Skip to content

Commit fb4cc24

Browse files
wraithgarwraithgar
authored
* allow reuse of external integrity stream * replaceRegistryHost can now be a hostname * error when passing signature without keys
1 parent a6b62b2 commit fb4cc24

File tree

6 files changed

+90
-87
lines changed

6 files changed

+90
-87
lines changed

‎node_modules/pacote/lib/fetcher.js

Lines changed: 25 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ const removeTrailingSlashes = require('./util/trailing-slashes.js')
1818
const getContents = require('@npmcli/installed-package-contents')
1919
const readPackageJsonFast = require('read-package-json-fast')
2020
const readPackageJson = promisify(require('read-package-json'))
21+
const Minipass = require('minipass')
2122

2223
// we only change ownership on unix platforms, and only if uid is 0
2324
const selfOwner = process.getuid && process.getuid() === 0 ? {
@@ -105,15 +106,10 @@ class FetcherBase {
105106
this[_readPackageJson] = readPackageJsonFast
106107
}
107108

108-
// config values: npmjs (default), never, always
109-
// we don't want to mutate the original value
110-
if (opts.replaceRegistryHost !== 'never'
111-
&& opts.replaceRegistryHost !== 'always'
112-
) {
113-
this.replaceRegistryHost = 'npmjs'
114-
} else {
115-
this.replaceRegistryHost = opts.replaceRegistryHost
116-
}
109+
// rrh is a registry hostname or 'never' or 'always'
110+
// defaults to registry.npmjs.org
111+
this.replaceRegistryHost = (!opts.replaceRegistryHost || opts.replaceRegistryHost === 'npmjs') ?
112+
'registry.npmjs.org' : opts.replaceRegistryHost
117113

118114
this.defaultTag = opts.defaultTag || 'latest'
119115
this.registry = removeTrailingSlashes(opts.registry || 'https://registry.npmjs.org')
@@ -224,40 +220,42 @@ class FetcherBase {
224220
}
225221

226222
[_istream] (stream) {
227-
// everyone will need one of these, either for verifying or calculating
228-
// We always set it, because we have might only have a weak legacy hex
229-
// sha1 in the packument, and this MAY upgrade it to a stronger algo.
230-
// If we had an integrity, and it doesn't match, then this does not
231-
// override that error; the istream will raise the error before it
232-
// gets to the point of re-setting the integrity.
233-
const istream = ssri.integrityStream(this.opts)
234-
istream.on('integrity', i => this.integrity = i)
235-
stream.on('error', er => istream.emit('error', er))
236-
237-
// if not caching this, just pipe through to the istream and return it
223+
// if not caching this, just return it
238224
if (!this.opts.cache || !this[_cacheFetches]) {
225+
// instead of creating a new integrity stream, we only piggyback on the
226+
// provided stream's events
227+
if (stream.hasIntegrityEmitter) {
228+
stream.on('integrity', i => this.integrity = i)
229+
return stream
230+
}
231+
232+
const istream = ssri.integrityStream(this.opts)
233+
istream.on('integrity', i => this.integrity = i)
234+
stream.on('error', err => istream.emit('error', err))
239235
return stream.pipe(istream)
240236
}
241237

242238
// we have to return a stream that gets ALL the data, and proxies errors,
243239
// but then pipe from the original tarball stream into the cache as well.
244240
// To do this without losing any data, and since the cacache put stream
245241
// is not a passthrough, we have to pipe from the original stream into
246-
// the cache AFTER we pipe into the istream. Since the cache stream
242+
// the cache AFTER we pipe into the middleStream. Since the cache stream
247243
// has an asynchronous flush to write its contents to disk, we need to
248-
// defer the istream end until the cache stream ends.
249-
stream.pipe(istream, { end: false })
244+
// defer the middleStream end until the cache stream ends.
245+
const middleStream = new Minipass()
246+
stream.on('error', err => middleStream.emit('error', err))
247+
stream.pipe(middleStream, { end: false })
250248
const cstream = cacache.put.stream(
251249
this.opts.cache,
252250
`pacote:tarball:${this.from}`,
253251
this.opts
254252
)
253+
cstream.on('integrity', i => this.integrity = i)
254+
cstream.on('error', err => stream.emit('error', err))
255255
stream.pipe(cstream)
256-
// defer istream end until after cstream
257-
// cache write errors should not crash the fetch, this is best-effort.
258-
cstream.promise().catch(() => {}).then(() => istream.end())
259256

260-
return istream
257+
cstream.promise().catch(() => {}).then(() => middleStream.end())
258+
return middleStream
261259
}
262260

263261
pickIntegrityAlgorithm () {

‎node_modules/pacote/lib/registry.js

Lines changed: 41 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -122,11 +122,12 @@ class RegistryFetcher extends Fetcher {
122122
}
123123

