rapid_stack 1.0.0 → 1.0.1

data/lib/rapid_stack/generators/generator-rapid/node_modules/pacote/lib/fetcher.js

@@ -7,24 +7,29 @@ const npa = require('npm-package-arg')
 const ssri = require('ssri')
 const { promisify } = require('util')
 const { basename, dirname } = require('path')
+const rimraf = promisify(require('rimraf'))
 const tar = require('tar')
-const log = require('proc-log')
+const procLog = require('./util/proc-log.js')
 const retry = require('promise-retry')
-const fs = require('fs/promises')
 const fsm = require('fs-minipass')
 const cacache = require('cacache')
 const isPackageBin = require('./util/is-package-bin.js')
-const removeTrailingSlashes = require('./util/trailing-slashes.js')
 const getContents = require('@npmcli/installed-package-contents')
-const readPackageJsonFast = require('read-package-json-fast')
-const readPackageJson = promisify(require('read-package-json'))
-const { Minipass } = require('minipass')
 
+// we only change ownership on unix platforms, and only if uid is 0
+const selfOwner = process.getuid && process.getuid() === 0 ? {
+  uid: 0,
+  gid: process.getgid(),
+} : null
+const chownr = selfOwner ? promisify(require('chownr')) : null
+const inferOwner = selfOwner ? require('infer-owner') : null
+const mkdirp = require('mkdirp')
 const cacheDir = require('./util/cache-dir.js')
 
 // Private methods.
 // Child classes should not have to override these.
 // Users should never call them.
+const _chown = Symbol('_chown')
 const _extract = Symbol('_extract')
 const _mkdir = Symbol('_mkdir')
 const _empty = Symbol('_empty')
@@ -36,13 +41,11 @@ const _assertType = Symbol('_assertType')
 const _tarballFromCache = Symbol('_tarballFromCache')
 const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
 const _cacheFetches = Symbol.for('pacote.Fetcher._cacheFetches')
-const _readPackageJson = Symbol.for('package.Fetcher._readPackageJson')
 
 class FetcherBase {
   constructor (spec, opts) {
-    if (!opts || typeof opts !== 'object') {
+    if (!opts || typeof opts !== 'object')
       throw new TypeError('options object is required')
-    }
     this.spec = npa(spec, opts.where)
 
     this.allowGitIgnore = !!opts.allowGitIgnore
@@ -59,10 +62,9 @@ class FetcherBase {
     this[_assertType]()
     // clone the opts object so that others aren't upset when we mutate it
     // by adding/modifying the integrity value.
-    this.opts = { ...opts }
+    this.opts = {...opts}
 
-    this.cache = opts.cache || cacheDir().cacache
-    this.tufCache = opts.tufCache || cacheDir().tufcache
+    this.cache = opts.cache || cacheDir()
     this.resolved = opts.resolved || null
 
     // default to caching/verifying with sha512, that's what we usually have
@@ -70,9 +72,8 @@ class FetcherBase {
     // is no longer strong enough.
     this.defaultIntegrityAlgorithm = opts.defaultIntegrityAlgorithm || 'sha512'
 
-    if (typeof opts.integrity === 'string') {
+    if (typeof opts.integrity === 'string')
       this.opts.integrity = ssri.parse(opts.integrity)
-    }
 
     this.package = null
     this.type = this.constructor.name
@@ -84,6 +85,7 @@ class FetcherBase {
     // the process's umask setting do its job.  but if configured, we do
     // respect it.
     this.umask = opts.umask || 0
+    this.log = opts.log || procLog
 
     this.preferOnline = !!opts.preferOnline
     this.preferOffline = !!opts.preferOffline
@@ -91,20 +93,10 @@ class FetcherBase {
 
