rapid_stack 1.0.0 → 1.0.2

data/lib/rapid_stack/generators/generator-rapid/node_modules/pacote/lib/git.js

@@ -6,9 +6,11 @@ const hashre = /^[a-f0-9]{40}$/
 const git = require('@npmcli/git')
 const pickManifest = require('npm-pick-manifest')
 const npa = require('npm-package-arg')
-const { Minipass } = require('minipass')
+const url = require('url')
+const Minipass = require('minipass')
 const cacache = require('cacache')
-const log = require('proc-log')
+const { promisify } = require('util')
+const readPackageJson = require('read-package-json-fast')
 const npm = require('./util/npm.js')
 
 const _resolvedFromRepo = Symbol('_resolvedFromRepo')
@@ -22,7 +24,6 @@ const _cloneHosted = Symbol('_cloneHosted')
 const _cloneRepo = Symbol('_cloneRepo')
 const _setResolvedWithSha = Symbol('_setResolvedWithSha')
 const _prepareDir = Symbol('_prepareDir')
-const _readPackageJson = Symbol.for('package.Fetcher._readPackageJson')
 
 // get the repository url.
 // prefer https if there's auth, since ssh will drop that.
@@ -38,17 +39,9 @@ const addGitPlus = url => url && `git+${url}`.replace(/^(git\+)+/, 'git+')
 class GitFetcher extends Fetcher {
   constructor (spec, opts) {
     super(spec, opts)
-
-    // we never want to compare integrity for git dependencies: npm/rfcs#525
-    if (this.opts.integrity) {
-      delete this.opts.integrity
-      log.warn(`skipping integrity check for git dependency ${this.spec.fetchSpec}`)
-    }
-
     this.resolvedRef = null
-    if (this.spec.hosted) {
+    if (this.spec.hosted)
       this.from = this.spec.hosted.shortcut({ noCommittish: false })
-    }
 
     // shortcut: avoid full clone when we can go straight to the tgz
     // if we have the full sha and it's a hosted git platform
@@ -58,11 +51,8 @@ class GitFetcher extends Fetcher {
       this.resolved = this.spec.hosted
         ? repoUrl(this.spec.hosted, { noCommittish: false })
         : this.spec.rawSpec
-    } else {
+    } else
       this.resolvedSha = ''
-    }
-
-    this.Arborist = opts.Arborist || null
   }
 
   // just exposed to make it easier to test all the combinations
@@ -77,9 +67,8 @@ class GitFetcher extends Fetcher {
   resolve () {
     // likely a hosted git repo with a sha, so get the tarball url
     // but in general, no reason to resolve() more than necessary!
-    if (this.resolved) {
+    if (this.resolved)
       return super.resolve()
-    }
 
     // fetch the git repo and then look at the current hash
     const h = this.spec.hosted
@@ -97,41 +86,37 @@ class GitFetcher extends Fetcher {
     return this[_resolvedFromRepo](hosted.https && hosted.https())
       .catch(er => {
         // Throw early since we know pathspec errors will fail again if retried
-        if (er instanceof git.errors.GitPathspecError) {
+        if (er instanceof git.errors.GitPathspecError)
           throw er
-        }
         const ssh = hosted.sshurl && hosted.sshurl()
         // no fallthrough if we can't fall through or have https auth
-        if (!ssh || hosted.auth) {
+        if (!ssh || hosted.auth)
           throw er
-        }
         return this[_resolvedFromRepo](ssh)
       })
   }
 
   [_resolvedFromRepo] (gitRemote) {
     // XXX make this a custom error class
-    if (!gitRemote) {
+    if (!gitRemote)
       return Promise.reject(new Error(`No git url for ${this.spec}`))
-    }
     const gitRange = this.spec.gitRange
     const name = this.spec.name
     return git.revs(gitRemote, this.opts).then(remoteRefs => {
       return gitRange ? pickManifest({
-        versions: remoteRefs.versions,
-        'dist-tags': remoteRefs['dist-tags'],
-        name,
-      }, gitRange, this.opts)
+          versions: remoteRefs.versions,
+          'dist-tags': remoteRefs['dist-tags'],
+          name,
+        }, gitRange, this.opts)
         : this.spec.gitCommittish ?
           remoteRefs.refs[this.spec.gitCommittish] ||
           remoteRefs.refs[remoteRefs.shas[this.spec.gitCommittish]]
-          : remoteRefs.refs.HEAD // no git committish, get default head
+        : remoteRefs.refs.HEAD // no git committish, get default head
     }).then(revDoc => {
       // the committish provided isn't in the rev list
       // things like HEAD~3 or @yesterday can land here.
-      if (!revDoc || !revDoc.sha) {
+      if (!revDoc || !revDoc.sha)
         return this[_resolvedFromClone]()
-      }
 
