update registry publishing

motivation: update based on recent spec

changes:
* do not request server requirements, deduce configuration based on use provided flags
* fix issues in publishing logic per testing
* simplify metadata handling

Author: tomerd

Sources/PackageRegistry/RegistryClient.swift

@@ -648,74 +648,6 @@ public final class RegistryClient: Cancellable {
         }
     }
 
-    public func getPublishRequirements(
-        registryURL: URL,
-        timeout: DispatchTimeInterval? = .none,
-        observabilityScope: ObservabilityScope,
-        callbackQueue: DispatchQueue,
-        completion: @escaping (Result<PublishRequirements, Error>) -> Void
-    ) {
-        let completion = self.makeAsync(completion, on: callbackQueue)
-
-        guard var components = URLComponents(url: registryURL, resolvingAgainstBaseURL: true) else {
-            return completion(.failure(RegistryError.invalidURL(registryURL)))
-        }
-        components.appendPathComponents("publish-requirements")
-        guard let url = components.url else {
-            return completion(.failure(RegistryError.invalidURL(registryURL)))
-        }
-
-        let request = LegacyHTTPClient.Request(
-            method: .get,
-            url: url,
-            headers: [
-                "Accept": self.acceptHeader(mediaType: .json),
-            ],
-            options: self.defaultRequestOptions(timeout: timeout, callbackQueue: callbackQueue)
-        )
-
-        self.httpClient.execute(request, observabilityScope: observabilityScope, progress: nil) { result in
-            completion(
-                result.tryMap { response in
-                    switch response.statusCode {
-                    case 200:
-                        let publishRequirements = try response.parseJSON(
-                            Serialization.PublishRequirements.self,
-                            decoder: self.jsonDecoder
-                        )
-
-                        return PublishRequirements(
-                            metadata: .init(
-                                location: publishRequirements.metadata.location.map {
-                                    switch $0 {
-                                    case .archive:
-                                        return .archive
-                                    case .request:
-                                        return .request
-                                    }
-                                }
-                            ),
-                            signing: .init(
-                                required: publishRequirements.signing.required,
-                                acceptedSignatureFormats: publishRequirements.signing.acceptedSignatureFormats.map {
-                                    switch $0 {
-                                    case .CMS_1_0_0:
-                                        return .CMS_1_0_0
-                                    }
-                                },
-                                trustedRootCertificates: publishRequirements.signing.trustedRootCertificates
-                            )
-                        )
-                    default:
-                        throw self.unexpectedStatusError(response, expectedStatus: [200])
-                    }
-                }.mapError {
-                    RegistryError.failedRetrievingRegistryPublishRequirements($0)
-                }
-            )
-        }
-    }
-
     public func publish(
         registryURL: URL,
         packageIdentity: PackageIdentity,
@@ -759,43 +691,46 @@ public final class RegistryClient: Cancellable {
         }
 
         // TODO: add generic support for upload requests in Basics
-        var body = Data()
         let boundary = UUID().uuidString
+        var parts = [String]()
 
         // archive field
-        body.append(contentsOf: """
-        --\(boundary)
+        parts.append("""
         Content-Disposition: form-data; name=\"source-archive\"\r
         Content-Type: application/zip\r
         Content-Transfer-Encoding: base64\r
         Content-Length: \(packageArchiveContent.count)\r
         \r
-        \(packageArchiveContent.base64EncodedString())
-        """.utf8)
+        \(packageArchiveContent.base64EncodedString())\r
+        """)
 
         if let metadataContent = metadataContent {
-            // spacer
-            body.append(contentsOf: "\r\n".utf8)
-            // metadata fiels
-            body.append(contentsOf: """
-            --\(boundary)\r
+            parts.append("""
             Content-Disposition: form-data; name=\"metadata\"\r
             Content-Type: application/json\r
             Content-Transfer-Encoding: quoted-printable\r
             Content-Length: \(metadataContent.count)\r
             \r
-            \(metadataContent)
-            """.utf8)
+            \(metadataContent)\r
+            """)
         }
 
