Merge branch 'main' into benibenj/narrow-smelt

package.json

@@ -50,7 +50,7 @@
 		"hosted-git-info": "^4.0.2",
 		"jsonc-parser": "^3.2.0",
 		"leven": "^3.1.0",
-		"markdown-it": "^12.3.2",
+		"markdown-it": "^14.1.0",
 		"mime": "^1.3.4",
 		"minimatch": "^3.0.3",
 		"parse-semver": "^1.1.1",
@@ -95,4 +95,4 @@
 		"watch-files": "src/**",
 		"spec": "src/test/**/*.ts"
 	}
-}
+}

src/main.ts

@@ -1,6 +1,6 @@
 import program from 'commander';
 import leven from 'leven';
-import { packageCommand, ls, Targets, generateManifest } from './package';
+import { packageCommand, ls, Targets, generateManifest, verifySignature } from './package';
 import { publish, unpublish } from './publish';
 import { show } from './show';
 import { search } from './search';
@@ -317,6 +317,14 @@ module.exports = function (argv: string[]): void {
 		.option('-o, --out <path>', 'Output the extension manifest to <path> location (defaults to <packagename>.manifest)')
 		.action(({ packagePath, out }) => main(generateManifest(packagePath, out)));
 
+	program
+		.command('verify-signature')
+		.description('Verifies the provided signature file against the provided VSIX package and manifest.')
+		.requiredOption('-i, --packagePath <path>', 'Path to the VSIX package')
+		.requiredOption('-m, --manifestPath <path>', 'Path to the Manifest file')
+		.requiredOption('-s, --signaturePath <path>', 'Path to the Signature file')
+		.action(({ packagePath, manifestPath, signaturePath }) => main(verifySignature(packagePath, manifestPath, signaturePath)));
+
 	program
 		.command('ls-publishers')
 		.description('Lists all known publishers')

src/package.ts

@@ -1885,6 +1885,19 @@ export function generateManifest(packageFile: string, outputFile?: string): Prom
 	return vsceSign.generateManifest(packageFile, outputFile);
 }
 
+export async function verifySignature(packageFile: string, manifestFile: string, signatureFile: string): Promise<void> {
+	const sigzipPath = await createSignatureArchive(manifestFile, signatureFile);
+	try {
+		const result = await vsceSign.verify(packageFile, sigzipPath, true);
+		console.log(`Signature verification result: ${result.code}`);
+		if (result.output) {
+			console.log(result.output)
+		}
+	} finally {
+		await fs.promises.unlink(sigzipPath);
+	}
+}
+
 // Create a signature zip file containing the manifest and signature file
 export async function createSignatureArchive(manifestFile: string, signatureFile: string, outputFile?: string): Promise<string> {
 	return vsceSign.zip(manifestFile, signatureFile, outputFile)
@@ -2021,7 +2034,7 @@ export async function printAndValidatePackagedFiles(files: IFile[], cwd: string,
 			message += unusedIncludePatterns.map(p => `  - ${p}`).join('\n');
 			message += '\nRemove any include pattern which is not needed.\n';
 			message += `\n=> Run ${chalk.bold('vsce ls --tree')} to see all included files.\n`;
-			message += `=> Use ${chalk.bold('--allow-unused-files-patterns')} to skip this check`;
+			message += `=> Use ${chalk.bold('--allow-unused-files-pattern')} to skip this check`;
 			util.log.error(message);
 			process.exit(1);
 		}