feat: verify pnpm 12 downloads against npm's registry signature

The action checked the release archive against the `digest` GitHub
publishes for it. GitHub serves both the asset and the digest, so
whoever can replace one can replace the other: that catches a corrupted
download, not a tampered one.

From v12 the npm registry carries the same executable, byte for byte,
and npm signs `<name>@<version>:<integrity>` with a key that is pinned
here. That signature cannot be produced without npm's private key, and
behind it sits the maintainer's approval of the staged publish — so v12
and newer are now fetched from the registry and refused unless both the
signature and the checksum check out.

v11 keeps using the release asset and its digest. Its `dist/` bundles
dependencies that the registry copy declares instead, and this action
has no step that would install them.

Two things fall out of not touching the GitHub API for v12+:

- `token` stops mattering there. It exists to lift the anonymous 60
  requests/hour limit on the release lookup.
- Versions published to npm without a GitHub release install fine now,
  instead of failing the lookup this action warns about.

The pinned keys are the ones pnpm itself pins for `pnpm audit
signatures`.

Author: zkochan

dist/index.js

@@ -2,11 +2,13 @@ import { HttpClient } from '@actions/http-client'
 import { spawn } from 'child_process'
 import { createHash } from 'crypto'
 import { createReadStream, createWriteStream, existsSync } from 'fs'
-import { chmod, copyFile, link, mkdir, rm } from 'fs/promises'
+import { chmod, copyFile, link, mkdir, rename, rm } from 'fs/promises'
 import path from 'path'
 import { pipeline } from 'stream/promises'
 import semver from 'semver'
 
+import { type PackageSignature, verifyRegistrySignature } from './verify-signature'
+
 // The action downloads pnpm's self-contained release archive and uses
 // `pnpm runtime` to install a JavaScript runtime. Both are available from v11
 // onward, so that is the oldest major this action can install.
@@ -19,12 +21,46 @@ const ABBREVIATED_PACKUMENT = 'application/vnd.npm.install-v1+json'
 
 const GITHUB_API = 'https://api.github.com'
 
-export interface ResolvedPnpm {
-  readonly version: string
-  readonly downloadUrl: string
-  // Hex-encoded SHA-256 of the release archive, from the GitHub asset `digest`.
-  readonly sha256: string
-  readonly archive: 'tar.gz' | 'zip'
+/**
+ * Where the executable is fetched from, and what proves it is the right one.
+ *
+ * From v12 the packages on the npm registry hold the same executable as the
+ * release assets, byte for byte, and npm signs a checksum for them with a key
+ * this action pins — so a tampered download cannot pass. GitHub publishes a
+ * digest but serves it from the same place as the asset, which catches
+ * corruption rather than tampering, so it is used only where there is nothing
+ * better: v11, whose `dist/` bundles dependencies the registry copy declares
+ * instead.
+ */
+export type ResolvedPnpm =
+  | {
+    readonly source: 'github'
+    readonly version: string
+    readonly downloadUrl: string
+    // Hex-encoded SHA-256 of the release archive, from the GitHub asset `digest`.
+    readonly sha256: string
+    readonly archive: 'tar.gz' | 'zip'
+  }
+  | {
+    readonly source: 'registry'
+    readonly version: string
+    readonly packages: readonly RegistryPackage[]
+  }
+
+interface RegistryPackage {
+  readonly name: string
+  readonly tarball: string
+  readonly integrity: string
+  /** Entry to lift out of the tarball's `package/` root into the destination. */
+  readonly keep: string
+}
+
+interface VersionMetadata {
+  readonly dist: {
+    readonly tarball: string
+    readonly integrity?: string
+    readonly signatures?: readonly PackageSignature[]
+  }
 }
 
 interface AbbreviatedPackument {
@@ -53,6 +89,10 @@ To install older pnpm, use the pnpm/action-setup action instead.`)
   }
 
   const platform = getPlatform()
+  if (semver.major(version) >= 12) {
+    return resolveFromRegistry(version, platform)
+  }
+
   const asset = assetName(platform)
   const release = await fetchRelease(version, token)
   const found = release.assets.find((a) => a.name === asset)
@@ -67,13 +107,42 @@ To install older pnpm, use the pnpm/action-setup action instead.`)
     throw new Error(`Release asset ${asset} for pnpm ${version} has no sha256 digest (got ${found.digest ?? '<missing>'}).`)
   }
   return {
+    source: 'github',
     version,
     downloadUrl: found.browser_download_url,
     sha256: found.digest.slice('sha256:'.length),
     archive: platform.os === 'win32' ? 'zip' : 'tar.gz',
   }
 }
 