       this.resolvedRef = revDoc
       this.resolvedSha = revDoc.sha
@@ -160,18 +145,16 @@ class GitFetcher extends Fetcher {
   }
 
   [_prepareDir] (dir) {
-    return this[_readPackageJson](dir + '/package.json').then(mani => {
+    return readPackageJson(dir + '/package.json').then(mani => {
       // no need if we aren't going to do any preparation.
       const scripts = mani.scripts
-      if (!mani.workspaces && (!scripts || !(
-        scripts.postinstall ||
+      if (!scripts || !(
+          scripts.postinstall ||
           scripts.build ||
           scripts.preinstall ||
           scripts.install ||
-          scripts.prepack ||
-          scripts.prepare))) {
+          scripts.prepare))
         return
-      }
 
       // to avoid cases where we have an cycle of git deps that depend
       // on one another, we only ever do preparation for one instance
@@ -183,7 +166,7 @@ class GitFetcher extends Fetcher {
       const noPrepare = !process.env._PACOTE_NO_PREPARE_ ? []
         : process.env._PACOTE_NO_PREPARE_.split('\n')
       if (noPrepare.includes(this.resolved)) {
-        log.info('prepare', 'skip prepare, already seen', this.resolved)
+        this.log.info('prepare', 'skip prepare, already seen', this.resolved)
         return
       }
       noPrepare.push(this.resolved)
@@ -203,17 +186,14 @@ class GitFetcher extends Fetcher {
   [_tarballFromResolved] () {
     const stream = new Minipass()
     stream.resolved = this.resolved
+    stream.integrity = this.integrity
     stream.from = this.from
 
     // check it out and then shell out to the DirFetcher tarball packer
     this[_clone](dir => this[_prepareDir](dir)
       .then(() => new Promise((res, rej) => {
-        if (!this.Arborist) {
-          throw new Error('GitFetcher requires an Arborist constructor to pack a tarball')
-        }
         const df = new DirFetcher(`file:${dir}`, {
           ...this.opts,
-          Arborist: this.Arborist,
           resolved: null,
           integrity: null,
         })
@@ -222,9 +202,9 @@ class GitFetcher extends Fetcher {
         dirStream.on('end', res)
         dirStream.pipe(stream)
       }))).catch(
-      /* istanbul ignore next: very unlikely and hard to test */
-      er => stream.emit('error', er)
-    )
+        /* istanbul ignore next: very unlikely and hard to test */
+        er => stream.emit('error', er)
+      )
     return stream
   }
 
@@ -245,7 +225,7 @@ class GitFetcher extends Fetcher {
     tarballOk = tarballOk &&
       h && resolved === repoUrl(h, { noCommittish: false }) && h.tarball
 
-    return cacache.tmp.withTmp(this.cache, o, async tmp => {
+    return cacache.tmp.withTmp(this.cache, o, tmp => {
       // if we're resolved, and have a tarball url, shell out to RemoteFetcher
       if (tarballOk) {
         const nameat = this.spec.name ? `${this.spec.name}@` : ''
@@ -257,23 +237,22 @@ class GitFetcher extends Fetcher {
           integrity: null, // it'll always be different, if we have one
         }).extract(tmp).then(() => handler(tmp), er => {
           // fall back to ssh download if tarball fails
-          if (er.constructor.name.match(/^Http/)) {
+          if (er.constructor.name.match(/^Http/))
             return this[_clone](handler, false)
-          } else {
+          else
             throw er
-          }
         })
       }
 
