Skip to content

Commit b1df5fd

Browse files
geigerzaehlergeigerzaehler
committed
Get NPM signing keys from @sigstore/tuf
Instead of hardcoding NPM signing keys for verification we get them from sigstore’s TUF repository. This is in line with how npm implements signature verification. Fixes #616, #612
1 parent c388c64 commit b1df5fd

9 files changed

+124
-69
lines changed

Diff for: ‎README.md

+11-2
Original file line numberDiff line numberDiff line change
@@ -316,8 +316,17 @@ same major line. Should you need to upgrade to a new major, use an explicit
316316
[`proxy-from-env`](https://github.com/Rob--W/proxy-from-env).
317317

318318
- `COREPACK_INTEGRITY_KEYS` can be set to an empty string or `0` to
319-
instruct Corepack to skip integrity checks, or to a JSON string containing
320-
custom keys.
319+
instruct Corepack to skip signature verification, or to a JSON string
320+
containing custom keys. The format based on the response of the
321+
`GET /-/npm/v1/keys` endpoint of NPM under the `npm` key. That is,
322+
323+
```bash
324+
curl https://registry.npmjs.org/-/npm/v1/keys | jq -c '{npm: .keys}'
325+
```
326+
327+
See the [NPM documentation on
328+
signatures](https://docs.npmjs.com/about-registry-signatures) for more
329+
information.
321330

322331
## Troubleshooting
323332

Diff for: ‎config.json

-18
Original file line numberDiff line numberDiff line change
@@ -161,23 +161,5 @@
161161
}
162162
}
163163
}
164-
},
165-
"keys": {
166-
"npm": [
167-
{
168-
"expires": "2025-01-29T00:00:00.000Z",
169-
"keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",
170-
"keytype": "ecdsa-sha2-nistp256",
171-
"scheme": "ecdsa-sha2-nistp256",
172-
"key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="
173-
},
174-
{
175-
"expires": null,
176-
"keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
177-
"keytype": "ecdsa-sha2-nistp256",
178-
"scheme": "ecdsa-sha2-nistp256",
179-
"key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="
180-
}
181-
]
182164
}
183165
}

Diff for: ‎package.json

+1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
"license": "MIT",
1919
"packageManager": "[email protected]+sha512.5383cc12567a95f1d668fbe762dfe0075c595b4bfff433be478dbbe24e05251a8e8c3eb992a986667c1d53b6c3a9c85b8398c35a960587fbd9fa3a0915406728",
2020
"devDependencies": {
21+
"@sigstore/tuf": "^3.1.0",
2122
"@types/debug": "^4.1.5",
2223
"@types/node": "^20.4.6",
2324
"@types/proxy-from-env": "^1",

Diff for: ‎sources/corepackUtils.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@ export async function installVersion(installTarget: string, locator: Locator, {s
289289
if (signatures! == null || integrity! == null)
290290
({signatures, integrity} = (await npmRegistryUtils.fetchTarballURLAndSignature(registry.package, version)));
291291

292-
npmRegistryUtils.verifySignature({signatures, integrity, packageName: registry.package, version});
292+
await npmRegistryUtils.verifySignature({signatures, integrity, packageName: registry.package, version});
293293
// @ts-expect-error ignore readonly
294294
build[1] = Buffer.from(integrity.slice(`sha512-`.length), `base64`).toString(`hex`);
295295
}

Diff for: ‎sources/npmRegistryUtils.ts

+51-21
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1-
import {UsageError} from 'clipanion';
2-
import {createVerify} from 'crypto';
1+
import * as sigstoreTuf from '@sigstore/tuf';
2+
import {UsageError} from 'clipanion';
3+
import assert from 'node:assert';
4+
import {createVerify, createPublicKey, KeyObject} from 'node:crypto';
35

4-
import defaultConfig from '../config.json';
5-
6-
import {shouldSkipIntegrityCheck} from './corepackUtils';
7-
import * as httpUtils from './httpUtils';
6+
import {shouldSkipIntegrityCheck} from './corepackUtils';
7+
import * as debugUtils from './debugUtils';
8+
import * as httpUtils from './httpUtils';
9+
import {once} from './utils';
810

911
// load abbreviated metadata as that's all we need for these calls
1012
// see: https://github.com/npm/registry/blob/cfe04736f34db9274a780184d1cdb2fb3e4ead2a/docs/responses/package-metadata.md
@@ -32,30 +34,58 @@ export async function fetchAsJson(packageName: string, version?: string) {
3234
return httpUtils.fetchAsJson(`${npmRegistryUrl}/${packageName}${version ? `/${version}` : ``}`, {headers});
3335
}
3436

