Skip to content

Commit f696b51

Browse files
authored
deps: @sigstore/[email protected] (#7132)
Signed-off-by: Brian DeHamer <[email protected]>
1 parent 004cf40 commit f696b51

File tree

11 files changed

+107
-65
lines changed

11 files changed

+107
-65
lines changed

node_modules/@sigstore/tuf/dist/client.js

Lines changed: 55 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,29 @@ limitations under the License.
2222
const fs_1 = __importDefault(require("fs"));
2323
const path_1 = __importDefault(require("path"));
2424
const tuf_js_1 = require("tuf-js");
25+
const _1 = require(".");
2526
const target_1 = require("./target");
27+
const TUF_SEEDS_PATH = require.resolve('../seeds.json');
28+
const TARGETS_DIR_NAME = 'targets';
2629
class TUFClient {
2730
constructor(options) {
28-
initTufCache(options);
29-
const remote = initRemoteConfig(options);
30-
this.updater = initClient(options.cachePath, remote, options);
31+
const url = new URL(options.mirrorURL);
32+
const repoName = encodeURIComponent(url.host + url.pathname.replace(/\/$/, ''));
33+
const cachePath = path_1.default.join(options.cachePath, repoName);
34+
initTufCache(cachePath);
35+
seedCache({
36+
cachePath,
37+
mirrorURL: options.mirrorURL,
38+
tufRootPath: options.rootPath,
39+
forceInit: options.forceInit,
40+
});
41+
this.updater = initClient({
42+
mirrorURL: options.mirrorURL,
43+
cachePath,
44+
forceCache: options.forceCache,
45+
retry: options.retry,
46+
timeout: options.timeout,
47+
});
3148
}
3249
async refresh() {
3350
return this.updater.refresh();
@@ -42,53 +59,55 @@ exports.TUFClient = TUFClient;
4259
// created. If the targets directory does not exist, it will be created.
4360
// If the root.json file does not exist, it will be copied from the
4461
// rootPath argument.
45-
function initTufCache({ cachePath, rootPath: tufRootPath, force, }) {
46-
const targetsPath = path_1.default.join(cachePath, 'targets');
47-
const cachedRootPath = path_1.default.join(cachePath, 'root.json');
62+
function initTufCache(cachePath) {
63+
const targetsPath = path_1.default.join(cachePath, TARGETS_DIR_NAME);
4864
if (!fs_1.default.existsSync(cachePath)) {
4965
fs_1.default.mkdirSync(cachePath, { recursive: true });
5066
}
5167
if (!fs_1.default.existsSync(targetsPath)) {
5268
fs_1.default.mkdirSync(targetsPath);
5369
}
54-
// If the root.json file does not exist (or we're forcing re-initialization),
55-
// copy it from the rootPath argument
56-
if (!fs_1.default.existsSync(cachedRootPath) || force) {
57-
fs_1.default.copyFileSync(tufRootPath, cachedRootPath);
58-
}
59-
return cachePath;
6070
}
61-
// Initializes the remote.json file, which contains the URL of the TUF
62-
// repository. If the file does not exist, it will be created. If the file
63-
// exists, it will be parsed and returned.
64-
function initRemoteConfig({ cachePath, mirrorURL, force, }) {
65-
let remoteConfig;
66-
const remoteConfigPath = path_1.default.join(cachePath, 'remote.json');
67-
// If the remote config file exists, read it and parse it (skip if force is
68-
// true)
69-
if (!force && fs_1.default.existsSync(remoteConfigPath)) {
70-
const data = fs_1.default.readFileSync(remoteConfigPath, 'utf-8');
71-
remoteConfig = JSON.parse(data);
72-
}
73-
// If the remote config file does not exist (or we're forcing initialization),
74-
// create it
75-
if (!remoteConfig || force) {
76-
remoteConfig = { mirror: mirrorURL };
77-
fs_1.default.writeFileSync(remoteConfigPath, JSON.stringify(remoteConfig));
71+
// Populates the TUF cache with the initial root.json file. If the root.json
72+
// file does not exist (or we're forcing re-initialization), copy it from either
73+
// the rootPath argument or from one of the repo seeds.
74+
function seedCache({ cachePath, mirrorURL, tufRootPath, forceInit, }) {
75+
const cachedRootPath = path_1.default.join(cachePath, 'root.json');
76+
// If the root.json file does not exist (or we're forcing re-initialization),
77+
// populate it either from the supplied rootPath or from one of the repo seeds.
78+
if (!fs_1.default.existsSync(cachedRootPath) || forceInit) {
79+
if (tufRootPath) {
80+
fs_1.default.copyFileSync(tufRootPath, cachedRootPath);
81+
}
82+
else {
83+
// Load the embedded repo seeds
84+
const seeds = JSON.parse(fs_1.default.readFileSync(TUF_SEEDS_PATH).toString('utf-8'));
85+
const repoSeed = seeds[mirrorURL];
86+
if (!repoSeed) {
87+
throw new _1.TUFError({
88+
code: 'TUF_INIT_CACHE_ERROR',
89+
message: `No root.json found for mirror: ${mirrorURL}`,
90+
});
91+
}
92+
fs_1.default.writeFileSync(cachedRootPath, Buffer.from(repoSeed['root.json'], 'base64'));
93+
// Copy any seed targets into the cache
94+
Object.entries(repoSeed.targets).forEach(([targetName, target]) => {
95+
fs_1.default.writeFileSync(path_1.default.join(cachePath, TARGETS_DIR_NAME, targetName), Buffer.from(target, 'base64'));
96+
});
97+
}
7898
}
79-
return remoteConfig;
8099
}
81-
function initClient(cachePath, remote, options) {
82-
const baseURL = remote.mirror;
100+
function initClient(options) {
83101
const config = {
84102
fetchTimeout: options.timeout,
85103
fetchRetry: options.retry,
86104
};
87105
return new tuf_js_1.Updater({
88-
metadataBaseUrl: baseURL,
89-
targetBaseUrl: `${baseURL}/targets`,
90-
metadataDir: cachePath,
91-
targetDir: path_1.default.join(cachePath, 'targets'),
106+
metadataBaseUrl: options.mirrorURL,
107+
targetBaseUrl: `${options.mirrorURL}/targets`,
108+
metadataDir: options.cachePath,
109+
targetDir: path_1.default.join(options.cachePath, TARGETS_DIR_NAME),
110+
forceCache: options.forceCache,
92111
config,
93112
});
94113
}

