deps: npm update

DEPENDENCIES.md

@@ -105,6 +105,7 @@ graph LR;
   npm-->libnpmversion;
   npm-->make-fetch-happen;
   npm-->nopt;
+  npm-->normalize-package-data;
   npm-->npm-audit-report;
   npm-->npm-install-checks;
   npm-->npm-package-arg;
@@ -516,6 +517,7 @@ graph LR;
   npm-->nock;
   npm-->node-gyp;
   npm-->nopt;
+  npm-->normalize-package-data;
   npm-->npm-audit-report;
   npm-->npm-install-checks;
   npm-->npm-package-arg;
@@ -764,7 +766,8 @@ graph LR;
   tar-->mkdirp;
   tar-->yallist;
   tuf-js-->make-fetch-happen;
-  tuf-js-->minimatch;
+  tuf-js-->tufjs-models["@tufjs/models"];
+  tufjs-models-->minimatch;
   unique-filename-->unique-slug;
   unique-slug-->imurmurhash;
   validate-npm-package-license-->spdx-correct;

node_modules/.gitignore

@@ -32,6 +32,9 @@
 !/@tootallnate/
 /@tootallnate/*
 !/@tootallnate/once
+!/@tufjs/
+/@tufjs/*
+!/@tufjs/models
 !/abbrev
 !/abort-controller
 !/agent-base

node_modules/@tufjs/models/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 GitHub and the TUF Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

node_modules/tuf-js/dist/models/base.d.ts → node_modules/@tufjs/models/dist/base.d.ts

@@ -1,5 +1,5 @@
-import { JSONObject, JSONValue } from '../utils/types';
 import { Signature } from './signature';
+import { JSONObject, JSONValue } from './utils';
 export interface Signable {
     signatures: Record<string, Signature>;
     signed: Signed;
@@ -10,6 +10,13 @@ export interface SignedOptions {
     expires?: string;
     unrecognizedFields?: Record<string, JSONValue>;
 }
+export declare enum MetadataKind {
+    Root = "root",
+    Timestamp = "timestamp",
+    Snapshot = "snapshot",
+    Targets = "targets"
+}
+export declare function isMetadataKind(value: unknown): value is MetadataKind;
 /***
  * A base class for the signed part of TUF metadata.
  *

node_modules/tuf-js/dist/models/base.js → node_modules/@tufjs/models/dist/base.js

@@ -3,11 +3,23 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Signed = void 0;
+exports.Signed = exports.isMetadataKind = exports.MetadataKind = void 0;
 const util_1 = __importDefault(require("util"));
-const error_1 = require("../error");
-const utils_1 = require("../utils");
+const error_1 = require("./error");
+const utils_1 = require("./utils");
 const SPECIFICATION_VERSION = ['1', '0', '31'];
+var MetadataKind;
+(function (MetadataKind) {
+    MetadataKind["Root"] = "root";
+    MetadataKind["Timestamp"] = "timestamp";
+    MetadataKind["Snapshot"] = "snapshot";
+    MetadataKind["Targets"] = "targets";
+})(MetadataKind = exports.MetadataKind || (exports.MetadataKind = {}));
+function isMetadataKind(value) {
+    return (typeof value === 'string' &&
+        Object.values(MetadataKind).includes(value));
+}
+exports.isMetadataKind = isMetadataKind;
 /***
  * A base class for the signed part of TUF metadata.
  *

node_modules/tuf-js/dist/models/delegations.d.ts → node_modules/@tufjs/models/dist/delegations.d.ts

@@ -1,6 +1,6 @@
-import { JSONObject, JSONValue } from '../utils/types';
 import { Key } from './key';
 import { DelegatedRole, SuccinctRoles } from './role';
+import { JSONObject, JSONValue } from './utils';
 type DelegatedRoleMap = Record<string, DelegatedRole>;
 type KeyMap = Record<string, Key>;
 interface DelegationsOptions {

node_modules/tuf-js/dist/models/delegations.js → node_modules/@tufjs/models/dist/delegations.js

@@ -5,10 +5,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Delegations = void 0;
 const util_1 = __importDefault(require("util"));
-const error_1 = require("../error");
-const guard_1 = require("../utils/guard");
+const error_1 = require("./error");
 const key_1 = require("./key");
 const role_1 = require("./role");
+const utils_1 = require("./utils");
 /**
  * A container object storing information about all delegations.
  *
@@ -67,7 +67,7 @@ class Delegations {
     static fromJSON(data) {
         const { keys, roles, succinct_roles, ...unrecognizedFields } = data;
         let succinctRoles;
-        if ((0, guard_1.isObject)(succinct_roles)) {
+        if (utils_1.guard.isObject(succinct_roles)) {
             succinctRoles = role_1.SuccinctRoles.fromJSON(succinct_roles);
         }
         return new Delegations({
@@ -89,7 +89,7 @@ function rolesToJSON(roles) {
     return Object.values(roles).map((role) => role.toJSON());
 }
 function keysFromJSON(data) {
-    if (!(0, guard_1.isObjectRecord)(data)) {
+    if (!utils_1.guard.isObjectRecord(data)) {
         throw new TypeError('keys is malformed');
     }
     return Object.entries(data).reduce((acc, [keyID, keyData]) => ({
@@ -99,8 +99,8 @@ function keysFromJSON(data) {
 }
 function rolesFromJSON(data) {
     let roleMap;
-    if ((0, guard_1.isDefined)(data)) {
-        if (!(0, guard_1.isObjectArray)(data)) {
+    if (utils_1.guard.isDefined(data)) {
+        if (!utils_1.guard.isObjectArray(data)) {
             throw new TypeError('roles is malformed');
         }
         roleMap = data.reduce((acc, role) => {

