update
This commit is contained in:
299
package/node_modules/@tufjs/models/dist/role.js
generated
vendored
Normal file
299
package/node_modules/@tufjs/models/dist/role.js
generated
vendored
Normal file
@@ -0,0 +1,299 @@
|
||||
"use strict";
|
||||
var __importDefault = (this && this.__importDefault) || function (mod) {
|
||||
return (mod && mod.__esModule) ? mod : { "default": mod };
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", { value: true });
|
||||
exports.SuccinctRoles = exports.DelegatedRole = exports.Role = exports.TOP_LEVEL_ROLE_NAMES = void 0;
|
||||
const crypto_1 = __importDefault(require("crypto"));
|
||||
const minimatch_1 = require("minimatch");
|
||||
const util_1 = __importDefault(require("util"));
|
||||
const error_1 = require("./error");
|
||||
const utils_1 = require("./utils");
|
||||
exports.TOP_LEVEL_ROLE_NAMES = [
|
||||
'root',
|
||||
'targets',
|
||||
'snapshot',
|
||||
'timestamp',
|
||||
];
|
||||
/**
|
||||
* Container that defines which keys are required to sign roles metadata.
|
||||
*
|
||||
* Role defines how many keys are required to successfully sign the roles
|
||||
* metadata, and which keys are accepted.
|
||||
*/
|
||||
class Role {
|
||||
constructor(options) {
|
||||
const { keyIDs, threshold, unrecognizedFields } = options;
|
||||
if (hasDuplicates(keyIDs)) {
|
||||
throw new error_1.ValueError('duplicate key IDs found');
|
||||
}
|
||||
if (threshold < 1) {
|
||||
throw new error_1.ValueError('threshold must be at least 1');
|
||||
}
|
||||
this.keyIDs = keyIDs;
|
||||
this.threshold = threshold;
|
||||
this.unrecognizedFields = unrecognizedFields || {};
|
||||
}
|
||||
equals(other) {
|
||||
if (!(other instanceof Role)) {
|
||||
return false;
|
||||
}
|
||||
return (this.threshold === other.threshold &&
|
||||
util_1.default.isDeepStrictEqual(this.keyIDs, other.keyIDs) &&
|
||||
util_1.default.isDeepStrictEqual(this.unrecognizedFields, other.unrecognizedFields));
|
||||
}
|
||||
toJSON() {
|
||||
return {
|
||||
keyids: this.keyIDs,
|
||||
threshold: this.threshold,
|
||||
...this.unrecognizedFields,
|
||||
};
|
||||
}
|
||||
static fromJSON(data) {
|
||||
const { keyids, threshold, ...rest } = data;
|
||||
if (!utils_1.guard.isStringArray(keyids)) {
|
||||
throw new TypeError('keyids must be an array');
|
||||
}
|
||||
if (typeof threshold !== 'number') {
|
||||
throw new TypeError('threshold must be a number');
|
||||
}
|
||||
return new Role({
|
||||
keyIDs: keyids,
|
||||
threshold,
|
||||
unrecognizedFields: rest,
|
||||
});
|
||||
}
|
||||
}
|
||||
exports.Role = Role;
|
||||
function hasDuplicates(array) {
|
||||
return new Set(array).size !== array.length;
|
||||
}
|
||||
/**
|
||||
* A container with information about a delegated role.
|
||||
*
|
||||
* A delegation can happen in two ways:
|
||||
* - ``paths`` is set: delegates targets matching any path pattern in ``paths``
|
||||
* - ``pathHashPrefixes`` is set: delegates targets whose target path hash
|
||||
* starts with any of the prefixes in ``pathHashPrefixes``
|
||||
*
|
||||
* ``paths`` and ``pathHashPrefixes`` are mutually exclusive: both cannot be
|
||||
* set, at least one of them must be set.
