import { all, batch, chunks, placeholders, stmt } from "../db";
import { accountDb, stmt as scopedStmt } from "../scoped-db";
import { withStore } from "../git/store";
import { randomId } from "../crypto";
import { badRequest, conflict } from "../errors";
import { assertBelowCap } from "../limits";
import { fetchRawCommits } from "../git/upload-pack";
import { isSha } from "../git/store";
import { checkCommitSignature } from "./commit-signature";
import type { KeyLookup, SignatureCheck } from "./commit-signature";
import { parsePgpPublicKeys } from "./openpgp-keys";
import { parseSshPublicKey } from "./sshsig";
import type { RepoRow } from "~/lib/types";
const MAX_SIGNING_KEYS = 50;
const MAX_PUBLIC_KEY_BYTES = 64 * 1024;
export type CommitSignatureInfo = {
sha: string;
verified: boolean;
reason: string;
kind: "ssh" | "gpg" | null;
keyFingerprint: string | null;
signer: string | null;
};
type SignatureRow = {
commit_sha: string;
verified: number;
reason: string;
kind: "ssh" | "gpg" | null;
key_fingerprint: string | null;
signer_name: string | null;
signer_disabled_at: number | null;
signer_id: string | null;
};
const MAX_KEY_CANDIDATES = 10;
/**
* Owners with any verified address equal to the committer email sort first, so keys squatted on the same