-      const sha = await (
+      return (
         h ? this[_cloneHosted](ref, tmp)
         : this[_cloneRepo](this.spec.fetchSpec, ref, tmp)
-      )
-      this.resolvedSha = sha
-      if (!this.resolved) {
-        await this[_addGitSha](sha)
-      }
-      return handler(tmp)
+      ).then(sha => {
+        this.resolvedSha = sha
+        if (!this.resolved)
+          this[_addGitSha](sha)
+      })
+      .then(() => handler(tmp))
     })
   }
 
@@ -287,14 +266,12 @@ class GitFetcher extends Fetcher {
     return this[_cloneRepo](hosted.https({ noCommittish: true }), ref, tmp)
       .catch(er => {
         // Throw early since we know pathspec errors will fail again if retried
-        if (er instanceof git.errors.GitPathspecError) {
+        if (er instanceof git.errors.GitPathspecError)
           throw er
-        }
         const ssh = hosted.sshurl && hosted.sshurl({ noCommittish: true })
         // no fallthrough if we can't fall through or have https auth
-        if (!ssh || hosted.auth) {
+        if (!ssh || hosted.auth)
           throw er
-        }
         return this[_cloneRepo](ssh, ref, tmp)
       })
   }
@@ -305,19 +282,19 @@ class GitFetcher extends Fetcher {
   }
 
   manifest () {
-    if (this.package) {
+    if (this.package)
       return Promise.resolve(this.package)
-    }
 
     return this.spec.hosted && this.resolved
       ? FileFetcher.prototype.manifest.apply(this)
       : this[_clone](dir =>
-        this[_readPackageJson](dir + '/package.json')
-          .then(mani => this.package = {
-            ...mani,
-            _resolved: this.resolved,
-            _from: this.from,
-          }))
+          readPackageJson(dir + '/package.json')
+            .then(mani => this.package = {
+              ...mani,
+              _integrity: this.integrity && String(this.integrity),
+              _resolved: this.resolved,
+              _from: this.from,
+            }))
   }
 
   packument () {

data/lib/rapid_stack/generators/generator-rapid/node_modules/pacote/lib/registry.js

@@ -2,13 +2,11 @@ const Fetcher = require('./fetcher.js')
 const RemoteFetcher = require('./remote.js')
 const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
 const pacoteVersion = require('../package.json').version
-const removeTrailingSlashes = require('./util/trailing-slashes.js')
+const npa = require('npm-package-arg')
 const rpj = require('read-package-json-fast')
 const pickManifest = require('npm-pick-manifest')
 const ssri = require('ssri')
-const crypto = require('crypto')
-const npa = require('npm-package-arg')
-const { sigstore } = require('sigstore')
+const Minipass = require('minipass')
 
 // Corgis are cute. 🐕🐶
 const corgiDoc = 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*'
@@ -16,6 +14,8 @@ const fullDoc = 'application/json'
 
 const fetch = require('npm-registry-fetch')
 
+// TODO: memoize reg requests, so we don't even have to check cache
+
 const _headers = Symbol('_headers')
 class RegistryFetcher extends Fetcher {
   constructor (spec, opts) {
@@ -29,34 +29,35 @@ class RegistryFetcher extends Fetcher {
     // already.
     this.packumentCache = this.opts.packumentCache || null
 
+    // handle case when npm-package-arg guesses wrong.
+    if (this.spec.type === 'tag' &&
+        this.spec.rawSpec === '' &&
+        this.defaultTag !== 'latest')
+      this.spec = npa(`${this.spec.name}@${this.defaultTag}`)
     this.registry = fetch.pickRegistry(spec, opts)
-    this.packumentUrl = removeTrailingSlashes(this.registry) + '/' +
+    this.packumentUrl = this.registry.replace(/\/*$/, '/') +
       this.spec.escapedName
 
-    const parsed = new URL(this.registry)
-    const regKey = `//${parsed.host}${parsed.pathname}`
-    // unlike the nerf-darted auth keys, this one does *not* allow a mismatch
-    // of trailing slashes.  It must match exactly.
-    if (this.opts[`${regKey}:_keys`]) {
-      this.registryKeys = this.opts[`${regKey}:_keys`]
-    }
-
     // XXX pacote <=9 has some logic to ignore opts.resolved if
     // the resolved URL doesn't go to the same registry.
     // Consider reproducing that here, to throw away this.resolved
     // in that case.
   }
 
