@pnpm/deps.compliance.commands 1101.1.11 → 1101.2.0

package/lib/audit/audit.d.ts

@@ -18,9 +18,13 @@ export type AuditOptions = Pick<UniversalOptions, 'dir'> & {
     registries: Registries;
     ignore?: string[];
     ignoreUnfixable?: boolean;
-} & Pick<Config, 'auditConfig' | 'auditLevel' | 'minimumReleaseAge' | 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'maxSockets' | 'noProxy' | 'strictSsl' | 'fetchRetries' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchRetryFactor' | 'fetchTimeout' | 'production' | 'dev' | 'overrides' | 'optional' | 'configByUri' | 'virtualStoreDirMaxLength' | 'workspaceDir'> & Pick<ConfigContext, 'rootProjectManifest' | 'rootProjectManifestDir'> & InstallCommandOptions;
+} & Pick<Config, 'auditConfig' | 'auditLevel' | 'minimumReleaseAge' | 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'maxSockets' | 'networkConcurrency' | 'noProxy' | 'strictSsl' | 'fetchRetries' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchRetryFactor' | 'fetchTimeout' | 'production' | 'dev' | 'overrides' | 'optional' | 'configByUri' | 'virtualStoreDirMaxLength' | 'workspaceDir'> & Pick<ConfigContext, 'rootProjectManifest' | 'rootProjectManifestDir'> & InstallCommandOptions;
 export declare function handler(opts: AuditOptions): Promise<{
     exitCode: number;
     output: string;
 }>;
+export declare function handler(opts: AuditOptions, params: string[]): Promise<{
+    exitCode: number;
+    output: string;
+}>;
 export declare function formatFixWithUpdateOutput(result: FixWithUpdateResult, auditReport: AuditReport): string;

package/lib/audit/audit.js

@@ -1,10 +1,8 @@
 import { docsUrl, TABLE_OPTIONS } from '@pnpm/cli.utils';
 import { types as allTypes } from '@pnpm/config.reader';
-import { WANTED_LOCKFILE } from '@pnpm/constants';
 import { audit, normalizeGhsaId } from '@pnpm/deps.compliance.audit';
 import { PnpmError } from '@pnpm/error';
 import { update } from '@pnpm/installing.commands';
-import { readEnvLockfile, readWantedLockfile } from '@pnpm/lockfile.fs';
 import { globalInfo } from '@pnpm/logger';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { table } from '@zkochan/table';
@@ -12,10 +10,12 @@ import chalk, {} from 'chalk';
 import enquirer from 'enquirer';
 import { pick, pickBy } from 'ramda';
 import { renderHelp } from 'render-help';
+import { createAuditNetworkOptions, loadAuditContext } from './auditContext.js';
 import { fix } from './fix.js';
 import { fixWithUpdate } from './fixWithUpdate.js';
 import { getAuditFixChoices } from './getAuditFixChoices.js';
 import { ignore } from './ignore.js';
+import { auditSignatures } from './signatures.js';
 const AUDIT_LEVEL_NUMBER = {
     info: 0,
     low: 1,
@@ -80,6 +80,15 @@ export function help() {
     return renderHelp({
         description: 'Checks for known security issues with the installed packages.',
         descriptionLists: [
+            {
+                title: 'Commands',
+                list: [
+                    {
+                        description: 'Verify ECDSA registry signatures for installed packages from registries that provide signing keys at /-/npm/v1/keys.',
+                        name: 'signatures',
+                    },
+                ],
+            },
             {
                 title: 'Options',
                 list: [
@@ -130,48 +139,43 @@ export function help() {
             },
         ],
         url: docsUrl('audit'),
-        usages: ['pnpm audit [options]'],
+        usages: ['pnpm audit [options]', 'pnpm audit signatures [options]'],
     });
 }
 const DEFAULT_FIX_METHOD = 'override';
-export async function handler(opts) {
-    const lockfileDir = opts.lockfileDir ?? opts.dir;
-    const lockfile = await readWantedLockfile(lockfileDir, { ignoreIncompatible: true });
-    if (lockfile == null) {
-        throw new PnpmError('AUDIT_NO_LOCKFILE', `No ${WANTED_LOCKFILE} found: Cannot audit a project without a lockfile`);
+export async function handler(opts, params = []) {
+    if (params.length > 0) {
+        if (params[0] === 'signatures') {
+            if (params.length > 1) {
+                throw new PnpmError('AUDIT_UNKNOWN_SUBCOMMAND', `Unknown audit subcommand: ${params.slice(0, 2).join(' ')}`);
+            }
+            return auditSignatures(opts);
+        }
+        throw new PnpmError('AUDIT_UNKNOWN_SUBCOMMAND', `Unknown audit subcommand: ${params[0]}`);
     }
-    const envLockfile = await readEnvLockfile(opts.workspaceDir ?? lockfileDir);
-    const include = {
-        dependencies: opts.production !== false,
-        devDependencies: opts.dev !== false,
-        optionalDependencies: opts.optional !== false,
-    };
+    const { envLockfile, include, lockfile } = await loadAuditContext(opts);
+    const networkOptions = createAuditNetworkOptions(opts);
     let auditReport;
     const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri, opts.registries?.default);
     try {
         auditReport = await audit(lockfile, getAuthHeader, {
             dispatcherOptions: {
-                ca: opts.ca,
-                cert: opts.cert,
-                httpProxy: opts.httpProxy,
-                httpsProxy: opts.httpsProxy,
-                key: opts.key,
-                localAddress: opts.localAddress,
-                maxSockets: opts.maxSockets,
-                noProxy: opts.noProxy,
-                strictSsl: opts.strictSsl,
-                timeout: opts.fetchTimeout,
+                ca: networkOptions.ca,
+                cert: networkOptions.cert,
+                httpProxy: networkOptions.httpProxy,
+                httpsProxy: networkOptions.httpsProxy,
+                key: networkOptions.key,
+                localAddress: networkOptions.localAddress,
+                maxSockets: networkOptions.maxSockets,
+                noProxy: networkOptions.noProxy,
+                strictSsl: networkOptions.strictSsl,
+                timeout: networkOptions.fetchTimeout,
             },
             envLockfile,
             include,
             registry: opts.registries.default,
-            retry: {
-                factor: opts.fetchRetryFactor,
-                maxTimeout: opts.fetchRetryMaxtimeout,
-                minTimeout: opts.fetchRetryMintimeout,
-                retries: opts.fetchRetries,
-            },
-            timeout: opts.fetchTimeout,
+            retry: networkOptions.retry,
+            timeout: networkOptions.fetchTimeout,
         });
     }
     catch (err) { // eslint-disable-line

