@pnpm/deps.security.signatures 1101.2.9 → 1101.3.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @pnpm/deps.security.signatures
 
+## 1101.3.0
+
+### Minor Changes
+
+- Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip `dist.signatures`) no longer break the automatic `packageManager` version switch and `pnpm self-update` [#13147](https://github.com/pnpm/pnpm/issues/13147). When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from `registry.npmjs.org` and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a `shasum`), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch.
+
+## 1101.2.10
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.1
+  - @pnpm/network.fetch@1100.1.11
+
 ## 1101.2.9
 
 ### Patch Changes

package/lib/verifySignatures.d.ts

@@ -56,11 +56,21 @@ export interface InstalledPackageToVerify {
  * - `unreachable`: the trust root could not be consulted (registry advertised no
  *   signing keys, or the network request failed) — typically transient/offline,
  *   not evidence of tampering.
+ * - `uncovered`: the installed integrity is not a sha512 hash (e.g. a sha1 pin
+ *   from a registry that only publishes `shasum`), so no npm registry signature
+ *   can ever validate over it — verification is impossible by construction,
+ *   not evidence of tampering.
  */
-export type SignatureFailureCategory = 'invalid' | 'absent' | 'unreachable';
+export type SignatureFailureCategory = 'invalid' | 'absent' | 'unreachable' | 'uncovered';
 export interface InstalledSignatureFailure {
     name: string;
     version: string;
+    /**
+     * The registry the package was installed from (see
+     * {@link InstalledPackageToVerify.registry}), with inline `user:pass@`
+     * credentials and control characters stripped so the failure is safe to print or log.
+     */
+    registry: string;
     reason: string;
     category: SignatureFailureCategory;
 }
@@ -86,4 +96,27 @@ export interface InstalledSignatureVerificationResult {
  * A package counts as a failure when the package is unsigned/unpublished, or
  * when a signature is present but does not validate over the installed bytes.
  */
-export declare function verifyInstalledPackageSignatures(packages: InstalledPackageToVerify[], trustedKeys: RegistryKey[], getAuthHeader: GetAuthHeader, opts: VerifySignaturesOptions): Promise<InstalledSignatureVerificationResult>;
+export interface VerifyInstalledSignaturesOptions extends VerifySignaturesOptions {
+    /**
+     * A registry to consult for signature metadata when a package's own registry
+     * cannot provide a verifiable signature (its packument omits `dist.signatures`,
+     * as private mirrors commonly do, or carries only a stale/broken one).
+     * Signatures are verified against the caller's trusted keys over the installed
+     * integrity, so where the signature bytes come from does not affect what they
+     * prove — a package passes only when some genuine signature validates over the
+     * bytes actually installed. See https://github.com/pnpm/pnpm/issues/13147.
+     */
+    fallbackRegistry?: string;
+}
+export declare function verifyInstalledPackageSignatures(packages: InstalledPackageToVerify[], trustedKeys: RegistryKey[], getAuthHeader: GetAuthHeader, opts: VerifyInstalledSignaturesOptions): Promise<InstalledSignatureVerificationResult>;
+/**
+ * Whether two registry URLs address the same registry. URL-equivalent forms
+ * must compare equal — hosts are case-insensitive and default ports are
+ * implied — or a canonical registry written as e.g.
+ * `https://Registry.NPMJS.org:443/` would be misclassified as a different,
+ * non-canonical one, weakening fail-closed decisions keyed on whether the
+ * registry is the canonical one. Inline `user:pass@` credentials are auth
+ * material, not identity, so they are stripped before comparing for the same
+ * reason.
+ */
+export declare function equalRegistries(a: string, b: string): boolean;