node_modules/@sigstore/tuf/dist/index.js

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ const appdata_1 = require("./appdata");
2121
const client_1 = require("./client");
2222
exports.DEFAULT_MIRROR_URL = 'https://tuf-repo-cdn.sigstore.dev';
2323
const DEFAULT_CACHE_DIR = 'sigstore-js';
24-
const DEFAULT_TUF_ROOT_PATH = '../store/public-good-instance-root.json';
2524
const DEFAULT_RETRY = { retries: 2 };
2625
const DEFAULT_TIMEOUT = 5000;
2726
const TRUSTED_ROOT_TARGET = 'trusted_root.json';
@@ -45,11 +44,12 @@ function createClient(options) {
4544
/* istanbul ignore next */
4645
return new client_1.TUFClient({
4746
cachePath: options.cachePath || (0, appdata_1.appDataPath)(DEFAULT_CACHE_DIR),
48-
rootPath: options.rootPath || require.resolve(DEFAULT_TUF_ROOT_PATH),
47+
rootPath: options.rootPath,
4948
mirrorURL: options.mirrorURL || exports.DEFAULT_MIRROR_URL,
5049
retry: options.retry ?? DEFAULT_RETRY,
5150
timeout: options.timeout ?? DEFAULT_TIMEOUT,
52-
force: options.force ?? false,
51+
forceCache: options.forceCache ?? false,
52+
forceInit: options.forceInit ?? options.force ?? false,
5353
});
5454
}
5555
var error_1 = require("./error");