package/lib/audit/auditContext.d.ts

@@ -0,0 +1,32 @@
+import type { EnvLockfile, LockfileObject } from '@pnpm/lockfile.types';
+import type { DependenciesField } from '@pnpm/types';
+import type { AuditOptions } from './audit.js';
+export interface AuditContext {
+    envLockfile: EnvLockfile | null;
+    include: {
+        [dependenciesField in DependenciesField]: boolean;
+    };
+    lockfile: LockfileObject;
+    lockfileDir: string;
+}
+export interface AuditNetworkOptions {
+    ca: AuditOptions['ca'];
+    cert: AuditOptions['cert'];
+    configByUri: AuditOptions['configByUri'];
+    fetchTimeout: AuditOptions['fetchTimeout'];
+    httpProxy: AuditOptions['httpProxy'];
+    httpsProxy: AuditOptions['httpsProxy'];
+    key: AuditOptions['key'];
+    localAddress: AuditOptions['localAddress'];
+    maxSockets: AuditOptions['maxSockets'];
+    noProxy: AuditOptions['noProxy'];
+    retry: {
+        factor: AuditOptions['fetchRetryFactor'];
+        maxTimeout: AuditOptions['fetchRetryMaxtimeout'];
+        minTimeout: AuditOptions['fetchRetryMintimeout'];
+        retries: AuditOptions['fetchRetries'];
+    };
+    strictSsl: AuditOptions['strictSsl'];
+}
+export declare function loadAuditContext(opts: AuditOptions): Promise<AuditContext>;
+export declare function createAuditNetworkOptions(opts: AuditOptions): AuditNetworkOptions;