|
||||
*/
|
||||
class DelegatedRole extends Role {
|
||||
constructor(opts) {
|
||||
super(opts);
|
||||
const { name, terminating, paths, pathHashPrefixes } = opts;
|
||||
this.name = name;
|
||||
this.terminating = terminating;
|
||||
if (opts.paths && opts.pathHashPrefixes) {
|
||||
throw new error_1.ValueError('paths and pathHashPrefixes are mutually exclusive');
|
||||
}
|
||||
this.paths = paths;
|
||||
this.pathHashPrefixes = pathHashPrefixes;
|
||||
}
|
||||
equals(other) {
|
||||
if (!(other instanceof DelegatedRole)) {
|
||||
return false;
|
||||
}
|
||||
return (super.equals(other) &&
|
||||
this.name === other.name &&
|
||||
this.terminating === other.terminating &&
|
||||
util_1.default.isDeepStrictEqual(this.paths, other.paths) &&
|
||||
util_1.default.isDeepStrictEqual(this.pathHashPrefixes, other.pathHashPrefixes));
|
||||
}
|
||||
isDelegatedPath(targetFilepath) {
|
||||
if (this.paths) {
|
||||
return this.paths.some((pathPattern) => isTargetInPathPattern(targetFilepath, pathPattern));
|
||||
}
|
||||
if (this.pathHashPrefixes) {
|
||||
const hasher = crypto_1.default.createHash('sha256');
|
||||
const pathHash = hasher.update(targetFilepath).digest('hex');
|
||||
return this.pathHashPrefixes.some((pathHashPrefix) => pathHash.startsWith(pathHashPrefix));
|
||||
}
|
||||
return false;
|
||||
}
|
||||
toJSON() {
|
||||
const json = {
|
||||
...super.toJSON(),
|
||||
name: this.name,
|
||||
terminating: this.terminating,
|
||||
};
|
||||
if (this.paths) {
|
||||
json.paths = this.paths;
|
||||
}
|
||||
if (this.pathHashPrefixes) {
|
||||
json.path_hash_prefixes = this.pathHashPrefixes;
|
||||
}
|
||||
return json;
|
||||
}
|
||||
static fromJSON(data) {
|
||||
const { keyids, threshold, name, terminating, paths, path_hash_prefixes, ...rest } = data;
|
||||
if (!utils_1.guard.isStringArray(keyids)) {
|
||||
throw new TypeError('keyids must be an array of strings');
|
||||
}
|
||||
if (typeof threshold !== 'number') {
|
||||
throw new TypeError('threshold must be a number');
|
||||
}
|
||||
if (typeof name !== 'string') {
|
||||
throw new TypeError('name must be a string');
|
||||
}
|
||||
if (typeof terminating !== 'boolean') {
|
||||
throw new TypeError('terminating must be a boolean');
|
||||
}
|
||||
if (utils_1.guard.isDefined(paths) && !utils_1.guard.isStringArray(paths)) {
|
||||
throw new TypeError('paths must be an array of strings');
|
||||
}
|
||||
if (utils_1.guard.isDefined(path_hash_prefixes) &&
|
||||
!utils_1.guard.isStringArray(path_hash_prefixes)) {
|
||||
throw new TypeError('path_hash_prefixes must be an array of strings');
|
||||
}
|
||||
return new DelegatedRole({
|
||||
keyIDs: keyids,
|
||||
threshold,
|
||||
name,
|
||||
terminating,
|
||||
paths,
|
||||
pathHashPrefixes: path_hash_prefixes,
|
||||
unrecognizedFields: rest,
|
||||
});
|
||||
}
|
||||
}
|
||||
exports.DelegatedRole = DelegatedRole;
|
||||
// JS version of Ruby's Array#zip
|
||||
const zip = (a, b) => a.map((k, i) => [k, b[i]]);
|
||||
function isTargetInPathPattern(target, pattern) {
|
||||
const targetParts = target.split('/');
|
||||
const patternParts = pattern.split('/');
|
||||
if (patternParts.length != targetParts.length) {
|
||||
return false;
|
||||
}
|
||||
return zip(targetParts, patternParts).every(([targetPart, patternPart]) => (0, minimatch_1.minimatch)(targetPart, patternPart));
|
||||
}
|
||||
/**
|
||||
* Succinctly defines a hash bin delegation graph.
|
||||
*
|
||||
* A ``SuccinctRoles`` object describes a delegation graph that covers all
|
||||
* targets, distributing them uniformly over the delegated roles (i.e. bins)
|
||||
* in the graph.
|
||||
*
|
||||
* The total number of bins is 2 to the power of the passed ``bit_length``.
|
||||
*
|
||||
* Bin names are the concatenation of the passed ``name_prefix`` and a
|
||||
* zero-padded hex representation of the bin index separated by a hyphen.
|
||||
*
|
||||
* The passed ``keyids`` and ``threshold`` is used for each bin, and each bin
|
||||
* is 'terminating'.
|
||||
*
|
||||
* For details: https://github.com/theupdateframework/taps/blob/master/tap15.md
|
||||
*/
|
||||
class SuccinctRoles extends Role {
|
||||
constructor(opts) {
|
||||
super(opts);
|
||||
const { bitLength, namePrefix } = opts;
|
||||
if (bitLength <= 0 || bitLength > 32) {
|
||||
throw new error_1.ValueError('bitLength must be between 1 and 32');
|
||||
}
|
||||
this.bitLength = bitLength;
|
||||
this.namePrefix = namePrefix;
|
||||
// Calculate the suffix_len value based on the total number of bins in
|
||||
// hex. If bit_length = 10 then number_of_bins = 1024 or bin names will
|
||||
// have a suffix between "000" and "3ff" in hex and suffix_len will be 3
|
||||
// meaning the third bin will have a suffix of "003".