124124
const packument = await this.packument()
125-
const mani = await pickManifest(packument, this.spec.fetchSpec, {
125+
let mani = await pickManifest(packument, this.spec.fetchSpec, {
126126
...this.opts,
127127
defaultTag: this.defaultTag,
128128
before: this.before,
129129
})
130+
mani = rpj.normalize(mani)
130131
/* XXX add ETARGET and E403 revalidation of cached packuments here */
131132

132133
// add _resolved and _integrity from dist object
@@ -165,49 +166,53 @@ class RegistryFetcher extends Fetcher {
165166
mani._integrity = String(this.integrity)
166167
if (dist.signatures) {
167168
if (this.opts.verifySignatures) {
168-
if (this.registryKeys) {
169-
// validate and throw on error, then set _signatures
170-
const message = `${mani._id}:${mani._integrity}`
171-
for (const signature of dist.signatures) {
172-
const publicKey = this.registryKeys.filter(key => (key.keyid === signature.keyid))[0]
173-
if (!publicKey) {
174-
throw Object.assign(new Error(
175-
`${mani._id} has a signature with keyid: ${signature.keyid} ` +
176-
'but no corresponding public key can be found.'
177-
), { code: 'EMISSINGSIGNATUREKEY' })
178-
}
179-
const validPublicKey =
180-
!publicKey.expires || (Date.parse(publicKey.expires) > Date.now())
181-
if (!validPublicKey) {
182-
throw Object.assign(new Error(
183-
`${mani._id} has a signature with keyid: ${signature.keyid} ` +
169+
// validate and throw on error, then set _signatures
170+
const message = `${mani._id}:${mani._integrity}`
171+
for (const signature of dist.signatures) {
172+
const publicKey = this.registryKeys &&
173+
this.registryKeys.filter(key => (key.keyid === signature.keyid))[0]
174+
if (!publicKey) {
175+
throw Object.assign(new Error(
176+
`${mani._id} has a registry signature with keyid: ${signature.keyid} ` +
177+
'but no corresponding public key can be found'
178+
), { code: 'EMISSINGSIGNATUREKEY' })
179+
}
180+
const validPublicKey =
181+
!publicKey.expires || (Date.parse(publicKey.expires) > Date.now())
182+
if (!validPublicKey) {
183+
throw Object.assign(new Error(
184+
`${mani._id} has a registry signature with keyid: ${signature.keyid} ` +
184185
`but the corresponding public key has expired ${publicKey.expires}`
185-
), { code: 'EEXPIREDSIGNATUREKEY' })
186-
}
187-
const verifier = crypto.createVerify('SHA256')
188-
verifier.write(message)
189-
verifier.end()
190-
const valid = verifier.verify(
191-
publicKey.pemkey,
192-
signature.sig,
193-
'base64'
194-
)
195-
if (!valid) {
196-
throw Object.assign(new Error(
197-
'Integrity checksum signature failed: ' +
198-
`key ${publicKey.keyid} signature ${signature.sig}`
199-
), { code: 'EINTEGRITYSIGNATURE' })
200-
}
186+
), { code: 'EEXPIREDSIGNATUREKEY' })
187+
}
188+
const verifier = crypto.createVerify('SHA256')
189+
verifier.write(message)
190+
verifier.end()
191+
const valid = verifier.verify(
192+
publicKey.pemkey,
193+
signature.sig,
194+
'base64'
195+
)
196+
if (!valid) {
197+
throw Object.assign(new Error(
198+
`${mani._id} has an invalid registry signature with ` +
199+
`keyid: ${publicKey.keyid} and signature: ${signature.sig}`
200+
), {
201+
code: 'EINTEGRITYSIGNATURE',
202+
keyid: publicKey.keyid,
203+
signature: signature.sig,
204+
resolved: mani._resolved,
205+
integrity: mani._integrity,
206+
})
201207
}
202-
mani._signatures = dist.signatures
203208
}
204-
// if no keys, don't set _signatures
209+
mani._signatures = dist.signatures
205210
} else {
206211
mani._signatures = dist.signatures
207212
}
208213
}
209214
}
210-
this.package = rpj.normalize(mani)
215+
this.package = mani
211216
return this.package
212217
}
213218

‎node_modules/pacote/lib/remote.js

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
44
const pacoteVersion = require('../package.json').version
55
const fetch = require('npm-registry-fetch')
66
const Minipass = require('minipass')
7-
// The default registry URL is a string of great magic.
8-
const magicHost = 'https://registry.npmjs.org'
97

108
const _cacheFetches = Symbol.for('pacote.Fetcher._cacheFetches')
119
const _headers = Symbol('_headers')
@@ -14,11 +12,9 @@ class RemoteFetcher extends Fetcher {
1412
super(spec, opts)
1513
this.resolved = this.spec.fetchSpec
1614
const resolvedURL = new URL(this.resolved)
17-
if (
18-
(this.replaceRegistryHost === 'npmjs'
19-
&& resolvedURL.origin === magicHost)
20-
|| this.replaceRegistryHost === 'always'
21-
) {
15+
if (this.replaceRegistryHost !== 'never'
16+
&& (this.replaceRegistryHost === 'always'
17+
|| this.replaceRegistryHost === resolvedURL.host)) {
2218
this.resolved = new URL(resolvedURL.pathname, this.registry).href
2319
}
2420