+        let bodyString = """
+        --\(boundary)\r
+        \(parts.joined(separator: "\n--\(boundary)\r\n"))
+        --\(boundary)--\r\n
+        """
+
         let request = LegacyHTTPClient.Request(
             method: .put,
             url: url,
             headers: [
+                "Content-Type": "multipart/form-data;boundary=\"\(boundary)\"",
                 "Accept": self.acceptHeader(mediaType: .json),
+                "Expect": "100-continue",
                 "Prefer": "respond-async",
             ],
-            body: body,
+            body: Data(bodyString.utf8),
             options: self.defaultRequestOptions(timeout: timeout, callbackQueue: callbackQueue)
         )
 
@@ -1024,23 +959,27 @@ extension RegistryClient {
 }
 
 extension RegistryClient {
-    public struct PublishRequirements {
-        public let metadata: Metadata
+    public struct PublishConfiguration {
         public let signing: Signing
 
-        public struct Metadata {
-            public let location: [MetadataLocation]
-        }
-
-        public enum MetadataLocation {
-            case request
-            case archive
+        public init(signing: Signing) {
+            self.signing = signing
         }
 
         public struct Signing {
             public let required: Bool
             public let acceptedSignatureFormats: [SignatureFormat]
             public let trustedRootCertificates: [String]
+
+            public init(
+                required: Bool,
+                acceptedSignatureFormats: [SignatureFormat],
+                trustedRootCertificates: [String]
+            ) {
+                self.required = required
+                self.acceptedSignatureFormats = acceptedSignatureFormats
+                self.trustedRootCertificates = trustedRootCertificates
+            }
         }
     }
 }

Sources/PackageRegistryTool/PackageRegistryTool+Publish.swift

@@ -33,13 +33,13 @@ extension SwiftPackageRegistryTool {
         @OptionGroup(visibility: .hidden)
         var globalOptions: GlobalOptions
 
-        @Option(name: .customLong("id"), help: "The package identity")
+        @Option(name: [.customLong("id"), .customLong("package-id")] , help: "The package identity")
         var packageIdentity: PackageIdentity
 
-        @Option(name: .customLong("version"), help: "The package version")
+        @Option(name: [.customLong("version"), .customLong("package-version")], help: "The package version")
         var packageVersion: Version
 
-        @Option(name: .customLong("url"), help: "The registry URL")
+        @Option(name: [.customLong("url"), .customLong("registry-url")], help: "The registry URL")
         var registryURL: URL?
 
         @Option(
@@ -66,7 +66,7 @@ extension SwiftPackageRegistryTool {
         @Option(
             help: "Paths to all of the certificates (DER-encoded) in the chain. The certificate used for signing must be listed first and the root certificate last."
         )
-        var certificateChainPaths: [AbsolutePath]
+        var certificateChainPaths: [AbsolutePath] = []
 
         func run(_ swiftTool: SwiftTool) throws {
             let configuration = try getRegistriesConfig(swiftTool).configuration
@@ -106,6 +106,12 @@ extension SwiftPackageRegistryTool {
                 }
             }
 
+            let workingDirectory = customWorkingDirectory ?? Workspace.DefaultLocations
+                .scratchDirectory(forRootPackage: packageDirectory).appending(components: ["registry", "publish"])
+            if localFileSystem.exists(workingDirectory) {
+                try localFileSystem.removeFileTree(workingDirectory)
+            }
+
             // validate custom metadata path
             if let customMetadataPath = self.customMetadataPath {
                 guard localFileSystem.exists(customMetadataPath) else {
@@ -124,39 +130,37 @@ extension SwiftPackageRegistryTool {
                 authorizationProvider: authorizationProvider
             )
 
