@pnpm/crypto.shasums-file 1100.2.7 → 1100.2.8

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/crypto.shasums-file
 
+## 1100.2.8
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/crypto.hash@1100.0.8
+  - @pnpm/error@1100.2.2
+
 ## 1100.2.7
 
 ### Patch Changes

package/lib/diskCache.d.ts

@@ -18,8 +18,7 @@
  *   `fetchVerifiedNodeShasumsFileCached`), so a pre-seeded entry is only
  *   accepted if it is a genuine release body.
  * - Unverified entries are trusted on read, which grants a project nothing
- *   new: the unsigned channels' mirrors are already project-configurable
- *   (their bodies were project-controllable before the cache existed), and
+ *   new: the unsigned channels' mirrors are already project-configurable, and
  *   the musl list's download URLs are derived from the hardcoded
  *   unofficial-builds base, never from the cached body.
  * - Authenticated responses bypass this cache because the URL does not

package/lib/diskCache.js

@@ -21,8 +21,7 @@ import { threadId } from 'node:worker_threads';
  *   `fetchVerifiedNodeShasumsFileCached`), so a pre-seeded entry is only
  *   accepted if it is a genuine release body.
  * - Unverified entries are trusted on read, which grants a project nothing
- *   new: the unsigned channels' mirrors are already project-configurable
- *   (their bodies were project-controllable before the cache existed), and
+ *   new: the unsigned channels' mirrors are already project-configurable, and
  *   the musl list's download URLs are derived from the hardcoded
  *   unofficial-builds base, never from the cached body.
  * - Authenticated responses bypass this cache because the URL does not

package/lib/verifyNodeShasums.js

@@ -93,14 +93,11 @@ async function signaturePacketVerifies(signaturePacket, keyPackets, literalDataP
     if (keyPacket == null)
         return false;
     try {
-        // Resolves on a valid signature, rejects otherwise. This is the raw
-        // cryptographic check against a pinned key — no web-of-trust / key-expiry
-        // evaluation, which is what `openpgp.verify` would (incorrectly here) apply.
+        // Resolves on a valid signature, rejects otherwise.
         await signaturePacket.verify(keyPacket, signaturePacket.signatureType, literalDataPacket, signaturePacket.created ?? undefined, true);
         return true;
     }
     catch {
-        // Not valid under this key/packet.
         return false;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/crypto.shasums-file",
-  "version": "1100.2.7",
+  "version": "1100.2.8",
   "description": "Utils for working with shasums files",
   "keywords": [
     "pnpm",
@@ -29,15 +29,15 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/crypto.hash": "1100.0.7",
-    "@pnpm/error": "1100.2.1",
+    "@pnpm/crypto.hash": "1100.0.8",
+    "@pnpm/error": "1100.2.2",
     "@pnpm/fetching.types": "1100.0.3",
-    "openpgp": "^6.3.1"
+    "openpgp": "^6.3.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@openpgp/web-stream-tools": "0.3.1",
-    "@pnpm/crypto.shasums-file": "1100.2.7"
+    "@pnpm/crypto.shasums-file": "1100.2.8"
   },
   "engines": {
     "node": ">=22.13"