node_modules/@tufjs/models/dist/error.d.ts

@@ -0,0 +1,12 @@
+export declare class ValueError extends Error {
+}
+export declare class RepositoryError extends Error {
+}
+export declare class UnsignedMetadataError extends RepositoryError {
+}
+export declare class LengthOrHashMismatchError extends RepositoryError {
+}
+export declare class CryptoError extends Error {
+}
+export declare class UnsupportedAlgorithmError extends CryptoError {
+}

node_modules/@tufjs/models/dist/error.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnsupportedAlgorithmError = exports.CryptoError = exports.LengthOrHashMismatchError = exports.UnsignedMetadataError = exports.RepositoryError = exports.ValueError = void 0;
+// An error about insufficient values
+class ValueError extends Error {
+}
+exports.ValueError = ValueError;
+// An error with a repository's state, such as a missing file.
+// It covers all exceptions that come from the repository side when
+// looking from the perspective of users of metadata API or ngclient.
+class RepositoryError extends Error {
+}
+exports.RepositoryError = RepositoryError;
+// An error about metadata object with insufficient threshold of signatures.
+class UnsignedMetadataError extends RepositoryError {
+}
+exports.UnsignedMetadataError = UnsignedMetadataError;
+// An error while checking the length and hash values of an object.
+class LengthOrHashMismatchError extends RepositoryError {
+}
+exports.LengthOrHashMismatchError = LengthOrHashMismatchError;
+class CryptoError extends Error {
+}
+exports.CryptoError = CryptoError;
+class UnsupportedAlgorithmError extends CryptoError {
+}
+exports.UnsupportedAlgorithmError = UnsupportedAlgorithmError;

node_modules/tuf-js/dist/models/file.d.ts → node_modules/@tufjs/models/dist/file.d.ts

@@ -1,7 +1,7 @@
 /// <reference types="node" />
 /// <reference types="node" />
 import { Readable } from 'stream';
-import { JSONObject, JSONValue } from '../utils/types';
+import { JSONObject, JSONValue } from './utils';
 interface MetaFileOptions {
     version: number;
     length?: number;

node_modules/tuf-js/dist/models/file.js → node_modules/@tufjs/models/dist/file.js

@@ -6,8 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TargetFile = exports.MetaFile = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 const util_1 = __importDefault(require("util"));
-const error_1 = require("../error");
-const guard_1 = require("../utils/guard");
+const error_1 = require("./error");
+const utils_1 = require("./utils");
 // A container with information about a particular metadata file.
 //
 // This class is used for Timestamp and Snapshot metadata.
@@ -75,10 +75,10 @@ class MetaFile {
         if (typeof version !== 'number') {
             throw new TypeError('version must be a number');
         }
-        if ((0, guard_1.isDefined)(length) && typeof length !== 'number') {
+        if (utils_1.guard.isDefined(length) && typeof length !== 'number') {
             throw new TypeError('length must be a number');
         }
-        if ((0, guard_1.isDefined)(hashes) && !(0, guard_1.isStringRecord)(hashes)) {
+        if (utils_1.guard.isDefined(hashes) && !utils_1.guard.isStringRecord(hashes)) {
             throw new TypeError('hashes must be string keys and values');
         }
         return new MetaFile({
@@ -163,7 +163,7 @@ class TargetFile {
         if (typeof length !== 'number') {
             throw new TypeError('length must be a number');
         }
-        if (!(0, guard_1.isStringRecord)(hashes)) {
+        if (!utils_1.guard.isStringRecord(hashes)) {
             throw new TypeError('hashes must have string keys and values');
         }
         return new TargetFile({

node_modules/@tufjs/models/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { MetadataKind } from './base';
+export { ValueError } from './error';
+export { MetaFile, TargetFile } from './file';
+export { Key } from './key';
+export { Metadata } from './metadata';
+export { Root } from './root';
+export { Signature } from './signature';
+export { Snapshot } from './snapshot';
+export { Targets } from './targets';
+export { Timestamp } from './timestamp';

