update registry publishing

motivation: update based on recent spec

changes:
* do not request server requirments, deduce configuration based on use provided flags
* fix issues in publishing logic per testing

Author: tomerd

Sources/PackageRegistry/RegistryClient.swift

@@ -648,73 +648,74 @@ public final class RegistryClient: Cancellable {
         }
     }
 
-    public func getPublishRequirements(
-        registryURL: URL,
-        timeout: DispatchTimeInterval? = .none,
-        observabilityScope: ObservabilityScope,
-        callbackQueue: DispatchQueue,
-        completion: @escaping (Result<PublishRequirements, Error>) -> Void
-    ) {
-        let completion = self.makeAsync(completion, on: callbackQueue)
-
-        guard var components = URLComponents(url: registryURL, resolvingAgainstBaseURL: true) else {
-            return completion(.failure(RegistryError.invalidURL(registryURL)))
-        }
-        components.appendPathComponents("publish-requirements")
-        guard let url = components.url else {
-            return completion(.failure(RegistryError.invalidURL(registryURL)))
-        }
-
-        let request = LegacyHTTPClient.Request(
-            method: .get,
-            url: url,
-            headers: [
-                "Accept": self.acceptHeader(mediaType: .json),
-            ],
-            options: self.defaultRequestOptions(timeout: timeout, callbackQueue: callbackQueue)
-        )
-
-        self.httpClient.execute(request, observabilityScope: observabilityScope, progress: nil) { result in
-            completion(
-                result.tryMap { response in
-                    switch response.statusCode {
-                    case 200:
-                        let publishRequirements = try response.parseJSON(
-                            Serialization.PublishRequirements.self,
-                            decoder: self.jsonDecoder
-                        )
-
-                        return PublishRequirements(
-                            metadata: .init(
-                                location: publishRequirements.metadata.location.map {
-                                    switch $0 {
-                                    case .archive:
-                                        return .archive
-                                    case .request:
-                                        return .request
-                                    }
-                                }
-                            ),
-                            signing: .init(
-                                required: publishRequirements.signing.required,
-                                acceptedSignatureFormats: publishRequirements.signing.acceptedSignatureFormats.map {
-                                    switch $0 {
-                                    case .CMS_1_0_0:
-                                        return .CMS_1_0_0
-                                    }
-                                },
-                                trustedRootCertificates: publishRequirements.signing.trustedRootCertificates
-                            )
-                        )
-                    default:
-                        throw self.unexpectedStatusError(response, expectedStatus: [200])
-                    }
-                }.mapError {
-                    RegistryError.failedRetrievingRegistryPublishRequirements($0)
-                }
-            )
-        }
-    }
+    /*
+     public func getPublishRequirements(
+         registryURL: URL,
+         timeout: DispatchTimeInterval? = .none,
+         observabilityScope: ObservabilityScope,
+         callbackQueue: DispatchQueue,
+         completion: @escaping (Result<PublishRequirements, Error>) -> Void
+     ) {
+         let completion = self.makeAsync(completion, on: callbackQueue)
+
+         guard var components = URLComponents(url: registryURL, resolvingAgainstBaseURL: true) else {
+             return completion(.failure(RegistryError.invalidURL(registryURL)))
+         }
+         components.appendPathComponents("publish-requirements")
+         guard let url = components.url else {
+             return completion(.failure(RegistryError.invalidURL(registryURL)))
+         }
+
+         let request = LegacyHTTPClient.Request(
+             method: .get,
+             url: url,
+             headers: [
+                 "Accept": self.acceptHeader(mediaType: .json),
+             ],
+             options: self.defaultRequestOptions(timeout: timeout, callbackQueue: callbackQueue)
+         )
+
+         self.httpClient.execute(request, observabilityScope: observabilityScope, progress: nil) { result in
+             completion(
+                 result.tryMap { response in
+                     switch response.statusCode {
+                     case 200:
+                         let publishRequirements = try response.parseJSON(
+                             Serialization.PublishRequirements.self,
+                             decoder: self.jsonDecoder
+                         )
+
+                         return PublishRequirements(
+                             metadata: .init(
+                                 location: publishRequirements.metadata.location.map {
+                                     switch $0 {
+                                     case .archive:
+                                         return .archive
+                                     case .request:
+                                         return .request
+                                     }
+                                 }
+                             ),
+                             signing: .init(
+                                 required: publishRequirements.signing.required,
+                                 acceptedSignatureFormats: publishRequirements.signing.acceptedSignatureFormats.map {
+                                     switch $0 {
+                                     case .CMS_1_0_0:
+                                         return .CMS_1_0_0
+                                     }
+                                 },
+                                 trustedRootCertificates: publishRequirements.signing.trustedRootCertificates
+                             )
+                         )
+                     default:
+                         throw self.unexpectedStatusError(response, expectedStatus: [200])
+                     }
+                 }.mapError {
+                     RegistryError.failedRetrievingRegistryPublishRequirements($0)
+                 }
+             )
+         }
+     }*/
 