node_modules/@sigstore/tuf/package.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@sigstore/tuf",
3-
"version": "2.2.0",
3+
"version": "2.3.0",
44
"description": "Client for the Sigstore TUF repository",
55
"main": "dist/index.js",
66
"types": "dist/index.d.ts",
@@ -11,7 +11,7 @@
1111
},
1212
"files": [
1313
"dist",
14-
"store"
14+
"seeds.json"
1515
],
1616
"author": "[email protected]",
1717
"license": "Apache-2.0",
@@ -29,11 +29,11 @@
2929
"devDependencies": {
3030
"@sigstore/jest": "^0.0.0",
3131
"@tufjs/repo-mock": "^2.0.0",
32-
"@types/make-fetch-happen": "^10.0.0"
32+
"@types/make-fetch-happen": "^10.0.4"
3333
},
3434
"dependencies": {
3535
"@sigstore/protobuf-specs": "^0.2.1",
36-
"tuf-js": "^2.1.0"
36+
"tuf-js": "^2.2.0"
3737
},
3838
"engines": {
3939
"node": "^16.14.0 || >=18.0.0"

node_modules/@sigstore/tuf/seeds.json

Lines changed: 1 addition & 0 deletions
Large diffs are not rendered by default.

node_modules/@sigstore/tuf/store/public-good-instance-root.json

Lines changed: 0 additions & 1 deletion
This file was deleted.

node_modules/tuf-js/dist/config.js

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@ exports.defaultConfig = void 0;
44
exports.defaultConfig = {
55
maxRootRotations: 32,
66
maxDelegations: 32,
7-
rootMaxLength: 512000,
8-
timestampMaxLength: 16384,
9-
snapshotMaxLength: 2000000,
10-
targetsMaxLength: 5000000,
7+
rootMaxLength: 512000, //bytes
8+
timestampMaxLength: 16384, // bytes
9+
snapshotMaxLength: 2000000, // bytes
10+
targetsMaxLength: 5000000, // bytes
1111
prefixTargetsWithHash: true,
12-
fetchTimeout: 100000,
12+
fetchTimeout: 100000, // milliseconds
1313
fetchRetries: undefined,
1414
fetchRetry: 2,
1515
};

node_modules/tuf-js/dist/updater.js

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ class Updater {
4444
this.metadataBaseUrl = metadataBaseUrl;
4545
this.targetDir = targetDir;
4646
this.targetBaseUrl = targetBaseUrl;
47+
this.forceCache = options.forceCache ?? false;
4748
const data = this.loadLocalMetadata(models_1.MetadataKind.Root);
4849
this.trustedSet = new store_1.TrustedMetadataStore(data);
4950
this.config = { ...config_1.defaultConfig, ...config };
@@ -57,8 +58,25 @@ class Updater {
5758
// refresh and load the metadata before downloading the target
5859
// refresh should be called once after the client is initialized
5960
async refresh() {
60-
await this.loadRoot();
61-
await this.loadTimestamp();
61+
// If forceCache is true, try to load the timestamp from local storage
62+
// without fetching it from the remote. Otherwise, load the root and
63+
// timestamp from the remote per the TUF spec.
64+
if (this.forceCache) {
65+
// If anything fails, load the root and timestamp from the remote. This
66+
// should cover any situation where the local metadata is corrupted or
67+
// expired.
68+
try {
69+
await this.loadTimestamp({ checkRemote: false });
70+
}
71+
catch (error) {
72+
await this.loadRoot();
73+
await this.loadTimestamp();
74+
}
75+
}
76+
else {
77+
await this.loadRoot();
78+
await this.loadTimestamp();
79+
}
6280
await this.loadSnapshot();
6381
await this.loadTargets(models_1.MetadataKind.Targets, models_1.MetadataKind.Root);
6482
}
@@ -143,11 +161,16 @@ class Updater {
143161
}
144162
// Load local and remote timestamp metadata.
145163
// Client workflow 5.4: update timestamp role
146-
async loadTimestamp() {
164+
async loadTimestamp({ checkRemote } = { checkRemote: true }) {
147165
// Load local and remote timestamp metadata
148166
try {
149167
const data = this.loadLocalMetadata(models_1.MetadataKind.Timestamp);
150168
this.trustedSet.updateTimestamp(data);
169+
// If checkRemote is disabled, return here to avoid fetching the remote
170+
// timestamp metadata.
171+
if (!checkRemote) {
172+
return;
173+
}
151174
}
152175
catch (error) {
153176
// continue