     this.before = opts.before
     this.fullMetadata = this.before ? true : !!opts.fullMetadata
-    this.fullReadJson = !!opts.fullReadJson
-    if (this.fullReadJson) {
-      this[_readPackageJson] = readPackageJson
-    } else {
-      this[_readPackageJson] = readPackageJsonFast
-    }
-
-    // rrh is a registry hostname or 'never' or 'always'
-    // defaults to registry.npmjs.org
-    this.replaceRegistryHost = (!opts.replaceRegistryHost || opts.replaceRegistryHost === 'npmjs') ?
-      'registry.npmjs.org' : opts.replaceRegistryHost
 
     this.defaultTag = opts.defaultTag || 'latest'
-    this.registry = removeTrailingSlashes(opts.registry || 'https://registry.npmjs.org')
+    this.registry = (opts.registry || 'https://registry.npmjs.org')
+      .replace(/\/+$/, '')
 
     // command to run 'prepare' scripts on directories and git dirs
     // To use pacote with yarn, for example, set npmBin to 'yarn'
@@ -112,7 +104,7 @@ class FetcherBase {
     this.npmBin = opts.npmBin || 'npm'
 
     // command to install deps for preparing
-    this.npmInstallCmd = opts.npmInstallCmd || ['install', '--force']
+    this.npmInstallCmd = opts.npmInstallCmd || [ 'install', '--force' ]
 
     // XXX fill more of this in based on what we know from this.opts
     // we explicitly DO NOT fill in --tag, though, since we are often
@@ -140,22 +132,19 @@ class FetcherBase {
   get integrity () {
     return this.opts.integrity || null
   }
-
   set integrity (i) {
-    if (!i) {
+    if (!i)
       return
-    }
 
     i = ssri.parse(i)
     const current = this.opts.integrity
 
     // do not ever update an existing hash value, but do
     // merge in NEW algos and hashes that we don't already have.
-    if (current) {
+    if (current)
       current.merge(i)
-    } else {
+    else
       this.opts.integrity = i
-    }
   }
 
   get notImplementedError () {
@@ -212,43 +201,39 @@ class FetcherBase {
   }
 
   [_istream] (stream) {
-    // if not caching this, just return it
-    if (!this.opts.cache || !this[_cacheFetches]) {
-      // instead of creating a new integrity stream, we only piggyback on the
-      // provided stream's events
-      if (stream.hasIntegrityEmitter) {
-        stream.on('integrity', i => this.integrity = i)
-        return stream
-      }
-
-      const istream = ssri.integrityStream(this.opts)
-      istream.on('integrity', i => this.integrity = i)
-      stream.on('error', err => istream.emit('error', err))
+    // everyone will need one of these, either for verifying or calculating
+    // We always set it, because we have might only have a weak legacy hex
+    // sha1 in the packument, and this MAY upgrade it to a stronger algo.
+    // If we had an integrity, and it doesn't match, then this does not
+    // override that error; the istream will raise the error before it
+    // gets to the point of re-setting the integrity.
+    const istream = ssri.integrityStream(this.opts)
+    istream.on('integrity', i => this.integrity = i)
+    stream.on('error', er => istream.emit('error', er))
+
+    // if not caching this, just pipe through to the istream and return it
+    if (!this.opts.cache || !this[_cacheFetches])
       return stream.pipe(istream)
-    }
 
     // we have to return a stream that gets ALL the data, and proxies errors,
     // but then pipe from the original tarball stream into the cache as well.
     // To do this without losing any data, and since the cacache put stream
     // is not a passthrough, we have to pipe from the original stream into
-    // the cache AFTER we pipe into the middleStream.  Since the cache stream
+    // the cache AFTER we pipe into the istream.  Since the cache stream
     // has an asynchronous flush to write its contents to disk, we need to
-    // defer the middleStream end until the cache stream ends.
-    const middleStream = new Minipass()
-    stream.on('error', err => middleStream.emit('error', err))
-    stream.pipe(middleStream, { end: false })
+    // defer the istream end until the cache stream ends.
+    stream.pipe(istream, { end: false })
     const cstream = cacache.put.stream(
       this.opts.cache,
       `pacote:tarball:${this.from}`,
       this.opts
     )
-    cstream.on('integrity', i => this.integrity = i)
-    cstream.on('error', err => stream.emit('error', err))
     stream.pipe(cstream)
+    // defer istream end until after cstream
+    // cache write errors should not crash the fetch, this is best-effort.
+    cstream.promise().catch(() => {}).then(() => istream.end())
 
