Signed packages handling in RegistryClient (without swift-crypto)

Package.swift

@@ -4,7 +4,7 @@
 //
 // This source file is part of the Swift open source project
 //
-// Copyright (c) 2014-2022 Apple Inc. and the Swift project authors
+// Copyright (c) 2014-2023 Apple Inc. and the Swift project authors
 // Licensed under Apache License v2.0 with Runtime Library Exception
 //
 // See http://swift.org/LICENSE.txt for license information
@@ -204,7 +204,8 @@ let package = Package(
                 "Basics",
                 "PackageFingerprint",
                 "PackageLoading",
-                "PackageModel"
+                "PackageModel",
+                "PackageSigning",
             ],
             exclude: ["CMakeLists.txt"]
         ),
@@ -293,10 +294,12 @@ let package = Package(
         .target(
             name: "PackageSigning",
             dependencies: [
-                .product(name: "Crypto", package: "swift-crypto"),
+                // TODO: uncomment once we resolve build problems
+//                .product(name: "Crypto", package: "swift-crypto"),
                 "Basics",
                 "PackageModel",
-            ]
+            ],
+            exclude: ["CMakeLists.txt"]
         ),
 
         // MARK: Package Manager Functionality
@@ -348,6 +351,7 @@ let package = Package(
                 "PackageGraph",
                 "PackageModel",
                 "PackageRegistry",
+                "PackageSigning",
                 "SourceControl",
                 "SPMBuildCore",
             ],
@@ -373,7 +377,6 @@ let package = Package(
                 .product(name: "ArgumentParser", package: "swift-argument-parser"),
                 "Basics",
                 "Build",
-                "PackageFingerprint",
                 "PackageLoading",
                 "PackageModel",
                 "PackageGraph",
@@ -540,6 +543,7 @@ let package = Package(
                 "PackageGraph",
                 "PackageLoading",
                 "PackageRegistry",
+                "PackageSigning",
                 "SourceControl",
                 .product(name: "TSCTestSupport", package: "swift-tools-support-core"),
                 "Workspace",

Sources/CMakeLists.txt

@@ -22,6 +22,7 @@ add_subdirectory(PackageLoading)
 add_subdirectory(PackageModel)
 add_subdirectory(PackagePlugin)
 add_subdirectory(PackageRegistry)
+add_subdirectory(PackageSigning)
 add_subdirectory(SPMBuildCore)
 add_subdirectory(SPMLLBuild)
 add_subdirectory(SourceControl)

Sources/CoreCommands/Options.swift

@@ -2,7 +2,7 @@
 //
 // This source file is part of the Swift open source project
 //
-// Copyright (c) 2014-2022 Apple Inc. and the Swift project authors
+// Copyright (c) 2014-2023 Apple Inc. and the Swift project authors
 // Licensed under Apache License v2.0 with Runtime Library Exception
 //
 // See http://swift.org/LICENSE.txt for license information
@@ -14,8 +14,6 @@ import ArgumentParser
 
 import struct Foundation.URL
 
-import enum PackageFingerprint.FingerprintCheckingMode
-
 import enum PackageModel.BuildConfiguration
 import struct PackageModel.BuildFlags
 import struct PackageModel.EnabledSanitizers
@@ -31,6 +29,8 @@ import struct TSCBasic.StringError
 import struct TSCUtility.Triple
 import struct TSCUtility.Version
 
+import struct Workspace.WorkspaceConfiguration
+
 public struct GlobalOptions: ParsableArguments {
     public init() {}
 
@@ -217,7 +217,10 @@ public struct SecurityOptions: ParsableArguments {
     #endif
 
     @Option(name: .customLong("resolver-fingerprint-checking"))
-    public var fingerprintCheckingMode: FingerprintCheckingMode = .strict
+    public var fingerprintCheckingMode: WorkspaceConfiguration.CheckingMode = .strict
+
+    @Option(name: .customLong("resolver-signing-entity-checking"))
+    public var signingEntityCheckingMode: WorkspaceConfiguration.CheckingMode = .warn
 }
 
 public struct ResolverOptions: ParsableArguments {
@@ -473,7 +476,7 @@ extension AbsolutePath: ExpressibleByArgument {
     }
 }
 
-extension FingerprintCheckingMode: ExpressibleByArgument {
+extension WorkspaceConfiguration.CheckingMode: ExpressibleByArgument {
     public init?(argument: String) {
         self.init(rawValue: argument)
     }

Sources/CoreCommands/SwiftTool.swift

@@ -2,7 +2,7 @@
 //
 // This source file is part of the Swift open source project
 //
-// Copyright (c) 2014-2022 Apple Inc. and the Swift project authors
+// Copyright (c) 2014-2023 Apple Inc. and the Swift project authors
 // Licensed under Apache License v2.0 with Runtime Library Exception
 //
 // See http://swift.org/LICENSE.txt for license information
@@ -463,6 +463,7 @@ public final class SwiftTool {
                 additionalFileRules: isXcodeBuildSystemEnabled ? FileRuleDescription.xcbuildFileTypes : FileRuleDescription.swiftpmFileTypes,
                 sharedDependenciesCacheEnabled: self.options.caching.useDependenciesCache,
                 fingerprintCheckingMode: self.options.security.fingerprintCheckingMode,
+                signingEntityCheckingMode: self.options.security.signingEntityCheckingMode,
                 sourceControlToRegistryDependencyTransformation: self.options.resolver.sourceControlToRegistryDependencyTransformation.workspaceConfiguration,
                 restrictImports: .none
             ),

Sources/PackageModel/PackageIdentity.swift

@@ -74,7 +74,7 @@ public struct PackageIdentity: CustomStringConvertible, Sendable {
         self.registry != nil
     }
 
-    public struct RegistryIdentity: CustomStringConvertible {
+    public struct RegistryIdentity: Hashable, CustomStringConvertible {
         public let scope: PackageIdentity.Scope
         public let name: PackageIdentity.Name
         public let underlying: PackageIdentity

Sources/PackageRegistry/CMakeLists.txt

@@ -7,16 +7,19 @@
 # See http://swift.org/CONTRIBUTORS.txt for Swift project authors
 
 add_library(PackageRegistry STATIC
+  ChecksumTOFU.swift
   Registry.swift
   RegistryConfiguration.swift
   RegistryClient.swift
   RegistryDownloadsManager.swift
-  ChecksumTOFU.swift)
+  SignatureValidation.swift
+  SigningEntityTOFU.swift)
 target_link_libraries(PackageRegistry PUBLIC
   Basics
   PackageFingerprint
   PackageLoading
   PackageModel
+  PackageSigning
   TSCBasic
   TSCUtility)
 # NOTE(compnerd) workaround for CMake not setting up include flags yet

Sources/PackageRegistry/ChecksumTOFU.swift

@@ -34,7 +34,7 @@ struct PackageVersionChecksumTOFU {
         self.registryClient = registryClient
     }
 
-    func check(
+    func validate(
         registry: Registry,
         package: PackageIdentity.RegistryIdentity,
         version: Version,
@@ -104,9 +104,7 @@ struct PackageVersionChecksumTOFU {
                 ) { result in
                     switch result {
                     case .success(let metadata):
-                        guard let sourceArchive = metadata.resources
-                            .first(where: { $0.name == "source-archive" })
-                        else {
+                        guard let sourceArchive = metadata.sourceArchive else {
                             return completion(.failure(RegistryError.missingSourceArchive))
                         }