     public func publish(
         registryURL: URL,
@@ -759,43 +760,46 @@ public final class RegistryClient: Cancellable {
         }
 
         // TODO: add generic support for upload requests in Basics
-        var body = Data()
         let boundary = UUID().uuidString
+        var parts = [String]()
 
         // archive field
-        body.append(contentsOf: """
-        --\(boundary)
+        parts.append("""
         Content-Disposition: form-data; name=\"source-archive\"\r
         Content-Type: application/zip\r
         Content-Transfer-Encoding: base64\r
         Content-Length: \(packageArchiveContent.count)\r
         \r
-        \(packageArchiveContent.base64EncodedString())
-        """.utf8)
+        \(packageArchiveContent.base64EncodedString())\r
+        """)
 
         if let metadataContent = metadataContent {
-            // spacer
-            body.append(contentsOf: "\r\n".utf8)
-            // metadata fiels
-            body.append(contentsOf: """
-            --\(boundary)\r
+            parts.append("""
             Content-Disposition: form-data; name=\"metadata\"\r
             Content-Type: application/json\r
             Content-Transfer-Encoding: quoted-printable\r
             Content-Length: \(metadataContent.count)\r
             \r
-            \(metadataContent)
-            """.utf8)
+            \(metadataContent)\r
+            """)
         }
 
+        let bodyString = """
+        --\(boundary)\r
+        \(parts.joined(separator: "\n--\(boundary)\r\n"))
+        --\(boundary)--\r\n
+        """
+
         let request = LegacyHTTPClient.Request(
             method: .put,
             url: url,
             headers: [
+                "Content-Type": "multipart/form-data;boundary=\"\(boundary)\"",
                 "Accept": self.acceptHeader(mediaType: .json),
+                "Expect": "100-continue",
                 "Prefer": "respond-async",
             ],
-            body: body,
+            body: Data(bodyString.utf8),
             options: self.defaultRequestOptions(timeout: timeout, callbackQueue: callbackQueue)
         )
 
@@ -1024,12 +1028,21 @@ extension RegistryClient {
 }
 
 extension RegistryClient {
-    public struct PublishRequirements {
+    public struct PublishConfiguration {
         public let metadata: Metadata
         public let signing: Signing
 
+        public init(metadata: Metadata, signing: Signing) {
+            self.metadata = metadata
+            self.signing = signing
+        }
+
         public struct Metadata {
             public let location: [MetadataLocation]
+
+            public init(location: [MetadataLocation]) {
+                self.location = location
+            }
         }
 
         public enum MetadataLocation {
@@ -1041,6 +1054,16 @@ extension RegistryClient {
             public let required: Bool
             public let acceptedSignatureFormats: [SignatureFormat]
             public let trustedRootCertificates: [String]
+
+            public init(
+                required: Bool,
+                acceptedSignatureFormats: [SignatureFormat],
+                trustedRootCertificates: [String]
+            ) {
+                self.required = required
+                self.acceptedSignatureFormats = acceptedSignatureFormats
+                self.trustedRootCertificates = trustedRootCertificates
+            }
         }
     }
 }

Sources/PackageRegistryTool/PackageRegistryTool+Publish.swift

@@ -33,13 +33,13 @@ extension SwiftPackageRegistryTool {
         @OptionGroup(visibility: .hidden)
         var globalOptions: GlobalOptions
 
-        @Option(name: .customLong("id"), help: "The package identity")
+        @Option(name: [.customLong("id"), .customLong("package-id")] , help: "The package identity")
         var packageIdentity: PackageIdentity
 
-        @Option(name: .customLong("version"), help: "The package version")
+        @Option(name: [.customLong("version"), .customLong("package-version")], help: "The package version")
         var packageVersion: Version
 
-        @Option(name: .customLong("url"), help: "The registry URL")
+        @Option(name: [.customLong("url"), .customLong("registry-url")], help: "The registry URL")
         var registryURL: URL?
 