node_modules/tuf-js/package.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "tuf-js",
3-
"version": "2.1.0",
3+
"version": "2.2.0",
44
"description": "JavaScript implementation of The Update Framework (TUF)",
55
"main": "dist/index.js",
66
"types": "dist/index.d.ts",
@@ -29,8 +29,8 @@
2929
"homepage": "https://github.com/theupdateframework/tuf-js/tree/main/packages/client#readme",
3030
"devDependencies": {
3131
"@tufjs/repo-mock": "2.0.0",
32-
"@types/debug": "^4.1.8",
33-
"@types/make-fetch-happen": "^10.0.1"
32+
"@types/debug": "^4.1.12",
33+
"@types/make-fetch-happen": "^10.0.4"
3434
},
3535
"dependencies": {
3636
"@tufjs/models": "2.0.0",

package-lock.json

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@
9797
"@npmcli/package-json": "^5.0.0",
9898
"@npmcli/promise-spawn": "^7.0.1",
9999
"@npmcli/run-script": "^7.0.3",
100-
"@sigstore/tuf": "^2.2.0",
100+
"@sigstore/tuf": "^2.3.0",
101101
"abbrev": "^2.0.0",
102102
"archy": "~1.0.0",
103103
"cacache": "^18.0.2",
@@ -2160,13 +2160,13 @@
21602160
}
21612161
},
21622162
"node_modules/@sigstore/tuf": {
2163-
"version": "2.2.0",
2164-
"resolved": "https://registry.npmjs.org/@sigstore/tuf/-/tuf-2.2.0.tgz",
2165-
"integrity": "sha512-KKATZ5orWfqd9ZG6MN8PtCIx4eevWSuGRKQvofnWXRpyMyUEpmrzg5M5BrCpjM+NfZ0RbNGOh5tCz/P2uoRqOA==",
2163+
"version": "2.3.0",
2164+
"resolved": "https://registry.npmjs.org/@sigstore/tuf/-/tuf-2.3.0.tgz",
2165+
"integrity": "sha512-S98jo9cpJwO1mtQ+2zY7bOdcYyfVYCUaofCG6wWRzk3pxKHVAkSfshkfecto2+LKsx7Ovtqbgb2LS8zTRhxJ9Q==",
21662166
"inBundle": true,
21672167
"dependencies": {
21682168
"@sigstore/protobuf-specs": "^0.2.1",
2169-
"tuf-js": "^2.1.0"
2169+
"tuf-js": "^2.2.0"
21702170
},
21712171
"engines": {
21722172
"node": "^16.14.0 || >=18.0.0"
@@ -15264,9 +15264,9 @@
1526415264
}
1526515265
},
1526615266
"node_modules/tuf-js": {
15267-
"version": "2.1.0",
15268-
"resolved": "https://registry.npmjs.org/tuf-js/-/tuf-js-2.1.0.tgz",
15269-
"integrity": "sha512-eD7YPPjVlMzdggrOeE8zwoegUaG/rt6Bt3jwoQPunRiNVzgcCE009UDFJKJjG+Gk9wFu6W/Vi+P5d/5QpdD9jA==",
15267+
"version": "2.2.0",
15268+
"resolved": "https://registry.npmjs.org/tuf-js/-/tuf-js-2.2.0.tgz",
15269+
"integrity": "sha512-ZSDngmP1z6zw+FIkIBjvOp/II/mIub/O7Pp12j1WNsiCpg5R5wAc//i555bBQsE44O94btLt0xM/Zr2LQjwdCg==",
1527015270
"inBundle": true,
1527115271
"dependencies": {
1527215272
"@tufjs/models": "2.0.0",

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
"@npmcli/package-json": "^5.0.0",
6060
"@npmcli/promise-spawn": "^7.0.1",
6161
"@npmcli/run-script": "^7.0.3",
62-
"@sigstore/tuf": "^2.2.0",
62+
"@sigstore/tuf": "^2.3.0",
6363
"abbrev": "^2.0.0",
6464
"archy": "~1.0.0",
6565
"cacache": "^18.0.2",

0 commit comments

Comments
 (0)