@node-core/utils 4.3.0 → 5.0.0

package/bin/ncu-ci.js

@@ -113,6 +113,11 @@ const args = yargs(hideBin(process.argv))
           describe: 'ID of the PR',
           type: 'number'
         })
+        .positional('certify-safe', {
+          describe: 'If not provided, the command will reject PRs that have ' +
+                    'been pushed since the last review',
+          type: 'boolean'
+        })
         .option('owner', {
           default: '',
           describe: 'GitHub repository owner'
@@ -291,7 +296,7 @@ class RunPRJobCommand {
       this.cli.setExitCode(1);
       return;
     }
-    const jobRunner = new RunPRJob(cli, request, owner, repo, prid);
+    const jobRunner = new RunPRJob(cli, request, owner, repo, prid, this.argv.certifySafe);
     if (!(await jobRunner.start())) {
       this.cli.setExitCode(1);
       process.exitCode = 1;

package/components/git/security.js

@@ -1,5 +1,8 @@
 import CLI from '../../lib/cli.js';
-import SecurityReleaseSteward from '../../lib/prepare_security.js';
+import PrepareSecurityRelease from '../../lib/prepare_security.js';
+import UpdateSecurityRelease from '../../lib/update_security_release.js';
+import SecurityBlog from '../../lib/security_blog.js';
+import SecurityAnnouncement from '../../lib/security-announcement.js';
 
 export const command = 'security [options]';
 export const describe = 'Manage an in-progress security release or start a new one.';
@@ -8,6 +11,30 @@ const securityOptions = {
   start: {
     describe: 'Start security release process',
     type: 'boolean'
+  },
+  'update-date': {
+    describe: 'Updates the target date of the security release',
+    type: 'string'
+  },
+  'add-report': {
+    describe: 'Extracts data from HackerOne report and adds it into vulnerabilities.json',
+    type: 'string'
+  },
+  'remove-report': {
+    describe: 'Removes a report from vulnerabilities.json',
+    type: 'string'
+  },
+  'pre-release': {
+    describe: 'Create the pre-release announcement',
+    type: 'boolean'
+  },
+  'notify-pre-release': {
+    describe: 'Notify the community about the security release',
+    type: 'boolean'
+  },
+  'request-cve': {
+    describe: 'Request CVEs for a security release',
+    type: 'boolean'
   }
 };
 
@@ -15,21 +42,109 @@ let yargsInstance;
 
 export function builder(yargs) {
   yargsInstance = yargs;
-  return yargs.options(securityOptions).example(
-    'git node security --start',
-    'Prepare a security release of Node.js');
+  return yargs.options(securityOptions)
+    .example(
+      'git node security --start',
+      'Prepare a security release of Node.js')
+    .example(
+      'git node security --update-date=YYYY/MM/DD',
+      'Updates the target date of the security release'
+    )
+    .example(
+      'git node security --add-report=H1-ID',
+      'Fetches HackerOne report based on ID provided and adds it into vulnerabilities.json'
+    )
+    .example(
+      'git node security --remove-report=H1-ID',
+      'Removes the Hackerone report based on ID provided from vulnerabilities.json'
+    )
+    .example(
+      'git node security --pre-release' +
+      'Create the pre-release announcement on the Nodejs.org repo'
+    ).example(
+      'git node security --notify-pre-release' +
+      'Notifies the community about the security release'
+    )
+    .example(
+      'git node security --request-cve',
+      'Request CVEs for a security release of Node.js based on' +
+      ' the next-security-release/vulnerabilities.json'
+    );
 }
 
 export function handler(argv) {
   if (argv.start) {
     return startSecurityRelease(argv);
   }
+  if (argv['update-date']) {
+    return updateReleaseDate(argv);
+  }
+  if (argv['pre-release']) {
+    return createPreRelease(argv);
+  }
+  if (argv['add-report']) {
+    return addReport(argv);
+  }
+  if (argv['remove-report']) {
+    return removeReport(argv);
+  }
+  if (argv['notify-pre-release']) {
+    return notifyPreRelease(argv);
+  }
+  if (argv['request-cve']) {
+    return requestCVEs(argv);
+  }
   yargsInstance.showHelp();
 }
 