-    // eslint-disable-next-line promise/catch-or-return
-    cstream.promise().catch(() => {}).then(() => middleStream.end())
-    return middleStream
+    return istream
   }
 
   pickIntegrityAlgorithm () {
@@ -262,10 +247,7 @@ class FetcherBase {
   }
 
   // override the types getter
-  get types () {
-    return false
-  }
-
+  get types () {}
   [_assertType] () {
     if (this.types && !this.types.includes(this.spec.type)) {
       throw new TypeError(`Wrong spec type (${
@@ -306,42 +288,39 @@ class FetcherBase {
       this.integrity &&
       this.resolved
     ) ? streamHandler(this[_tarballFromCache]()).catch(er => {
-        if (this.isDataCorruptionError(er)) {
-          log.warn('tarball', `cached data for ${
+      if (this.isDataCorruptionError(er)) {
+        this.log.warn('tarball', `cached data for ${
           this.spec
         } (${this.integrity}) seems to be corrupted. Refreshing cache.`)
-          return this.cleanupCached().then(() => {
-            throw er
-          })
-        } else {
-          throw er
-        }
-      }) : null
+        return this.cleanupCached().then(() => { throw er })
+      } else {
+        throw er
+      }
+    }) : null
 
     const fromResolved = er => {
       if (er) {
-        if (!this.isRetriableError(er)) {
+        if (!this.isRetriableError(er))
           throw er
-        }
-        log.silly('tarball', `no local data for ${
+        this.log.silly('tarball', `no local data for ${
           this.spec
         }. Extracting by manifest.`)
       }
       return this.resolve().then(() => retry(tryAgain =>
         streamHandler(this[_istream](this[_tarballFromResolved]()))
-          .catch(streamErr => {
+        .catch(er => {
           // Most likely data integrity.  A cache ENOENT error is unlikely
           // here, since we're definitely not reading from the cache, but it
           // IS possible that the fetch subsystem accessed the cache, and the
           // entry got blown away or something.  Try one more time to be sure.
-            if (this.isRetriableError(streamErr)) {
-              log.warn('tarball', `tarball data for ${
+          if (this.isRetriableError(er)) {
+            this.log.warn('tarball', `tarball data for ${
               this.spec
             } (${this.integrity}) seems to be corrupted. Trying again.`)
-              return this.cleanupCached().then(() => tryAgain(streamErr))
-            }
-            throw streamErr
-          }), { retries: 1, minTimeout: 0, maxTimeout: 0 }))
+            return this.cleanupCached().then(() => tryAgain(er))
+          }
+          throw er
+        }), { retries: 1, minTimeout: 0, maxTimeout: 0 }))
     }
 
     return fromCache ? fromCache.catch(fromResolved) : fromResolved()
@@ -351,21 +330,44 @@ class FetcherBase {
     return cacache.rm.content(this.cache, this.integrity, this.opts)
   }
 
+  async [_chown] (path, uid, gid) {
+    return selfOwner && (selfOwner.gid !== gid || selfOwner.uid !== uid)
+      ? chownr(path, uid, gid)
+      : /* istanbul ignore next - we don't test in root-owned folders */ null
+  }
+
   [_empty] (path) {
-    return getContents({ path, depth: 1 }).then(contents => Promise.all(
-      contents.map(entry => fs.rm(entry, { recursive: true, force: true }))))
+    return getContents({path, depth: 1}).then(contents => Promise.all(
+      contents.map(entry => rimraf(entry))))
   }
 
