basic-electron-updater/dist/download/validators/gpg.js

A secure, cross-platform auto-update library for Electron Forge apps using GitHub Releases.

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.validateGpgSignature = validateGpgSignature;
const child_process_1 = require("child_process");
/**
 * Validates a file's GPG signature using a detached .sig file and a public keyring.
 * Throws if validation fails.
 */
async function validateGpgSignature(filePath, sigPath, keyringPath) {
    return new Promise((resolve, reject) => {
        const args = ["--verify", sigPath, filePath];
        if (keyringPath) {
            args.unshift("--keyring", keyringPath);
        }
        const proc = (0, child_process_1.spawn)("gpg", args);
        let stderr = "";
        proc.stderr.on("data", d => (stderr += d.toString()));
        proc.on("close", code => {
            if (code === 0) {
                resolve();
            }
            else {
                reject(new Error(`GPG signature validation failed: ${stderr}`));
            }
        });
        proc.on("error", reject);
    });
}