         @Option(
@@ -66,7 +66,7 @@ extension SwiftPackageRegistryTool {
         @Option(
             help: "Paths to all of the certificates (DER-encoded) in the chain. The certificate used for signing must be listed first and the root certificate last."
         )
-        var certificateChainPaths: [AbsolutePath]
+        var certificateChainPaths: [AbsolutePath] = []
 
         func run(_ swiftTool: SwiftTool) throws {
             let configuration = try getRegistriesConfig(swiftTool).configuration
@@ -106,6 +106,12 @@ extension SwiftPackageRegistryTool {
                 }
             }
 
+            let workingDirectory = customWorkingDirectory ?? Workspace.DefaultLocations
+                .scratchDirectory(forRootPackage: packageDirectory).appending(components: ["registry", "publish"])
+            if localFileSystem.exists(workingDirectory) {
+                try localFileSystem.removeFileTree(workingDirectory)
+            }
+
             // validate custom metadata path
             if let customMetadataPath = self.customMetadataPath {
                 guard localFileSystem.exists(customMetadataPath) else {
@@ -125,6 +131,7 @@ extension SwiftPackageRegistryTool {
             )
 
             // step 1: get registry publishing requirements
+            /*
             swiftTool.observabilityScope.emit(info: "retrieving '\(registryURL)' publishing requirements")
             let publishRequirements = try tsc_await { callback in
                 registryClient.getPublishRequirements(
@@ -133,7 +140,15 @@ extension SwiftPackageRegistryTool {
                     callbackQueue: .sharedConcurrent,
                     completion: callback
                 )
-            }
+            }*/
+            let publishConfiguration = RegistryClient.PublishConfiguration(
+                metadata: .init(location: [.archive, .request]), // FIXME
+                signing: .init(
+                    required: self.signingIdentity != nil || self.privateKeyPath != nil,
+                    acceptedSignatureFormats: [.CMS_1_0_0],
+                    trustedRootCertificates: []
+                )
+            )
 
             // step 2: generate source archive for the package release
             let metadataPath = self.customMetadataPath ?? packageDirectory.appending(component: Self.metadataFilename)
@@ -148,15 +163,15 @@ extension SwiftPackageRegistryTool {
                 packageIdentity: self.packageIdentity,
                 packageVersion: self.packageVersion,
                 packageDirectory: packageDirectory,
-                metadataPath: publishRequirements.metadata.location.contains(.archive) ? metadataPath : .none,
-                customWorkingDirectory: self.customWorkingDirectory,
+                metadataPath: publishConfiguration.metadata.location.contains(.archive) ? metadataPath : .none,
+                workingDirectory: workingDirectory,
                 cancellator: swiftTool.cancellator,
                 observabilityScope: swiftTool.observabilityScope
             )
 
             // step 3: sign the source archive if needed
             var signature: Data? = .none
-            if publishRequirements.signing.required {
+            if publishConfiguration.signing.required {
                 swiftTool.observabilityScope.emit(info: "signing the archive at '\(archivePath)'")
                 signature = try self.sign(
                     archivePath: archivePath,
@@ -177,7 +192,7 @@ extension SwiftPackageRegistryTool {
                     packageIdentity: self.packageIdentity,
                     packageVersion: self.packageVersion,
                     packageArchive: archivePath,
-                    packageMetadata: publishRequirements.metadata.location.contains(.request) ? metadataPath : .none,
+                    packageMetadata: publishConfiguration.metadata.location.contains(.request) ? metadataPath : .none,
                     signature: signature,
                     fileSystem: localFileSystem,
                     observabilityScope: swiftTool.observabilityScope,
@@ -201,13 +216,10 @@ extension SwiftPackageRegistryTool {
             packageVersion: Version,
             packageDirectory: AbsolutePath,
             metadataPath: AbsolutePath?,
-            customWorkingDirectory: AbsolutePath?,
+            workingDirectory: AbsolutePath,
             cancellator: Cancellator?,
             observabilityScope: ObservabilityScope
         ) throws -> AbsolutePath {
-            let workingDirectory = customWorkingDirectory ?? Workspace.DefaultLocations
-                .scratchDirectory(forRootPackage: packageDirectory).appending(components: ["registry", "publish"])
-
             let archivePath = workingDirectory.appending(component: "\(packageIdentity)-\(packageVersion).zip")
 
             // create temp location for sources