-  async [_mkdir] (dest) {
-    await this[_empty](dest)
-    return await fs.mkdir(dest, { recursive: true })
+  [_mkdir] (dest) {
+    // if we're bothering to do owner inference, then do it.
+    // otherwise just make the dir, and return an empty object.
+    // always empty the dir dir to start with, but do so
+    // _after_ inferring the owner, in case there's an existing folder
+    // there that we would want to preserve which differs from the
+    // parent folder (rare, but probably happens sometimes).
+    return !inferOwner
+      ? this[_empty](dest).then(() => mkdirp(dest)).then(() => ({}))
+      : inferOwner(dest).then(({uid, gid}) =>
+        this[_empty](dest)
+          .then(() => mkdirp(dest))
+          .then(made => {
+            // ignore the || dest part in coverage.  It's there to handle
+            // race conditions where the dir may be made by someone else
+            // after being removed by us.
+            const dir = made || /* istanbul ignore next */ dest
+            return this[_chown](dir, uid, gid)
+          })
+          .then(() => ({uid, gid})))
   }
 
   // extraction is always the same.  the only difference is where
   // the tarball comes from.
-  async extract (dest) {
-    await this[_mkdir](dest)
-    return this.tarballStream((tarball) => this[_extract](dest, tarball))
+  extract (dest) {
+    return this[_mkdir](dest).then(({uid, gid}) =>
+      this.tarballStream(tarball => this[_extract](dest, tarball, uid, gid)))
   }
 
   [_toFile] (dest) {
@@ -383,14 +385,18 @@ class FetcherBase {
   }
 
   // don't use this[_mkdir] because we don't want to rimraf anything
-  async tarballFile (dest) {
+  tarballFile (dest) {
     const dir = dirname(dest)
-    await fs.mkdir(dir, { recursive: true })
-    return this[_toFile](dest)
+    return !inferOwner
+      ? mkdirp(dir).then(() => this[_toFile](dest))
+      : inferOwner(dest).then(({uid, gid}) =>
+        mkdirp(dir).then(made => this[_toFile](dest)
+          .then(res => this[_chown](made || dir, uid, gid)
+            .then(() => res))))
   }
 
-  [_extract] (dest, tarball) {
-    const extractor = tar.x(this[_tarxOptions]({ cwd: dest }))
+  [_extract] (dest, tarball, uid, gid) {
+    const extractor = tar.x(this[_tarxOptions]({ cwd: dest, uid, gid }))
     const p = new Promise((resolve, reject) => {
       extractor.on('end', () => {
         resolve({
@@ -401,8 +407,8 @@ class FetcherBase {
       })
 
       extractor.on('error', er => {
-        log.warn('tar', er.message)
-        log.silly('tar', er)
+        this.log.warn('tar', er.message)
+        this.log.silly('tar', er)
         reject(er)
       })
 
@@ -426,30 +432,28 @@ class FetcherBase {
     return ((mode | m) & ~this.umask) | exe | 0o600
   }
 
-  [_tarxOptions] ({ cwd }) {
+  [_tarxOptions] ({ cwd, uid, gid }) {
     const sawIgnores = new Set()
     return {
       cwd,
       noChmod: true,
       noMtime: true,
       filter: (name, entry) => {
-        if (/Link$/.test(entry.type)) {
+        if (/Link$/.test(entry.type))
           return false
-        }
         entry.mode = this[_entryMode](entry.path, entry.mode, entry.type)
         // this replicates the npm pack behavior where .gitignore files
         // are treated like .npmignore files, but only if a .npmignore
         // file is not present.
         if (/File$/.test(entry.type)) {
           const base = basename(entry.path)
-          if (base === '.npmignore') {
+          if (base === '.npmignore')
             sawIgnores.add(entry.path)
-          } else if (base === '.gitignore' && !this.allowGitIgnore) {
+          else if (base === '.gitignore' && !this.allowGitIgnore) {
             // rename, but only if there's not already a .npmignore
             const ni = entry.path.replace(/\.gitignore$/, '.npmignore')
-            if (sawIgnores.has(ni)) {
+            if (sawIgnores.has(ni))
               return false
-            }
             entry.path = ni
           }
           return true
@@ -458,12 +462,12 @@ class FetcherBase {
       strip: 1,
       onwarn: /* istanbul ignore next - we can trust that tar logs */
       (code, msg, data) => {
-        log.warn('tar', code, msg)
-        log.silly('tar', code, msg, data)
+        this.log.warn('tar', code, msg)
+        this.log.silly('tar', code, msg, data)
       },
+      uid,
+      gid,
       umask: this.umask,
-      // always ignore ownership info from tarball metadata
-      preserveOwner: false,
     }
   }
 }