package/lib/audit/auditContext.js

@@ -0,0 +1,43 @@
+import { WANTED_LOCKFILE } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
+import { readEnvLockfile, readWantedLockfile } from '@pnpm/lockfile.fs';
+export async function loadAuditContext(opts) {
+    const lockfileDir = opts.lockfileDir ?? opts.dir;
+    const lockfile = await readWantedLockfile(lockfileDir, { ignoreIncompatible: true });
+    if (lockfile == null) {
+        throw new PnpmError('AUDIT_NO_LOCKFILE', `No ${WANTED_LOCKFILE} found: Cannot audit a project without a lockfile`);
+    }
+    const envLockfile = await readEnvLockfile(opts.workspaceDir ?? lockfileDir);
+    return {
+        envLockfile,
+        include: {
+            dependencies: opts.production !== false,
+            devDependencies: opts.dev !== false,
+            optionalDependencies: opts.optional !== false,
+        },
+        lockfile,
+        lockfileDir,
+    };
+}
+export function createAuditNetworkOptions(opts) {
+    return {
+        ca: opts.ca,
+        cert: opts.cert,
+        configByUri: opts.configByUri,
+        fetchTimeout: opts.fetchTimeout,
+        httpProxy: opts.httpProxy,
+        httpsProxy: opts.httpsProxy,
+        key: opts.key,
+        localAddress: opts.localAddress,
+        maxSockets: opts.maxSockets,
+        noProxy: opts.noProxy,
+        retry: {
+            factor: opts.fetchRetryFactor,
+            maxTimeout: opts.fetchRetryMaxtimeout,
+            minTimeout: opts.fetchRetryMintimeout,
+            retries: opts.fetchRetries,
+        },
+        strictSsl: opts.strictSsl,
+    };
+}
+//# sourceMappingURL=auditContext.js.map

package/lib/audit/signatures.d.ts

@@ -0,0 +1,5 @@
+import type { AuditOptions } from './audit.js';
+export declare function auditSignatures(opts: AuditOptions): Promise<{
+    exitCode: number;
+    output: string;
+}>;

package/lib/audit/signatures.js

@@ -0,0 +1,69 @@
+import { TABLE_OPTIONS } from '@pnpm/cli.utils';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { lockfileToAuditRequest } from '@pnpm/deps.compliance.audit';
+import { verifySignatures } from '@pnpm/deps.security.signatures';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { table } from '@zkochan/table';
+import chalk from 'chalk';
+import { createAuditNetworkOptions, loadAuditContext } from './auditContext.js';
+export async function auditSignatures(opts) {
+    const { envLockfile, include, lockfile } = await loadAuditContext(opts);
+    const auditRequest = lockfileToAuditRequest(lockfile, { envLockfile, include });
+    const packages = Object.entries(auditRequest.request).flatMap(([name, versions]) => (versions.map((version) => ({ name, registry: pickRegistryForPackage(opts.registries, name), version }))));
+    if (packages.length === 0) {
+        throw new PnpmError('AUDIT_NO_PACKAGES', 'No installed packages found to audit');
+    }
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri, opts.registries?.default);
+    const networkOptions = createAuditNetworkOptions(opts);
+    const result = await verifySignatures(packages, getAuthHeader, {
+        ca: networkOptions.ca,
+        cert: networkOptions.cert,
+        configByUri: networkOptions.configByUri,
+        httpProxy: networkOptions.httpProxy,
+        httpsProxy: networkOptions.httpsProxy,
+        key: networkOptions.key,
+        localAddress: networkOptions.localAddress,
+        maxSockets: networkOptions.maxSockets,
+        networkConcurrency: opts.networkConcurrency,
+        noProxy: networkOptions.noProxy,
+        retry: networkOptions.retry,
+        strictSsl: networkOptions.strictSsl,
+        timeout: networkOptions.fetchTimeout,
+    });
+    return {
+        exitCode: result.invalid.length > 0 || result.missing.length > 0 ? 1 : 0,
+        output: opts.json ? JSON.stringify(result, null, 2) : renderSignatureVerificationResult(result),
+    };
+}
+function renderSignatureVerificationResult(result) {
+    const lines = [];
+    lines.push(`audited ${result.audited} package${result.audited === 1 ? '' : 's'}`);
+    lines.push('');
+    if (result.verified > 0) {
+        lines.push(`${result.verified} package${result.verified === 1 ? ' has a' : 's have'} ${chalk.bold('verified')} registry signature${result.verified === 1 ? '' : 's'}`);
+        lines.push('');
+    }
+    if (result.missing.length > 0) {
+        lines.push(`${result.missing.length} package${result.missing.length === 1 ? ' is' : 's are'} ${chalk.redBright('missing')} registry signature${result.missing.length === 1 ? '' : 's'} but the registry is providing signing keys:`);
+        lines.push('');
+        lines.push(table(result.missing.map(({ name, registry, version }) => [chalk.red(`${name}@${version}`), registry]), TABLE_OPTIONS));
+        lines.push('');
+    }
+    if (result.invalid.length > 0) {
+        lines.push(`${result.invalid.length} package${result.invalid.length === 1 ? ' has an' : 's have'} ${chalk.redBright('invalid')} registry signature${result.invalid.length === 1 ? '' : 's'}:`);
+        lines.push('');
+        lines.push(table(result.invalid.map(({ name, reason, registry, version }) => [chalk.red(`${name}@${version}`), registry, reason ?? 'Invalid registry signature']), TABLE_OPTIONS));
+        lines.push('');
+        lines.push(result.invalid.length === 1
+            ? 'Someone might have tampered with this package since it was published on the registry!'
+            : 'Someone might have tampered with these packages since they were published on the registry!');
+        lines.push('');
+    }
+    if (result.audited === 0 && result.invalid.length === 0 && result.missing.length === 0 && result.verified === 0) {
+        lines.push('No dependencies were installed from a registry with signing keys');
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=signatures.js.map