-  async resolve () {
-    // fetching the manifest sets resolved and (if present) integrity
-    await this.manifest()
-    if (!this.resolved) {
+  resolve () {
+    if (this.resolved)
+      return Promise.resolve(this.resolved)
+
+    // fetching the manifest sets resolved and (usually) integrity
+    return this.manifest().then(() => {
+      if (this.resolved)
+        return this.resolved
+
       throw Object.assign(
         new Error('Invalid package manifest: no `dist.tarball` field'),
         { package: this.spec.toString() }
       )
-    }
-    return this.resolved
+    })
   }
 
   [_headers] () {
@@ -76,252 +77,89 @@ class RegistryFetcher extends Fetcher {
     // note this might be either an in-flight promise for a request,
     // or the actual packument, but we never want to make more than
     // one request at a time for the same thing regardless.
-    if (this.packumentCache && this.packumentCache.has(this.packumentUrl)) {
+    if (this.packumentCache && this.packumentCache.has(this.packumentUrl))
       return this.packumentCache.get(this.packumentUrl)
-    }
 
     // npm-registry-fetch the packument
     // set the appropriate header for corgis if fullMetadata isn't set
     // return the res.json() promise
-    try {
-      const res = await fetch(this.packumentUrl, {
-        ...this.opts,
-        headers: this[_headers](),
-        spec: this.spec,
-        // never check integrity for packuments themselves
-        integrity: null,
-      })
-      const packument = await res.json()
+    const p = fetch(this.packumentUrl, {
+      ...this.opts,
+      headers: this[_headers](),
+      spec: this.spec,
+      // never check integrity for packuments themselves
+      integrity: null,
+    }).then(res => res.json().then(packument => {
+      packument._cached = res.headers.has('x-local-cache')
       packument._contentLength = +res.headers.get('content-length')
-      if (this.packumentCache) {
+      if (this.packumentCache)
         this.packumentCache.set(this.packumentUrl, packument)
-      }
       return packument
-    } catch (err) {
-      if (this.packumentCache) {
+    })).catch(er => {
+      if (this.packumentCache)
         this.packumentCache.delete(this.packumentUrl)
+      if (er.code === 'E404' && !this.fullMetadata) {
+        // possible that corgis are not supported by this registry
+        this.fullMetadata = true
+        return this.packument()
       }
-      if (err.code !== 'E404' || this.fullMetadata) {
-        throw err
-      }
-      // possible that corgis are not supported by this registry
-      this.fullMetadata = true
-      return this.packument()
-    }
-  }
-
-  async manifest () {
-    if (this.package) {
-      return this.package
-    }
-
-    const packument = await this.packument()
-    let mani = await pickManifest(packument, this.spec.fetchSpec, {
-      ...this.opts,
-      defaultTag: this.defaultTag,
-      before: this.before,
+      throw er
     })
-    mani = rpj.normalize(mani)
-    /* XXX add ETARGET and E403 revalidation of cached packuments here */
-
-    // add _resolved and _integrity from dist object
-    const { dist } = mani
-    if (dist) {
-      this.resolved = mani._resolved = dist.tarball
-      mani._from = this.from
-      const distIntegrity = dist.integrity ? ssri.parse(dist.integrity)
-        : dist.shasum ? ssri.fromHex(dist.shasum, 'sha1', { ...this.opts })
-        : null
-      if (distIntegrity) {
-        if (this.integrity && !this.integrity.match(distIntegrity)) {
-          // only bork if they have algos in common.
-          // otherwise we end up breaking if we have saved a sha512
-          // previously for the tarball, but the manifest only
-          // provides a sha1, which is possible for older publishes.
-          // Otherwise, this is almost certainly a case of holding it
-          // wrong, and will result in weird or insecure behavior
-          // later on when building package tree.
-          for (const algo of Object.keys(this.integrity)) {
-            if (distIntegrity[algo]) {
-              throw Object.assign(new Error(
-                `Integrity checksum failed when using ${algo}: ` +
-                `wanted ${this.integrity} but got ${distIntegrity}.`
-              ), { code: 'EINTEGRITY' })
-            }
-          }
-        }
-        // made it this far, the integrity is worthwhile.  accept it.
-        // the setter here will take care of merging it into what we already
-        // had.
-        this.integrity = distIntegrity
-      }
-    }
-    if (this.integrity) {
-      mani._integrity = String(this.integrity)
-      if (dist.signatures) {
-        if (this.opts.verifySignatures) {
-          // validate and throw on error, then set _signatures
-          const message = `${mani._id}:${mani._integrity}`