data/lib/rapid_stack/generators/generator-rapid/node_modules/pacote/lib/file.js

@@ -1,11 +1,12 @@
 const Fetcher = require('./fetcher.js')
 const fsm = require('fs-minipass')
 const cacache = require('cacache')
+const { promisify } = require('util')
+const readPackageJson = require('read-package-json-fast')
 const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
 const _exeBins = Symbol('_exeBins')
 const { resolve } = require('path')
 const fs = require('fs')
-const _readPackageJson = Symbol.for('package.Fetcher._readPackageJson')
 
 class FileFetcher extends Fetcher {
   constructor (spec, opts) {
@@ -19,26 +20,24 @@ class FileFetcher extends Fetcher {
   }
 
   manifest () {
-    if (this.package) {
+    if (this.package)
       return Promise.resolve(this.package)
-    }
 
     // have to unpack the tarball for this.
     return cacache.tmp.withTmp(this.cache, this.opts, dir =>
       this.extract(dir)
-        .then(() => this[_readPackageJson](dir + '/package.json'))
-        .then(mani => this.package = {
-          ...mani,
-          _integrity: this.integrity && String(this.integrity),
-          _resolved: this.resolved,
-          _from: this.from,
-        }))
+      .then(() => readPackageJson(dir + '/package.json'))
+      .then(mani => this.package = {
+        ...mani,
+        _integrity: this.integrity && String(this.integrity),
+        _resolved: this.resolved,
+        _from: this.from,
+      }))
   }
 
   [_exeBins] (pkg, dest) {
-    if (!pkg.bin) {
+    if (!pkg.bin)
       return Promise.resolve()
-    }
 
     return Promise.all(Object.keys(pkg.bin).map(k => new Promise(res => {
       const script = resolve(dest, pkg.bin[k])
@@ -47,13 +46,11 @@ class FileFetcher extends Fetcher {
       // something, we just leave it for a later stage to trip over
       // when we can provide a more useful contextual error.
       fs.stat(script, (er, st) => {
-        if (er) {
+        if (er)
           return res()
-        }
         const mode = st.mode | 0o111
-        if (mode === st.mode) {
+        if (mode === st.mode)
           return res()
-        }
         fs.chmod(script, mode, res)
       })
     })))
@@ -64,8 +61,8 @@ class FileFetcher extends Fetcher {
     // but if not, read the unpacked manifest and chmod properly.
     return super.extract(dest)
       .then(result => this.package ? result
-      : this[_readPackageJson](dest + '/package.json').then(pkg =>
-        this[_exeBins](pkg, dest)).then(() => result))
+        : readPackageJson(dest + '/package.json').then(pkg =>
+          this[_exeBins](pkg, dest)).then(() => result))
   }
 
   [_tarballFromResolved] () {
@@ -78,7 +75,7 @@ class FileFetcher extends Fetcher {
     return this.manifest().then(mani => ({
       name: mani.name,
       'dist-tags': {
-        [this.defaultTag]: mani.version,
+        [this.defaultTag]: mani.version
       },
       versions: {
         [mani.version]: {
@@ -86,9 +83,9 @@ class FileFetcher extends Fetcher {
           dist: {
             tarball: `file:${this.resolved}`,
             integrity: this.integrity && String(this.integrity),
-          },
-        },
-      },
+          }
+        }
+      }
     }))
   }
 }