|
||||
this.numberOfBins = Math.pow(2, bitLength);
|
||||
// suffix_len is calculated based on "number_of_bins - 1" as the name
|
||||
// of the last bin contains the number "number_of_bins -1" as a suffix.
|
||||
this.suffixLen = (this.numberOfBins - 1).toString(16).length;
|
||||
}
|
||||
equals(other) {
|
||||
if (!(other instanceof SuccinctRoles)) {
|
||||
return false;
|
||||
}
|
||||
return (super.equals(other) &&
|
||||
this.bitLength === other.bitLength &&
|
||||
this.namePrefix === other.namePrefix);
|
||||
}
|
||||
/***
|
||||
* Calculates the name of the delegated role responsible for 'target_filepath'.
|
||||
*
|
||||
* The target at path ''target_filepath' is assigned to a bin by casting
|
||||
* the left-most 'bit_length' of bits of the file path hash digest to
|
||||
* int, using it as bin index between 0 and '2**bit_length - 1'.
|
||||
*
|
||||
* Args:
|
||||
* target_filepath: URL path to a target file, relative to a base
|
||||
* targets URL.
|
||||
*/
|
||||
getRoleForTarget(targetFilepath) {
|
||||
const hasher = crypto_1.default.createHash('sha256');
|
||||
const hasherBuffer = hasher.update(targetFilepath).digest();
|
||||
// can't ever need more than 4 bytes (32 bits).
|
||||
const hashBytes = hasherBuffer.subarray(0, 4);
|
||||
// Right shift hash bytes, so that we only have the leftmost
|
||||
// bit_length bits that we care about.
|
||||
const shiftValue = 32 - this.bitLength;
|
||||
const binNumber = hashBytes.readUInt32BE() >>> shiftValue;
|
||||
// Add zero padding if necessary and cast to hex the suffix.
|
||||
const suffix = binNumber.toString(16).padStart(this.suffixLen, '0');
|
||||
return `${this.namePrefix}-${suffix}`;
|
||||
}
|
||||
*getRoles() {
|
||||
for (let i = 0; i < this.numberOfBins; i++) {
|
||||
const suffix = i.toString(16).padStart(this.suffixLen, '0');
|
||||
yield `${this.namePrefix}-${suffix}`;
|
||||
}
|
||||
}
|
||||
/***
|
||||
* Determines whether the given ``role_name`` is in one of
|
||||
* the delegated roles that ``SuccinctRoles`` represents.
|
||||
*
|
||||
* Args:
|
||||
* role_name: The name of the role to check against.
|
||||
*/
|
||||
isDelegatedRole(roleName) {
|
||||
const desiredPrefix = this.namePrefix + '-';
|
||||
if (!roleName.startsWith(desiredPrefix)) {
|
||||
return false;
|
||||
}
|
||||
const suffix = roleName.slice(desiredPrefix.length, roleName.length);
|
||||
if (suffix.length != this.suffixLen) {
|
||||
return false;
|
||||
}
|
||||
// make sure the suffix is a hex string
|
||||
if (!suffix.match(/^[0-9a-fA-F]+$/)) {
|
||||
return false;
|
||||
}
|
||||
const num = parseInt(suffix, 16);
|
||||
return 0 <= num && num < this.numberOfBins;
|
||||
}
|
||||
toJSON() {
|
||||
const json = {
|
||||
...super.toJSON(),
|
||||
bit_length: this.bitLength,
|
||||
name_prefix: this.namePrefix,
|
||||
};
|
||||
return json;
|
||||
}
|
||||
static fromJSON(data) {
|
||||
const { keyids, threshold, bit_length, name_prefix, ...rest } = data;
|
||||
if (!utils_1.guard.isStringArray(keyids)) {
|
||||
throw new TypeError('keyids must be an array of strings');
|
||||
}
|
||||
if (typeof threshold !== 'number') {
|
||||
throw new TypeError('threshold must be a number');
|
||||
}
|
||||
if (typeof bit_length !== 'number') {
|
||||
throw new TypeError('bit_length must be a number');
|
||||
}
|
||||
if (typeof name_prefix !== 'string') {
|
||||
throw new TypeError('name_prefix must be a string');
|
||||
}
|
||||
return new SuccinctRoles({
|
||||
keyIDs: keyids,
|
||||
threshold,
|
||||
bitLength: bit_length,
|
||||
namePrefix: name_prefix,
|
||||
unrecognizedFields: rest,
|
||||
});
|
||||
}
|
||||
}
|
||||
exports.SuccinctRoles = SuccinctRoles;
|
||||
Reference in New Issue
Block a user