refactor: don't fail if extra signatures we don't care about (#67)

phoenixframework · Oct 11, 2023 · f88f731 · f88f731
1 parent 7ba419c
commit f88f731
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/lib/esbuild/npm_registry.ex b/lib/esbuild/npm_registry.ex
@@ -18,18 +18,18 @@ defmodule Esbuild.NpmRegistry do
       "_id" => id,
       "dist" => %{
         "integrity" => integrity,
-        "signatures" => [
-          %{
-            "keyid" => @public_key_id,
-            "sig" => signature
-          }
-        ],
+        "signatures" => signatures,
         "tarball" => tarball
       }
     } =
       fetch_file!("#{@base_url}/#{name}/#{version}")
       |> Jason.decode!()
 
+    %{"sig" => signature} =
+      signatures
+      |> Enum.find(fn %{"keyid" => keyid} -> keyid == @public_key_id end) ||
+        raise "missing signature"
+
     verify_signature!("#{id}:#{integrity}", signature)
     tar = fetch_file!(tarball)