Function verifySignature

sources/npmRegistryUtils.ts:35–68

({signatures, integrity, packageName, version}: {
  signatures: Array<{keyid: string, sig: string}>;
  integrity: string;
  packageName: string;
  version: string;
})

}

export function verifySignature({signatures, integrity, packageName, version}: {
  signatures: Array<{keyid: string, sig: string}>;
  integrity: string;
  packageName: string;
  version: string;
}) {
  if (!Array.isArray(signatures) || !signatures.length) throw new Error(`No compatible signature found in package metadata`);

  const {npm: trustedKeys} = process.env.COREPACK_INTEGRITY_KEYS ?
    JSON.parse(process.env.COREPACK_INTEGRITY_KEYS) as typeof defaultConfig.keys :
    defaultConfig.keys;

  let signature: typeof signatures[0] | undefined;
  let key!: string;
  for (const k of trustedKeys) {
    signature = signatures.find(({keyid}) => keyid === k.keyid);
    if (signature != null) {
      key = k.key;
      break;
    }
  }
  if (signature?.sig == null) throw new UsageError(`The package was not signed by any trusted keys: ${JSON.stringify({signatures, trustedKeys}, undefined, 2)}`);

  const verifier = createVerify(`SHA256`);
  verifier.end(`${packageName}@${version}:${integrity}`);
  const valid = verifier.verify(
    `-----BEGIN PUBLIC KEY-----\n${key}\n-----END PUBLIC KEY-----`,
    signature.sig,
    `base64`,
  );
  if (!valid) {
    throw new Error(`Signature does not match`);
  }
}

export async function fetchLatestStableVersion(packageName: string) {
  const metadata = await fetchAsJson(packageName, `latest`);