package/lib/sbom/sbom.d.ts

@@ -2,6 +2,7 @@ import { type Config, type ConfigContext } from '@pnpm/config.reader';
 export type SbomCommandOptions = {
     sbomFormat?: string;
     sbomType?: string;
+    sbomSpecVersion?: string;
     lockfileOnly?: boolean;
     sbomAuthors?: string;
     sbomSupplier?: string;

package/lib/sbom/sbom.js

@@ -18,6 +18,7 @@ export const cliOptionsTypes = () => ({
     recursive: Boolean,
     'sbom-format': String,
     'sbom-type': String,
+    'sbom-spec-version': String,
     'sbom-authors': String,
     'sbom-supplier': String,
     'lockfile-only': Boolean,
@@ -42,6 +43,10 @@ export function help() {
                         description: 'The component type for the root package (default: library)',
                         name: '--sbom-type <library|application>',
                     },
+                    {
+                        description: 'The CycloneDX specification version (1.5, 1.6, or 1.7; default: 1.7)',
+                        name: '--sbom-spec-version <version>',
+                    },
                     {
                         description: 'Only use lockfile data (skip reading from the store)',
                         name: '--lockfile-only',
@@ -90,6 +95,7 @@ export async function handler(opts, _params = []) {
         throw new PnpmError('SBOM_INVALID_FORMAT', `Invalid SBOM format "${opts.sbomFormat}". Use "cyclonedx" or "spdx".`);
     }
     const sbomType = validateSbomType(opts.sbomType);
+    const sbomSpecVersion = validateSbomSpecVersion(opts.sbomSpecVersion, format);
     const lockfile = await readWantedLockfile(opts.lockfileDir ?? opts.dir, {
         ignoreIncompatible: true,
     });
@@ -153,6 +159,7 @@ export async function handler(opts, _params = []) {
             lockfileOnly: opts.lockfileOnly,
             sbomAuthors: opts.sbomAuthors?.split(',').map((s) => s.trim()).filter(Boolean),
             sbomSupplier: opts.sbomSupplier,
+            specVersion: sbomSpecVersion,
         })
         : serializeSpdx(result);
     return { output, exitCode: 0 };
@@ -164,4 +171,19 @@ function validateSbomType(value) {
         return 'application';
     throw new PnpmError('SBOM_INVALID_TYPE', `Invalid SBOM type "${value}". Use "library" or "application".`);
 }
+// Versions whose schema is fully covered by what we currently emit
+// (e.g. metadata.lifecycles requires CycloneDX 1.5+).
+const SUPPORTED_CYCLONEDX_SPEC_VERSIONS = ['1.5', '1.6', '1.7'];
+function validateSbomSpecVersion(value, format) {
+    if (value == null)
+        return undefined;
+    if (format !== 'cyclonedx') {
+        throw new PnpmError('SBOM_SPEC_VERSION_UNSUPPORTED_FORMAT', 'The --sbom-spec-version option is only supported with --sbom-format cyclonedx.');
+    }
+    const normalized = value.trim();
+    if (!SUPPORTED_CYCLONEDX_SPEC_VERSIONS.includes(normalized)) {
+        throw new PnpmError('SBOM_INVALID_SPEC_VERSION', `Invalid CycloneDX spec version "${value}". Supported versions: ${SUPPORTED_CYCLONEDX_SPEC_VERSIONS.join(', ')}.`);
+    }
+    return normalized;
+}
 //# sourceMappingURL=sbom.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.commands",