@@ -35,23 +31,28 @@ class RemoteFetcher extends Fetcher {
3531

3632
[_tarballFromResolved] () {
3733
const stream = new Minipass()
34+
stream.hasIntegrityEmitter = true
35+
3836
const fetchOpts = {
3937
...this.opts,
4038
headers: this[_headers](),
4139
spec: this.spec,
4240
integrity: this.integrity,
4341
algorithms: [this.pickIntegrityAlgorithm()],
4442
}
45-
fetch(this.resolved, fetchOpts).then(res => {
46-
const hash = res.headers.get('x-local-cache-hash')
47-
if (hash) {
48-
this.integrity = decodeURIComponent(hash)
49-
}
5043

44+
fetch(this.resolved, fetchOpts).then(res => {
5145
res.body.on('error',
5246
/* istanbul ignore next - exceedingly rare and hard to simulate */
5347
er => stream.emit('error', er)
54-
).pipe(stream)
48+
)
49+
50+
res.body.on('integrity', i => {
51+
this.integrity = i
52+
stream.emit('integrity', i)
53+
})
54+
55+
res.body.pipe(stream)
5556
}).catch(er => stream.emit('error', er))
5657

5758
return stream

‎node_modules/pacote/package.json

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "pacote",
3-
"version": "13.5.0",
3+
"version": "13.6.0",
44
"description": "JavaScript package downloader",
55
"author": "GitHub Inc.",
66
"bin": {
@@ -21,8 +21,7 @@
2121
"template-oss-apply": "template-oss-apply --force"
2222
},
2323
"tap": {
24-
"timeout": 300,
25-
"coverage-map": "map.js"
24+
"timeout": 300
2625
},
2726
"devDependencies": {
2827
"@npmcli/eslint-config": "^3.0.1",

‎package-lock.json

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@
138138
"npm-user-validate": "^1.0.1",
139139
"npmlog": "^6.0.2",
140140
"opener": "^1.5.2",
141-
"pacote": "^13.4.1",
141+
"pacote": "^13.6.0",
142142
"parse-conflict-json": "^2.0.2",
143143
"proc-log": "^2.0.1",
144144
"qrcode-terminal": "^0.12.0",
@@ -5547,9 +5547,9 @@
55475547
}
55485548
},
55495549
"node_modules/pacote": {
5550-
"version": "13.5.0",
5551-
"resolved": "https://registry.npmjs.org/pacote/-/pacote-13.5.0.tgz",
5552-
"integrity": "sha512-yekp0ykEsaBH0t0bYA/89R+ywdYV5ZnEdg4YMIfqakSlpIhoF6b8+aEUm8NZpfWRgmy6lxgywcW05URhLRogVQ==",
5550+
"version": "13.6.0",
5551+
"resolved": "https://registry.npmjs.org/pacote/-/pacote-13.6.0.tgz",
5552+
"integrity": "sha512-zHmuCwG4+QKnj47LFlW3LmArwKoglx2k5xtADiMCivVWPgNRP5QyLDGOIjGjwOe61lhl1rO63m/VxT16pEHLWg==",
55535553
"inBundle": true,
55545554
"dependencies": {
55555555
"@npmcli/git": "^3.0.0",
@@ -13877,9 +13877,9 @@
1387713877
}
1387813878
},
1387913879
"pacote": {
13880-
"version": "13.5.0",
13881-
"resolved": "https://registry.npmjs.org/pacote/-/pacote-13.5.0.tgz",
13882-
"integrity": "sha512-yekp0ykEsaBH0t0bYA/89R+ywdYV5ZnEdg4YMIfqakSlpIhoF6b8+aEUm8NZpfWRgmy6lxgywcW05URhLRogVQ==",
13880+
"version": "13.6.0",
13881+
"resolved": "https://registry.npmjs.org/pacote/-/pacote-13.6.0.tgz",
13882+
"integrity": "sha512-zHmuCwG4+QKnj47LFlW3LmArwKoglx2k5xtADiMCivVWPgNRP5QyLDGOIjGjwOe61lhl1rO63m/VxT16pEHLWg==",
1388313883
"requires": {
1388413884
"@npmcli/git": "^3.0.0",
1388513885
"@npmcli/installed-package-contents": "^1.0.7",

‎package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@
107107
"npm-user-validate": "^1.0.1",
108108
"npmlog": "^6.0.2",
109109
"opener": "^1.5.2",
110-
"pacote": "^13.4.1",
110+
"pacote": "^13.6.0",
111111
"parse-conflict-json": "^2.0.2",
112112
"proc-log": "^2.0.1",
113113
"qrcode-terminal": "^0.12.0",

0 commit comments

Comments
 (0)