35-
export function verifySignature({signatures, integrity, packageName, version}: {
37+
const getVerificationKeys = once(async (): Promise<Array<{ keyid: string, key: KeyObject }>> => {
38+
let keys: Array<{ keyid: string, key: string }>;
39+
if (process.env.COREPACK_INTEGRITY_KEYS) {
40+
// We use the format of the `GET /-/npm/v1/keys` endpoint with `npm` instead
41+
// of `keys` as the wrapping key.
42+
const keysFromEnv = JSON.parse(process.env.COREPACK_INTEGRITY_KEYS) as { npm: Array<{ keyid: string, key: string }> };
43+
keys = keysFromEnv.npm.map(k => ({keyid: k.keyid, key: k.key}));
44+
debugUtils.log(`Using COREPACK_INTEGRITY_KEYS to verify signatures: ${keys.map(k => k.keyid).join(`, `)}`);
45+
} else {
46+
// This follows the implementation for npm.
47+
// See https://github.com/npm/cli/blob/3a80a7b7d168c23b5e297cba7b47ba5b9875934d/lib/utils/verify-signatures.js#L174
48+
// We only support sigstore for NPM. For other registries
49+
// COREPACK_INTEGRITY_KEYS can be used.
50+
const sigstoreTufClient = await sigstoreTuf.initTUF();
51+
const keysRaw = await sigstoreTufClient.getTarget(`registry.npmjs.org/keys.json`);
52+
// The format of the key file is undocumented, unfortunately. `rawBytes` is
53+
// the PEM content, i.e. base64 encoded SPKI DER.
54+
const keysFromSigstore = JSON.parse(keysRaw) as { keys: Array<{ keyId: string, publicKey: { rawBytes: string }}> };
55+
keys = keysFromSigstore.keys.map(k => ({keyid: k.keyId, key: k.publicKey.rawBytes}));
56+
debugUtils.log(`Using NPM keys from @sigstore/tuf to verify signatures: ${keys.map(k => k.keyid).join(`, `)}`);
57+
}
58+
59+
return keys.map(k => ({
60+
keyid: k.keyid,
61+
key: createPublicKey(`-----BEGIN PUBLIC KEY-----\n${k.key}\n-----END PUBLIC KEY-----`,
62+
)}));
63+
});
64+
65+
export async function verifySignature({signatures, integrity, packageName, version}: {
3666
signatures: Array<{keyid: string, sig: string}>;
3767
integrity: string;
3868
packageName: string;
3969
version: string;
4070
}) {
41-
const {npm: keys} = process.env.COREPACK_INTEGRITY_KEYS ?
42-
JSON.parse(process.env.COREPACK_INTEGRITY_KEYS) as typeof defaultConfig.keys :
43-
defaultConfig.keys;
44-
71+
const keys = await getVerificationKeys();
4572
const key = keys.find(({keyid}) => signatures.some(s => s.keyid === keyid));
46-
const signature = signatures.find(({keyid}) => keyid === key?.keyid);
73+
if (key == null)
74+
throw new Error(`Cannot find key to verify signature. signature keys: ${signatures.map(s => s.keyid)}, verification keys: ${keys.map(k => k.keyid)}`);
4775

48-
if (key == null || signature == null) throw new Error(`Cannot find matching keyid: ${JSON.stringify({signatures, keys})}`);
76+
const signature = signatures.find(({keyid}) => keyid === key.keyid);
77+
assert(signature); // If `key` is defined there is a matching signature
4978

5079
const verifier = createVerify(`SHA256`);
51-
verifier.end(`${packageName}@${version}:${integrity}`);
52-
const valid = verifier.verify(
53-
`-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`,
54-
signature.sig,
55-
`base64`,
56-
);
80+
const payload = `${packageName}@${version}:${integrity}`;
81+
verifier.end(payload);
82+
const valid = verifier.verify(key, signature.sig, `base64`);
83+
5784
if (!valid) {
58-
throw new Error(`Signature does not match`);
85+
throw new Error(
86+
`Signature verification failed for ${payload} with key ${key.keyid}\n` +
87+
`If you are using a custom registry you can set COREPACK_INTEGRITY_KEYS.`,
88+
);
5989
}
6090
}
6191

@@ -65,7 +95,7 @@ export async function fetchLatestStableVersion(packageName: string) {
6595
const {version, dist: {integrity, signatures, shasum}} = metadata;
6696

6797
if (!shouldSkipIntegrityCheck()) {
68-
verifySignature({
98+
await verifySignature({
6999
packageName, version,
70100
integrity, signatures,
71101
});

Diff for: ‎sources/types.ts

-10
Original file line numberDiff line numberDiff line change
@@ -103,16 +103,6 @@ export interface Config {
103103
};
104104
};
105105
};
106-
107-
keys: {
108-
[registry: string]: Array<{
109-
expires: null;
110-
keyid: string;
111-
keytype: string;
112-
scheme: string;
113-
key: string;
114-
}>;
115-
};
116106
}
117107

118108
/**

Diff for: ‎sources/utils.ts

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
export function once<T>(fn: () => T) {
2+
let cache: null | { value: T } = null;
3+
return function () {
4+
if (cache)
5+
return cache.value;
6+
7+
8+
cache = {value: fn()};
9+
return cache.value;
10+
};
11+
}

Diff for: ‎tests/config.test.ts

-14
This file was deleted.