-          for (const signature of dist.signatures) {
-            const publicKey = this.registryKeys &&
-              this.registryKeys.filter(key => (key.keyid === signature.keyid))[0]
-            if (!publicKey) {
-              throw Object.assign(new Error(
-                  `${mani._id} has a registry signature with keyid: ${signature.keyid} ` +
-                  'but no corresponding public key can be found'
-              ), { code: 'EMISSINGSIGNATUREKEY' })
-            }
-            const validPublicKey =
-              !publicKey.expires || (Date.parse(publicKey.expires) > Date.now())
-            if (!validPublicKey) {
-              throw Object.assign(new Error(
-                  `${mani._id} has a registry signature with keyid: ${signature.keyid} ` +
-                  `but the corresponding public key has expired ${publicKey.expires}`
-              ), { code: 'EEXPIREDSIGNATUREKEY' })
-            }
-            const verifier = crypto.createVerify('SHA256')
-            verifier.write(message)
-            verifier.end()
-            const valid = verifier.verify(
-              publicKey.pemkey,
-              signature.sig,
-              'base64'
-            )
-            if (!valid) {
-              throw Object.assign(new Error(
-                  `${mani._id} has an invalid registry signature with ` +
-                  `keyid: ${publicKey.keyid} and signature: ${signature.sig}`
-              ), {
-                code: 'EINTEGRITYSIGNATURE',
-                keyid: publicKey.keyid,
-                signature: signature.sig,
-                resolved: mani._resolved,
-                integrity: mani._integrity,
-              })
-            }
-          }
-          mani._signatures = dist.signatures
-        } else {
-          mani._signatures = dist.signatures
-        }
-      }
-
-      if (dist.attestations) {
-        if (this.opts.verifyAttestations) {
-          // Always fetch attestations from the current registry host
-          const attestationsPath = new URL(dist.attestations.url).pathname
-          const attestationsUrl = removeTrailingSlashes(this.registry) + attestationsPath
-          const res = await fetch(attestationsUrl, {
-            ...this.opts,
-            // disable integrity check for attestations json payload, we check the
-            // integrity in the verification steps below
-            integrity: null,
-          })
-          const { attestations } = await res.json()
-          const bundles = attestations.map(({ predicateType, bundle }) => {
-            const statement = JSON.parse(
-              Buffer.from(bundle.dsseEnvelope.payload, 'base64').toString('utf8')
-            )
-            const keyid = bundle.dsseEnvelope.signatures[0].keyid
-            const signature = bundle.dsseEnvelope.signatures[0].sig
-
-            return {
-              predicateType,
-              bundle,
-              statement,
-              keyid,
-              signature,
-            }
-          })
-
-          const attestationKeyIds = bundles.map((b) => b.keyid).filter((k) => !!k)
-          const attestationRegistryKeys = (this.registryKeys || [])
-            .filter(key => attestationKeyIds.includes(key.keyid))
-          if (!attestationRegistryKeys.length) {
-            throw Object.assign(new Error(
-              `${mani._id} has attestations but no corresponding public key(s) can be found`
-            ), { code: 'EMISSINGSIGNATUREKEY' })
-          }
-
-          for (const { predicateType, bundle, keyid, signature, statement } of bundles) {
-            const publicKey = attestationRegistryKeys.find(key => key.keyid === keyid)
-            // Publish attestations have a keyid set and a valid public key must be found
-            if (keyid) {
-              if (!publicKey) {
-                throw Object.assign(new Error(
-                  `${mani._id} has attestations with keyid: ${keyid} ` +
-                  'but no corresponding public key can be found'
-                ), { code: 'EMISSINGSIGNATUREKEY' })
-              }
-
-              const validPublicKey =
-                !publicKey.expires || (Date.parse(publicKey.expires) > Date.now())
-              if (!validPublicKey) {
-                throw Object.assign(new Error(
-                  `${mani._id} has attestations with keyid: ${keyid} ` +
-                  `but the corresponding public key has expired ${publicKey.expires}`
-                ), { code: 'EEXPIREDSIGNATUREKEY' })
-              }
-            }
-
-            const subject = {
-              name: statement.subject[0].name,
-              sha512: statement.subject[0].digest.sha512,
-            }
+    if (this.packumentCache)
+      this.packumentCache.set(this.packumentUrl, p)
+    return p
+  }
 