+/**
+ * The executable and the `dist/` tree it loads are published as two packages:
+ * the platform package holds the binary, `pnpm` holds `dist/`. Both are
+ * verified the same way.
+ */
+async function resolveFromRegistry(version: string, platform: Platform): Promise<ResolvedPnpm> {
+  const exe = platform.os === 'win32' ? 'pnpm.exe' : 'pnpm'
+  const wanted = [
+    { name: platformPackageName(platform), keep: exe },
+    { name: 'pnpm', keep: 'dist' },
+  ]
+  const packages = await Promise.all(wanted.map(async ({ name, keep }) => {
+    const meta = await fetchJson<VersionMetadata>(`${REGISTRY}/${name}/${version}`)
+    const integrity = meta.dist.integrity
+    if (!integrity) {
+      throw new Error(`The npm registry published no checksum for ${name}@${version}.`)
+    }
+    verifyRegistrySignature({ name, version, integrity, signatures: meta.dist.signatures })
+    return { name, tarball: meta.dist.tarball, integrity, keep }
+  }))
+  return { source: 'registry', version, packages }
+}
+
+// Platform packages are named `@pnpm/exe.<os>-<arch>[-musl]`.
+function platformPackageName({ os, arch, musl }: Platform): string {
+  return `@pnpm/exe.${os}-${arch}${musl ? '-musl' : ''}`
+}
+
 /**
  * Downloads and extracts the pnpm release archive into `destDir`, returning the
  * path to the `pnpm` executable. The archive holds the executable at its root
@@ -86,16 +155,19 @@ export async function downloadPnpm(resolved: ResolvedPnpm, destDir: string): Pro
   const tmpDir = path.join(destDir, '.download')
   await mkdir(tmpDir, { recursive: true })
 
-  const archivePath = path.join(tmpDir, resolved.archive === 'zip' ? 'pnpm.zip' : 'pnpm.tgz')
-  const response = await http.get(resolved.downloadUrl)
-  if (response.message.statusCode !== 200) {
-    response.message.resume()
-    throw new Error(`Failed to download ${resolved.downloadUrl}: HTTP ${response.message.statusCode}`)
+  if (resolved.source === 'registry') {
+    await downloadFromRegistry(resolved.packages, destDir, tmpDir)
+  } else {
+    const archivePath = path.join(tmpDir, resolved.archive === 'zip' ? 'pnpm.zip' : 'pnpm.tgz')
+    const response = await http.get(resolved.downloadUrl)
+    if (response.message.statusCode !== 200) {
+      response.message.resume()
+      throw new Error(`Failed to download ${resolved.downloadUrl}: HTTP ${response.message.statusCode}`)
+    }
+    await pipeline(response.message, createWriteStream(archivePath))
+    await verifySha256(archivePath, resolved.sha256, resolved.downloadUrl)
+    await extractArchive(archivePath, destDir, resolved.archive)
   }
-  await pipeline(response.message, createWriteStream(archivePath))
-  await verifySha256(archivePath, resolved.sha256, resolved.downloadUrl)
-
-  await extractArchive(archivePath, destDir, resolved.archive)
   await rm(tmpDir, { recursive: true, force: true })
 
   const exe = process.platform === 'win32' ? 'pnpm.exe' : 'pnpm'
@@ -216,6 +288,47 @@ async function fetchJson<T>(url: string, headers?: Record<string, string>): Prom
   return response.result
 }
 
+/**
+ * Fetches each package, checks it against the checksum npm signed for it, and
+ * lifts the wanted entry out of the tarball's `package/` root. Unpacking
+ * happens away from `destDir`, whose layout the executable depends on.
+ */
+async function downloadFromRegistry(
+  packages: readonly RegistryPackage[],
+  destDir: string,
+  tmpDir: string,
+): Promise<void> {
+  for (const pkg of packages) {
+    const safeName = pkg.name.replace(/[@/]/g, '_')
+    const archivePath = path.join(tmpDir, `${safeName}.tgz`)
+    const response = await http.get(pkg.tarball)
+    if (response.message.statusCode !== 200) {
+      response.message.resume()
+      throw new Error(`Failed to download ${pkg.tarball}: HTTP ${response.message.statusCode}`)
+    }
+    await pipeline(response.message, createWriteStream(archivePath))
+    await verifyIntegrity(archivePath, pkg)
+
+    const unpackDir = path.join(tmpDir, safeName)
+    await mkdir(unpackDir, { recursive: true })
+    await extractArchive(archivePath, unpackDir, 'tar.gz')
+    await rm(path.join(destDir, pkg.keep), { recursive: true, force: true })
+    await rename(path.join(unpackDir, 'package', pkg.keep), path.join(destDir, pkg.keep))
+  }
+}
+
+async function verifyIntegrity(file: string, pkg: RegistryPackage): Promise<void> {
+  const [algorithm, expected] = pkg.integrity.split('-')
+  const hash = createHash(algorithm)
+  await pipeline(createReadStream(file), hash)
+  const actual = hash.digest('base64')
+  if (actual !== expected) {
+    throw new Error(`${pkg.name}@${pkg.integrity} does not match the checksum the npm registry published for it. Refusing to install.
+  Expected ${algorithm}: ${expected}
+  Actual   ${algorithm}: ${actual}`)
+  }
+}
+
 async function verifySha256(file: string, expectedHex: string, url: string): Promise<void> {
   const hash = createHash('sha256')
   await pipeline(createReadStream(file), hash)

