| 179 | } |
| 180 | |
| 181 | async setKeys ({ registry, tuf }) { |
| 182 | const { host, pathname } = new URL(registry) |
| 183 | // Strip any trailing slashes from pathname |
| 184 | const regKey = `${host}${pathname.replace(/\/$/, '')}/keys.json` |
| 185 | let keys = await tuf.getTarget(regKey) |
| 186 | .then((target) => JSON.parse(target)) |
| 187 | .then(({ keys: ks }) => ks.map((key) => ({ |
| 188 | ...key, |
| 189 | keyid: key.keyId, |
| 190 | pemkey: `-----BEGIN PUBLIC KEY-----\n${key.publicKey.rawBytes}\n-----END PUBLIC KEY-----`, |
| 191 | expires: key.publicKey.validFor.end || null, |
| 192 | }))).catch(err => { |
| 193 | if (err.code === 'TUF_FIND_TARGET_ERROR') { |
| 194 | return null |
| 195 | } else { |
| 196 | throw err |
| 197 | } |
| 198 | }) |
| 199 | |
| 200 | // If keys not found in Sigstore TUF repo, fall back to registry keys API |
| 201 | if (!keys) { |
| 202 | log.warn(`Fetching verification keys using TUF failed. Fetching directly from ${registry}.`) |
| 203 | keys = await npmFetch.json('/-/npm/v1/keys', { |
| 204 | ...this.npm.flatOptions, |
| 205 | registry, |
| 206 | }).then(({ keys: ks }) => ks.map((key) => ({ |
| 207 | ...key, |
| 208 | pemkey: `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`, |
| 209 | }))).catch(err => { |
| 210 | if (err.code === 'E404' || err.code === 'E400') { |
| 211 | return null |
| 212 | } else { |
| 213 | throw err |
| 214 | } |
| 215 | }) |
| 216 | } |
| 217 | |
| 218 | if (keys) { |
| 219 | this.keys.set(registry, keys) |
| 220 | } |
| 221 | } |
| 222 | |
| 223 | getEdgeType (edge) { |
| 224 | return edge.optional ? 'optionalDependencies' |