-            // Only type 'version' can be turned into a PURL
-            const purl = this.spec.type === 'version' ? npa.toPurl(this.spec) : this.spec
-            // Verify the statement subject matches the package, version
-            if (subject.name !== purl) {
-              throw Object.assign(new Error(
-                `${mani._id} package name and version (PURL): ${purl} ` +
-                `doesn't match what was signed: ${subject.name}`
-              ), { code: 'EATTESTATIONSUBJECT' })
-            }
+  manifest () {
+    if (this.package)
+      return Promise.resolve(this.package)
 
-            // Verify the statement subject matches the tarball integrity
-            const integrityHexDigest = ssri.parse(this.integrity).hexDigest()
-            if (subject.sha512 !== integrityHexDigest) {
-              throw Object.assign(new Error(
-                `${mani._id} package integrity (hex digest): ` +
-                `${integrityHexDigest} ` +
-                `doesn't match what was signed: ${subject.sha512}`
-              ), { code: 'EATTESTATIONSUBJECT' })
-            }
-
-            try {
-              // Provenance attestations are signed with a signing certificate
-              // (including the key) so we don't need to return a public key.
-              //
-              // Publish attestations are signed with a keyid so we need to
-              // specify a public key from the keys endpoint: `registry-host.tld/-/npm/v1/keys`
-              const options = {
-                tufCachePath: this.tufCache,
-                keySelector: publicKey ? () => publicKey.pemkey : undefined,
+    return this.packument()
+      .then(packument => pickManifest(packument, this.spec.fetchSpec, {
+        ...this.opts,
+        defaultTag: this.defaultTag,
+        before: this.before,
+      }) /* XXX add ETARGET and E403 revalidation of cached packuments here */)
+      .then(mani => {
+        // add _resolved and _integrity from dist object
+        const { dist } = mani
+        if (dist) {
+          this.resolved = mani._resolved = dist.tarball
+          mani._from = this.from
+          const distIntegrity = dist.integrity ? ssri.parse(dist.integrity)
+            : dist.shasum ? ssri.fromHex(dist.shasum, 'sha1', {...this.opts})
+            : null
+          if (distIntegrity) {
+            if (!this.integrity)
+              this.integrity = distIntegrity
+            else if (!this.integrity.match(distIntegrity)) {
+              // only bork if they have algos in common.
+              // otherwise we end up breaking if we have saved a sha512
+              // previously for the tarball, but the manifest only
+              // provides a sha1, which is possible for older publishes.
+              // Otherwise, this is almost certainly a case of holding it
+              // wrong, and will result in weird or insecure behavior
+              // later on when building package tree.
+              for (const algo of Object.keys(this.integrity)) {
+                if (distIntegrity[algo]) {
+                  throw Object.assign(new Error(
+                    `Integrity checksum failed when using ${algo}: `+
+                    `wanted ${this.integrity} but got ${distIntegrity}.`
+                  ), { code: 'EINTEGRITY' })
+                }
               }
-              await sigstore.verify(bundle, null, options)
-            } catch (e) {
-              throw Object.assign(new Error(
-                `${mani._id} failed to verify attestation: ${e.message}`
-              ), {
-                code: 'EATTESTATIONVERIFY',
-                predicateType,
-                keyid,
-                signature,
-                resolved: mani._resolved,
-                integrity: mani._integrity,
-              })
+              // made it this far, the integrity is worthwhile.  accept it.
+              // the setter here will take care of merging it into what we
+              // already had.
+              this.integrity = distIntegrity
             }
           }
-          mani._attestations = dist.attestations
-        } else {
-          mani._attestations = dist.attestations
         }
-      }
-    }
-
-    this.package = mani
-    return this.package
+        if (this.integrity)
+          mani._integrity = String(this.integrity)
+        this.package = rpj.normalize(mani)
+        return this.package
+      })
   }
 
   [_tarballFromResolved] () {