node_modules/@tufjs/models/dist/index.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Timestamp = exports.Targets = exports.Snapshot = exports.Signature = exports.Root = exports.Metadata = exports.Key = exports.TargetFile = exports.MetaFile = exports.ValueError = exports.MetadataKind = void 0;
+var base_1 = require("./base");
+Object.defineProperty(exports, "MetadataKind", { enumerable: true, get: function () { return base_1.MetadataKind; } });
+var error_1 = require("./error");
+Object.defineProperty(exports, "ValueError", { enumerable: true, get: function () { return error_1.ValueError; } });
+var file_1 = require("./file");
+Object.defineProperty(exports, "MetaFile", { enumerable: true, get: function () { return file_1.MetaFile; } });
+Object.defineProperty(exports, "TargetFile", { enumerable: true, get: function () { return file_1.TargetFile; } });
+var key_1 = require("./key");
+Object.defineProperty(exports, "Key", { enumerable: true, get: function () { return key_1.Key; } });
+var metadata_1 = require("./metadata");
+Object.defineProperty(exports, "Metadata", { enumerable: true, get: function () { return metadata_1.Metadata; } });
+var root_1 = require("./root");
+Object.defineProperty(exports, "Root", { enumerable: true, get: function () { return root_1.Root; } });
+var signature_1 = require("./signature");
+Object.defineProperty(exports, "Signature", { enumerable: true, get: function () { return signature_1.Signature; } });
+var snapshot_1 = require("./snapshot");
+Object.defineProperty(exports, "Snapshot", { enumerable: true, get: function () { return snapshot_1.Snapshot; } });
+var targets_1 = require("./targets");
+Object.defineProperty(exports, "Targets", { enumerable: true, get: function () { return targets_1.Targets; } });
+var timestamp_1 = require("./timestamp");
+Object.defineProperty(exports, "Timestamp", { enumerable: true, get: function () { return timestamp_1.Timestamp; } });

node_modules/tuf-js/dist/models/key.d.ts → node_modules/@tufjs/models/dist/key.d.ts

@@ -1,5 +1,5 @@
-import { JSONObject, JSONValue } from '../utils/types';
 import { Signable } from './base';
+import { JSONObject, JSONValue } from './utils';
 export interface KeyOptions {
     keyID: string;
     keyType: string;

node_modules/tuf-js/dist/models/key.js → node_modules/@tufjs/models/dist/key.js

@@ -1,37 +1,13 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Key = void 0;
 const util_1 = __importDefault(require("util"));
-const error_1 = require("../error");
-const guard_1 = require("../utils/guard");
-const key_1 = require("../utils/key");
-const signer = __importStar(require("../utils/signer"));
+const error_1 = require("./error");
+const utils_1 = require("./utils");
+const key_1 = require("./utils/key");
 // A container class representing the public portion of a Key.
 class Key {
     constructor(options) {
@@ -57,7 +33,7 @@ class Key {
         });
         const signedData = metadata.signed.toJSON();
         try {
-            if (!signer.verifySignature(signedData, publicKey, signature.sig)) {
+            if (!utils_1.crypto.verifySignature(signedData, publicKey, signature.sig)) {
                 throw new error_1.UnsignedMetadataError(`failed to verify ${this.keyID} signature`);
             }
         }
@@ -94,7 +70,7 @@ class Key {
         if (typeof scheme !== 'string') {
             throw new TypeError('scheme must be a string');
         }
-        if (!(0, guard_1.isStringRecord)(keyval)) {
+        if (!utils_1.guard.isStringRecord(keyval)) {
             throw new TypeError('keyval must be a string record');
         }
         return new Key({

node_modules/tuf-js/dist/models/metadata.d.ts → node_modules/@tufjs/models/dist/metadata.d.ts

@@ -1,10 +1,11 @@
-import { JSONObject, JSONValue, MetadataKind } from '../utils/types';
-import { Signable } from './base';
+/// <reference types="node" />
+import { MetadataKind, Signable } from './base';
 import { Root } from './root';
 import { Signature } from './signature';
 import { Snapshot } from './snapshot';
 import { Targets } from './targets';
 import { Timestamp } from './timestamp';
+import { JSONObject, JSONValue } from './utils';
 type MetadataType = Root | Timestamp | Snapshot | Targets;
 /***
  * A container for signed TUF metadata.
@@ -35,8 +36,10 @@ export declare class Metadata<T extends MetadataType> implements Signable {
     signatures: Record<string, Signature>;
     unrecognizedFields: Record<string, JSONValue>;
     constructor(signed: T, signatures?: Record<string, Signature>, unrecognizedFields?: Record<string, JSONValue>);
+    sign(signer: (data: Buffer) => Signature, append?: boolean): void;
     verifyDelegate(delegatedRole: string, delegatedMetadata: Metadata<MetadataType>): void;
     equals(other: T): boolean;
+    toJSON(): JSONObject;
     static fromJSON(type: MetadataKind.Root, data: JSONObject): Metadata<Root>;
     static fromJSON(type: MetadataKind.Timestamp, data: JSONObject): Metadata<Timestamp>;
     static fromJSON(type: MetadataKind.Snapshot, data: JSONObject): Metadata<Snapshot>;