src/install-pnpm/download.ts

@@ -0,0 +1,29 @@
+/* eslint-disable */
+// GENERATED — npm's public registry signing keys, mirrored from
+// https://registry.npmjs.org/-/npm/v1/keys
+//
+// Mirrored from the copy pnpm itself pins (pnpm/pnpm, deps/security/signatures).
+// Refresh from https://registry.npmjs.org/-/npm/v1/keys when npm rotates a key;
+// an unrecognised keyid fails the install rather than weakening the check.
+export const NPM_SIGNING_KEYS = [
+  {
+    "expires": null,
+    "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
+    "keytype": "ecdsa-sha2-nistp256",
+    "scheme": "ecdsa-sha2-nistp256",
+    "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="
+  },
+  {
+    "expires": "2025-01-29T00:00:00.000Z",
+    "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",
+    "keytype": "ecdsa-sha2-nistp256",
+    "scheme": "ecdsa-sha2-nistp256",
+    "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="
+  }
+] as const satisfies ReadonlyArray<{
+  expires: string | null
+  keyid: string
+  keytype: string
+  scheme: string
+  key: string
+}>

src/install-pnpm/npm-signing-keys.ts

@@ -18,7 +18,9 @@ export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerRes
 
   const spec = readTargetVersion({ version, packageJsonFile })
   const resolved = await resolvePnpm(spec, token)
-  info(`Downloading pnpm ${resolved.version} from ${resolved.downloadUrl}`)
+  info(resolved.source === 'registry'
+    ? `Downloading pnpm ${resolved.version} from the npm registry`
+    : `Downloading pnpm ${resolved.version} from ${resolved.downloadUrl}`)
 
   await rm(dest, { recursive: true, force: true })
   // Create dest/bin upfront: pnpm ≤ 12.0.0-alpha.17 refuses to run

src/install-pnpm/run.ts

@@ -0,0 +1,48 @@
+import { createVerify } from 'crypto'
+
+import { NPM_SIGNING_KEYS } from './npm-signing-keys'
+
+export interface PackageSignature {
+  readonly keyid: string
+  readonly sig: string
+}
+
+/**
+ * Checks the registry's signature over a package's identity and checksum.
+ *
+ * The registry serves both the tarball and the checksum, so a checksum taken
+ * from it proves nothing on its own. The signature is what makes it worth
+ * something: it is made with a key npm publishes but the download host cannot
+ * mint, and the trusted copy of that key is pinned in this action.
+ *
+ * @throws if the package is unsigned, signed with a key that isn't pinned or
+ * has expired, or the signature does not verify.
+ */
+export function verifyRegistrySignature(opts: {
+  readonly name: string
+  readonly version: string
+  readonly integrity: string
+  readonly signatures?: readonly PackageSignature[]
+}): void {
+  const pkg = `${opts.name}@${opts.version}`
+  const signature = opts.signatures?.[0]
+  if (!signature) {
+    throw new Error(`${pkg} carries no npm registry signature, so it cannot be verified.`)
+  }
+
+  const key = NPM_SIGNING_KEYS.find(({ keyid }) => keyid === signature.keyid)
+  if (!key) {
+    throw new Error(`${pkg} is signed with an unexpected npm key (${signature.keyid}). `
+      + 'If npm has rotated its signing key, this action needs updating.')
+  }
+  if (key.expires && new Date(key.expires) < new Date()) {
+    throw new Error(`${pkg} is signed with an npm key that expired on ${key.expires}.`)
+  }
+
+  // Registry signatures cover the package identity and its content hash.
+  const message = `${pkg}:${opts.integrity}`
+  const publicKey = `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`
+  if (!createVerify('SHA256').update(message).verify(publicKey, signature.sig, 'base64')) {
+    throw new Error(`The npm registry signature for ${pkg} is not valid. Refusing to install.`)
+  }
+}