFileIntegrity {
|
|
path: string;
|
|
bytes: number;
|
|
sha256: string;
|
|
}
|
|
|
|
export interface StagedPackageIntegrity {
|
|
name: string;
|
|
version: string;
|
|
files: StagedFileIntegrity[];
|
|
}
|
|
|
|
const forbiddenStageName =
|
|
/^(?:\.env(?:\..*)?|focus-shims\.d\.ts|tsconfig\.focus\.json|id_rsa|id_ed25519|.*\.(?:pem|key|p12|pfx))$/i;
|
|
const highConfidenceSecret =
|
|
/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\bnpm_[A-Za-z0-9]{30,}\b|\bgh[pousr]_[A-Za-z0-9]{30,}\b/;
|
|
|
|
function listFiles(root: string): string[] {
|
|
const files: string[] = [];
|
|
for (const entry of readdirSync(root, { recursive: true, withFileTypes: true })) {
|
|
if (!entry.isFile()) continue;
|
|
files.push(join(entry.parentPath, entry.name));
|
|
}
|
|
return files.sort((a, b) => {
|
|
const left = relative(root, a).replace(/\\/g, "/");
|
|
const right = relative(root, b).replace(/\\/g, "/");
|
|
return left < right ? -1 : left > right ? 1 : 0;
|
|
});
|
|
}
|
|
|
|
export function validateAndHashStage(
|
|
stage: string,
|
|
manifest: Record<string, unknown>,
|
|
): StagedPackageIntegrity {
|
|
const name = String(manifest.name ?? "unknown package");
|
|
const files = listFiles(stage);
|
|
if (!files.length) throw new Error(`${name} staged no files.`);
|
|
const integrity: StagedFileIntegrity[] = [];
|
|
|
|
for (const file of files) {
|
|
const path = relative(stage, file).replace(/\\/g, "/");
|
|
const filename = basename(file);
|
|
if (forbiddenStageName.test(filename)) {
|
|
throw new Error(`${name} staged forbidden secret-like file ${path}.`);
|
|
}
|
|
if (path.endsWith(".map")) {
|
|
throw new Error(`${name} staged source map ${path}; package source maps are disabled.`);
|
|
}
|
|
if (path.endsWith(".ts") && !path.endsWith(".d.ts")) {
|
|
throw new Error(`${name} staged TypeScript source ${path}.`);
|
|
}
|
|
|
|
const value = readFileSync(file);
|
|
if (value.byteLength <= 2 * 1024 * 1024) {
|
|
const source = value.toString("utf8");
|
|
if (highConfidenceSecret.test(source)) {
|
|
throw new Error(`${name} staged content matching a high-confidence secret in ${path}.`);
|
|
}
|
|
}
|
|
integrity.push({
|
|
path,
|
|
bytes: value.byteLength,
|
|
sha256: createHash("sha256").update(value).digest("hex"),
|
|
});
|
|
}
|
|
|
|
return {
|
|
name,
|
|
version: String(manifest.version ?? "unknown"),
|
|
files: integrity,
|
|
};
|
|
}
|