Diff for: ‎yarn.lock

+49-3
Original file line numberDiff line numberDiff line change
@@ -634,6 +634,40 @@ __metadata:
634634
languageName: node
635635
linkType: hard
636636

637+
"@sigstore/protobuf-specs@npm:^0.4.0":
638+
version: 0.4.0
639+
resolution: "@sigstore/protobuf-specs@npm:0.4.0"
640+
checksum: 10c0/5b9e074ad132b977050cbd9431c09ea88b21af266dae91dda8d51e29c7b295e73e3be255c10d68874259326229dde1805dd1f5ff29082d2f3d32a932809816eb
641+
languageName: node
642+
linkType: hard
643+
644+
"@sigstore/tuf@npm:^3.1.0":
645+
version: 3.1.0
646+
resolution: "@sigstore/tuf@npm:3.1.0"
647+
dependencies:
648+
"@sigstore/protobuf-specs": "npm:^0.4.0"
649+
tuf-js: "npm:^3.0.1"
650+
checksum: 10c0/940237295bec3817ef4dbfd48de8b9a73b4e297966c05e81b6103747904def999f27499adb3de572407f2c72c6f28d2c699a6c8446be808b599c427a9903f081
651+
languageName: node
652+
linkType: hard
653+
654+
"@tufjs/canonical-json@npm:2.0.0":
655+
version: 2.0.0
656+
resolution: "@tufjs/canonical-json@npm:2.0.0"
657+
checksum: 10c0/52c5ffaef1483ed5c3feedfeba26ca9142fa386eea54464e70ff515bd01c5e04eab05d01eff8c2593291dcaf2397ca7d9c512720e11f52072b04c47a5c279415
658+
languageName: node
659+
linkType: hard
660+
661+
"@tufjs/models@npm:3.0.1":
662+
version: 3.0.1
663+
resolution: "@tufjs/models@npm:3.0.1"
664+
dependencies:
665+
"@tufjs/canonical-json": "npm:2.0.0"
666+
minimatch: "npm:^9.0.5"
667+
checksum: 10c0/0b2022589139102edf28f7fdcd094407fc98ac25bf530ebcf538dd63152baea9b6144b713c8dfc4f6b7580adeff706ab6ecc5f9716c4b816e58a04419abb1926
668+
languageName: node
669+
linkType: hard
670+
637671
"@types/debug@npm:^4.1.5":
638672
version: 4.1.12
639673
resolution: "@types/debug@npm:4.1.12"
@@ -1393,6 +1427,7 @@ __metadata:
13931427
version: 0.0.0-use.local
13941428
resolution: "corepack@workspace:."
13951429
dependencies:
1430+
"@sigstore/tuf": "npm:^3.1.0"
13961431
"@types/debug": "npm:^4.1.5"
13971432
"@types/node": "npm:^20.4.6"
13981433
"@types/proxy-from-env": "npm:^1"
@@ -1463,7 +1498,7 @@ __metadata:
14631498
languageName: node
14641499
linkType: hard
14651500

1466-
"debug@npm:4, debug@npm:^4.1.1, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.4, debug@npm:^4.4.0":
1501+
"debug@npm:4, debug@npm:^4.1.1, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.4, debug@npm:^4.3.6, debug@npm:^4.4.0":
14671502
version: 4.4.0
14681503
resolution: "debug@npm:4.4.0"
14691504
dependencies:
@@ -3058,7 +3093,7 @@ __metadata:
30583093
languageName: node
30593094
linkType: hard
30603095

3061-
"make-fetch-happen@npm:^14.0.3":
3096+
"make-fetch-happen@npm:^14.0.1, make-fetch-happen@npm:^14.0.3":
30623097
version: 14.0.3
30633098
resolution: "make-fetch-happen@npm:14.0.3"
30643099
dependencies:
@@ -3117,7 +3152,7 @@ __metadata:
31173152
languageName: node
31183153
linkType: hard
31193154

3120-
"minimatch@npm:^9.0.4":
3155+
"minimatch@npm:^9.0.4, minimatch@npm:^9.0.5":
31213156
version: 9.0.5
31223157
resolution: "minimatch@npm:9.0.5"
31233158
dependencies:
@@ -4394,6 +4429,17 @@ __metadata:
43944429
languageName: node
43954430
linkType: hard
43964431

4432+
"tuf-js@npm:^3.0.1":
4433+
version: 3.0.1
4434+
resolution: "tuf-js@npm:3.0.1"
4435+
dependencies:
4436+
"@tufjs/models": "npm:3.0.1"
4437+
debug: "npm:^4.3.6"
4438+
make-fetch-happen: "npm:^14.0.1"
4439+
checksum: 10c0/4214dd6bb1ec8a6cadbc5690e5a8556de0306f0e95022e54fc7c0ff9dbcc229ab379fd4b048511387f9c0023ea8f8c35acd8f7313f6cbc94a1b8af8b289f62ad
4440+
languageName: node
4441+
linkType: hard
4442+
43974443
"tunnel-agent@npm:^0.6.0":
43984444
version: 0.6.0
43994445
resolution: "tunnel-agent@npm:0.6.0"

0 commit comments

Comments
 (0)