+async function removeReport(argv) {
+  const reportId = argv['remove-report'];
+  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
+  const cli = new CLI(logStream);
+  const update = new UpdateSecurityRelease(cli);
+  return update.removeReport(reportId);
+}
+
+async function addReport(argv) {
+  const reportId = argv['add-report'];
+  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
+  const cli = new CLI(logStream);
+  const update = new UpdateSecurityRelease(cli);
+  return update.addReport(reportId);
+}
+
+async function updateReleaseDate(argv) {
+  const releaseDate = argv['update-date'];
+  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
+  const cli = new CLI(logStream);
+  const update = new UpdateSecurityRelease(cli);
+  return update.updateReleaseDate(releaseDate);
+}
+
+async function createPreRelease() {
+  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
+  const cli = new CLI(logStream);
+  const preRelease = new SecurityBlog(cli);
+  return preRelease.createPreRelease();
+}
+
+async function requestCVEs() {
+  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
+  const cli = new CLI(logStream);
+  const hackerOneCve = new UpdateSecurityRelease(cli);
+  return hackerOneCve.requestCVEs();
+}
+
 async function startSecurityRelease(argv) {
   const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
   const cli = new CLI(logStream);
-  const release = new SecurityReleaseSteward(cli);
+  const release = new PrepareSecurityRelease(cli);
   return release.start();
 }
+
+async function notifyPreRelease() {
+  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
+  const cli = new CLI(logStream);
+  const preRelease = new SecurityAnnouncement(cli);
+  return preRelease.notifyPreRelease();
+}

package/lib/ci/run_ci.js

@@ -7,6 +7,7 @@ import {
 } from './ci_type_parser.js';
 import PRData from '../pr_data.js';
 import { debuglog } from '../verbosity.js';
+import PRChecker from '../pr_checker.js';
 
 export const CI_CRUMB_URL = `https://${CI_DOMAIN}/crumbIssuer/api/json`;
 const CI_PR_NAME = CI_TYPES.get(CI_TYPES_KEYS.PR).jobName;
@@ -16,13 +17,16 @@ const CI_V8_NAME = CI_TYPES.get(CI_TYPES_KEYS.V8).jobName;
 export const CI_V8_URL = `https://${CI_DOMAIN}/job/${CI_V8_NAME}/build`;
 
 export class RunPRJob {
-  constructor(cli, request, owner, repo, prid) {
+  constructor(cli, request, owner, repo, prid, certifySafe) {
     this.cli = cli;
     this.request = request;
     this.owner = owner;
     this.repo = repo;
     this.prid = prid;
     this.prData = new PRData({ prid, owner, repo }, cli, request);
+    this.certifySafe =
+      certifySafe ||
+      new PRChecker(cli, this.prData, request, {}).checkCommitsAfterReview();
   }
 
   async getCrumb() {
@@ -62,7 +66,13 @@ export class RunPRJob {
   }
 
   async start() {
-    const { cli } = this;
+    const { cli, certifySafe } = this;
+
+    if (!certifySafe) {
+      cli.error('Refusing to run CI on potentially unsafe PR');
+      return false;
+    }
+
     cli.startSpinner('Validating Jenkins credentials');
     const crumb = await this.getCrumb();
 

package/lib/github/templates/security-pre-release.md

@@ -0,0 +1,30 @@
+---
+date: %ANNOUNCEMENT_DATE%
+category: vulnerability
+title: %RELEASE_DATE% Security Releases
+slug: %SLUG%
+layout: blog-post
+author: The Node.js Project
+---
+
+# Summary
+
+The Node.js project will release new versions of the %AFFECTED_VERSIONS%
+releases lines on or shortly after, %RELEASE_DATE% in order to address:
+
+%VULNERABILITIES%
+%OPENSSL_UPDATES%
+## Impact
+
+%IMPACT%
+
+## Release timing
+
+Releases will be available on, or shortly after, %RELEASE_DATE%.
+
+## Contact and future updates
+
+The current Node.js security policy can be found at https://nodejs.org/en/security/.
+Please follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.
+
+Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization.

package/lib/pr_checker.js

@@ -534,6 +534,7 @@ export default class PRChecker {
     );
 
     if (reviewIndex === -1) {
+      cli.warn('No approving reviews found');
       return false;
     }