-            // step 1: get registry publishing requirements
-            swiftTool.observabilityScope.emit(info: "retrieving '\(registryURL)' publishing requirements")
-            let publishRequirements = try tsc_await { callback in
-                registryClient.getPublishRequirements(
-                    registryURL: registryURL,
-                    observabilityScope: swiftTool.observabilityScope,
-                    callbackQueue: .sharedConcurrent,
-                    completion: callback
-                )
-            }
-
-            // step 2: generate source archive for the package release
+            // step 1: publishing configuration
             let metadataPath = self.customMetadataPath ?? packageDirectory.appending(component: Self.metadataFilename)
             guard localFileSystem.exists(metadataPath) else {
                 throw StringError(
                     "Publishing to '\(registryURL)' requires metadata file but none was found at '\(metadataPath)'."
                 )
             }
 
+            let publishConfiguration = RegistryClient.PublishConfiguration(
+                signing: .init(
+                    required: self.signingIdentity != nil || self.privateKeyPath != nil,
+                    acceptedSignatureFormats: [.CMS_1_0_0],
+                    trustedRootCertificates: []
+                )
+            )
+
+            // step 2: generate source archive for the package release
+
             swiftTool.observabilityScope.emit(info: "archiving the source at '\(packageDirectory)'")
             let archivePath = try self.archiveSource(
                 packageIdentity: self.packageIdentity,
                 packageVersion: self.packageVersion,
                 packageDirectory: packageDirectory,
-                metadataPath: publishRequirements.metadata.location.contains(.archive) ? metadataPath : .none,
-                customWorkingDirectory: self.customWorkingDirectory,
+                workingDirectory: workingDirectory,
                 cancellator: swiftTool.cancellator,
                 observabilityScope: swiftTool.observabilityScope
             )
 
             // step 3: sign the source archive if needed
             var signature: Data? = .none
-            if publishRequirements.signing.required {
+            if publishConfiguration.signing.required {
                 swiftTool.observabilityScope.emit(info: "signing the archive at '\(archivePath)'")
                 signature = try self.sign(
                     archivePath: archivePath,
@@ -177,7 +181,7 @@ extension SwiftPackageRegistryTool {
                     packageIdentity: self.packageIdentity,
                     packageVersion: self.packageVersion,
                     packageArchive: archivePath,
-                    packageMetadata: publishRequirements.metadata.location.contains(.request) ? metadataPath : .none,
+                    packageMetadata: self.customMetadataPath,
                     signature: signature,
                     fileSystem: localFileSystem,
                     observabilityScope: swiftTool.observabilityScope,
@@ -200,14 +204,10 @@ extension SwiftPackageRegistryTool {
             packageIdentity: PackageIdentity,
             packageVersion: Version,
             packageDirectory: AbsolutePath,
-            metadataPath: AbsolutePath?,
-            customWorkingDirectory: AbsolutePath?,
+            workingDirectory: AbsolutePath,
             cancellator: Cancellator?,
             observabilityScope: ObservabilityScope
         ) throws -> AbsolutePath {
-            let workingDirectory = customWorkingDirectory ?? Workspace.DefaultLocations
-                .scratchDirectory(forRootPackage: packageDirectory).appending(components: ["registry", "publish"])
-
             let archivePath = workingDirectory.appending(component: "\(packageIdentity)-\(packageVersion).zip")
 
             // create temp location for sources
@@ -224,16 +224,6 @@ extension SwiftPackageRegistryTool {
                 )
             }
 
-            // include metadata from non-standard location in the archive
-            if let metadataPath = metadataPath,
-               metadataPath != packageDirectory.appending(component: Self.metadataFilename)
-            {
-                try localFileSystem.copy(
-                    from: metadataPath,
-                    to: sourceDirectory.appending(component: Self.metadataFilename)
-                )
-            }
-
             try SwiftPackageTool.archiveSource(
                 at: sourceDirectory,
                 to: archivePath,