renovate/lib/config/decrypt/bcpgp.ts

import type { RuntimeType } from '@renovatebot/pgp';
import { decrypt, isSupportedRuntime } from '@renovatebot/pgp';
import { logger } from '../../logger/index.ts';
import { getEnv } from '../../util/env.ts';
import { regEx } from '../../util/regex.ts';

export async function tryDecryptBcPgp(
  privateKey: string,
  encryptedStr: string,
): Promise<string | null> {
  try {
    const startBlock = '-----BEGIN PGP MESSAGE-----\n\n';
    const endBlock = '\n-----END PGP MESSAGE-----';
    let armoredMessage = encryptedStr.trim();

    const hasStartHeader = armoredMessage.startsWith(startBlock);
    const hasEndHeader = armoredMessage.endsWith(endBlock);

    if (
      !hasStartHeader &&
      !hasEndHeader &&
      !armoredMessage.includes('=') &&
      !armoredMessage.includes('\n') &&
      armoredMessage.length % 4 !== 0
    ) {
      logger.debug('Adding base64 padding to armored message');
      armoredMessage += `=`.repeat(4 - (armoredMessage.length % 4));
    }

    // v8 ignore else -- TODO: add test #40625
    if (!hasStartHeader) {
      armoredMessage = `${startBlock}${armoredMessage}`;
    }
    // v8 ignore else -- TODO: add test #40625
    if (!hasEndHeader) {
      armoredMessage = `${armoredMessage}${endBlock}`;
    }

    const data = await decrypt(
      privateKey.replace(regEx(/\n[ \t]+/g), '\n'), // little massage to help a common problem
      armoredMessage,
      {
        runtime: runtime(),
      },
    );
    logger.debug('Decrypted config using bcpgp');
    return data;
  } catch (err) {
    logger.debug({ err }, 'Could not decrypt using bcpgp');
    return null;
  }
}

function runtime(): RuntimeType {
  const runtime = getEnv().RENOVATE_X_PGP_RUNTIME;
  if (runtime) {
    if (isSupportedRuntime(runtime)) {
      logger.trace({ runtime }, 'Using configured PGP runtime');
      return runtime;
    }
    logger.once.warn({ runtime }, 'Unknown PGP runtime, using wasm-java');
  }
  logger.trace('Using default PGP runtime: wasm-java');
  return 'wasm-java';
}