-  "version": "1101.1.11",
+  "version": "1101.2.0",
   "description": "pnpm commands for audit, licenses, and sbom",
   "keywords": [
     "pnpm",
@@ -28,37 +28,39 @@
   ],
   "dependencies": {
     "@zkochan/table": "^2.0.1",
-    "chalk": "^5.6.2",
+    "chalk": "^5.6.0",
     "enquirer": "^2.4.1",
     "memoize": "^10.2.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
-    "semver": "^7.7.4",
-    "@pnpm/cli.command": "1100.0.1",
-    "@pnpm/cli.meta": "1100.0.2",
+    "semver": "^7.7.2",
     "@pnpm/cli.common-cli-options-help": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.2",
-    "@pnpm/config.reader": "1101.2.2",
+    "@pnpm/cli.meta": "1100.0.3",
+    "@pnpm/cli.utils": "1101.0.3",
+    "@pnpm/config.pick-registry-for-package": "1100.0.3",
+    "@pnpm/config.writer": "1100.0.7",
+    "@pnpm/config.reader": "1101.3.0",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.writer": "1100.0.6",
-    "@pnpm/deps.compliance.audit": "1101.0.5",
+    "@pnpm/cli.command": "1100.0.1",
     "@pnpm/deps.compliance.license-resolver": "1100.0.0",
-    "@pnpm/deps.compliance.license-scanner": "1100.0.9",
-    "@pnpm/deps.compliance.sbom": "1100.0.9",
+    "@pnpm/deps.compliance.audit": "1101.0.6",
+    "@pnpm/deps.compliance.sbom": "1100.1.0",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/installing.commands": "1100.1.12",
-    "@pnpm/lockfile.fs": "1100.0.6",
-    "@pnpm/lockfile.utils": "1100.0.6",
-    "@pnpm/lockfile.types": "1100.0.4",
-    "@pnpm/lockfile.walker": "1100.0.4",
-    "@pnpm/object.key-sorting": "1100.0.0",
-    "@pnpm/network.auth-header": "1100.0.1",
+    "@pnpm/deps.compliance.license-scanner": "1100.0.10",
+    "@pnpm/installing.commands": "1100.2.0",
+    "@pnpm/lockfile.fs": "1100.0.7",
+    "@pnpm/deps.security.signatures": "1101.1.0",
+    "@pnpm/lockfile.utils": "1100.0.7",
     "@pnpm/store.path": "1100.0.1",
-    "@pnpm/types": "1101.0.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.3"
+    "@pnpm/network.auth-header": "1100.0.2",
+    "@pnpm/types": "1101.1.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.4",
+    "@pnpm/lockfile.types": "1100.0.5",
+    "@pnpm/lockfile.walker": "1100.0.5",
+    "@pnpm/object.key-sorting": "1100.0.0"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1"
+    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -70,14 +72,14 @@
     "nock": "13.3.4",
     "read-yaml-file": "^3.0.0",
     "tempy": "3.0.0",
+    "@pnpm/deps.compliance.commands": "1101.2.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/deps.compliance.commands": "1101.1.11",
-    "@pnpm/pkg-manifest.reader": "1100.0.2",
-    "@pnpm/prepare": "1100.0.6",
-    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/prepare": "1100.0.7",
     "@pnpm/testing.command-defaults": "1100.0.1",
-    "@pnpm/testing.mock-agent": "1100.0.2",
-    "@pnpm/workspace.projects-filter": "1100.0.9"
+    "@pnpm/testing.mock-agent": "1100.0.3",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/workspace.projects-filter": "1100.0.10",
+    "@pnpm/pkg-manifest.reader": "1100.0.3"
   },
   "engines": {
     "node": ">=22.13"