package/lib/verifySignatures.js

@@ -1,7 +1,7 @@
 import crypto from 'node:crypto';
 import url from 'node:url';
 import util from 'node:util';
-import { PnpmError } from '@pnpm/error';
+import { PnpmError, redactAndSanitize } from '@pnpm/error';
 import { createFetchFromRegistry } from '@pnpm/network.fetch';
 import pLimit from 'p-limit';
 import { NPM_SIGNING_KEYS } from './npmSigningKeys.js';
@@ -265,50 +265,84 @@ function sortIssue(a, b) {
 export function getNpmSigningKeys() {
     return NPM_SIGNING_KEYS.map((k) => ({ ...k }));
 }
-/**
- * Verifies that the bytes installed on disk are exactly what the registry
- * signed for `name@version`. The signed message is built from the
- * caller-supplied installed {@link InstalledPackageToVerify.integrity}, not
- * from the integrity in the freshly-fetched packument — so if the integrity
- * on disk was tampered with (or fetched from a different registry), the
- * registry's signature will not validate over it.
- *
- * Signatures are verified against the caller-supplied `trustedKeys` (npm's
- * embedded public keys, see {@link getNpmSigningKeys}) rather than keys fetched
- * from a registry — so a registry the caller cannot vouch for cannot answer with
- * its own key pair. The packument (which carries the signatures) is fetched from
- * each package's own registry; an npm mirror works transparently because it
- * proxies the same signed packument.
- *
- * A package counts as a failure when the package is unsigned/unpublished, or
- * when a signature is present but does not validate over the installed bytes.
- */
 export async function verifyInstalledPackageSignatures(packages, trustedKeys, getAuthHeader, opts) {
-    const packumentCache = new Map();
+    const ctx = {
+        trustedKeys,
+        getAuthHeader,
+        opts,
+        packumentCache: new Map(),
+    };
     const limit = pLimit(opts.networkConcurrency ?? 16);
     const failures = [];
     await Promise.all(packages.map((pkg) => limit(async () => {
-        const failure = await findSignatureFailure(pkg, trustedKeys, getAuthHeader, opts, packumentCache);
+        const failure = await findSignatureFailure(pkg, ctx);
         if (failure != null) {
-            failures.push({ name: pkg.name, version: pkg.version, ...failure });
+            failures.push({ name: pkg.name, version: pkg.version, registry: redactAndSanitize(pkg.registry), ...failure });
         }
     })));
     failures.sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
     return { verified: failures.length === 0, failures };
 }
-async function findSignatureFailure(pkg, trustedKeys, getAuthHeader, opts, packumentCache) {
+async function findSignatureFailure(pkg, ctx) {
+    // npm registry signatures sign `name@version:integrity` with the sha512
+    // integrity the registry published. An installed integrity in any other form
+    // (a sha1 pin converted from `shasum` by a registry that publishes no
+    // `integrity`) can never validate against a genuine signature, so verifying
+    // it would misreport an authentic release as tampered with.
+    if (!pkg.integrity.startsWith('sha512-')) {
+        return {
+            reason: `${pkg.name}@${pkg.version} is pinned by a non-sha512 integrity, which npm registry signatures cannot cover`,
+            category: 'uncovered',
+        };
+    }
+    const primary = await attemptSignatureVerification(pkg, pkg.registry, ctx);
+    if (primary == null)
+        return undefined;
+    const { fallbackRegistry } = ctx.opts;
+    if (fallbackRegistry == null || equalRegistries(pkg.registry, fallbackRegistry))
+        return primary;
+    const secondary = await attemptSignatureVerification(pkg, fallbackRegistry, ctx);
+    // A genuine signature validating over the installed integrity proves the
+    // installed bytes regardless of which registry the primary attempt hit or
+    // what it answered (e.g. a mirror serving stale signatures from a rotated
+    // key), so a fallback pass is a pass.
+    if (secondary == null)
+        return undefined;
+    // A well-formed signature that fails to validate is a tamper signal from
+    // either source; surface it over the softer categories.
+    if (primary.category === 'invalid')
+        return primary;
+    if (secondary.category !== 'unreachable')
+        return secondary;
+    // The primary registry had no usable signature (a mirror commonly serves
+    // none) and the fallback could not be consulted — nothing suspicious was
+    // observed, the signature was simply unobtainable.
+    return {
+        reason: `${primary.reason}; the fallback registry (${redactAndSanitize(fallbackRegistry)}) could not be consulted either: ${secondary.reason}`,
+        category: 'unreachable',
+    };
+}
+/**
+ * Verifies `pkg`'s installed integrity against the signatures the packument on
+ * `registry` carries. Returns `undefined` on success, otherwise the failure.
+ */
+async function attemptSignatureVerification(pkg, registry, ctx) {
+    // Registry URLs may carry inline `user:pass@` credentials, and the reasons
+    // built here end up in error messages and warnings.
+    const displayRegistry = redactAndSanitize(registry);
     let packument;
     try {
-        packument = await getPackument(pkg, getAuthHeader, opts, packumentCache);
+        packument = await getPackument({ ...pkg, registry }, ctx.getAuthHeader, ctx.opts, ctx.packumentCache);
     }
     catch (err) {
-        return { reason: util.types.isNativeError(err) ? err.message : String(err), category: 'unreachable' };
+        // The fetch error may echo the request URL, credentials included.
+        return { reason: redactAndSanitize(util.types.isNativeError(err) ? err.message : String(err)), category: 'unreachable' };
     }
     if (!packument)
-        return { reason: `${pkg.name} is not published on ${pkg.registry}`, category: 'absent' };
+        return { reason: `${pkg.name} is not published on ${displayRegistry}`, category: 'absent' };
     const version = packument.versions?.[pkg.version];
     if (!version)
-        return { reason: `${pkg.name}@${pkg.version} was not found on ${pkg.registry}`, category: 'absent' };
+        return { reason: `${pkg.name}@${pkg.version} was not found on ${displayRegistry}`, category: 'absent' };
     const rawSignatures = version.dist?.signatures;
     if (rawSignatures != null && !Array.isArray(rawSignatures)) {
         return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
@@ -318,11 +352,34 @@ async function findSignatureFailure(pkg, trustedKeys, getAuthHeader, opts, packu
         return { reason: `malformed registry signatures metadata for ${pkg.name}@${pkg.version}`, category: 'absent' };
     }
     if (signatures.length === 0) {
-        return { reason: `${pkg.name}@${pkg.version} has no registry signature`, category: 'absent' };
+        return { reason: `${pkg.name}@${pkg.version} has no registry signature on ${displayRegistry}`, category: 'absent' };
     }
     // The message is built from the installed integrity, so a signature only
     // validates when the installed bytes match what the registry signed.
-    const issue = verifyPackageSignatures({ ...pkg, integrity: pkg.integrity, publishedAt: packument.time?.[pkg.version], signatures }, trustedKeys);
+    const issue = verifyPackageSignatures({ ...pkg, integrity: pkg.integrity, publishedAt: packument.time?.[pkg.version], signatures }, ctx.trustedKeys);
     return issue == null ? undefined : { reason: issue.reason ?? 'invalid registry signature', category: 'invalid' };
 }
+/**
+ * Whether two registry URLs address the same registry. URL-equivalent forms
+ * must compare equal — hosts are case-insensitive and default ports are
+ * implied — or a canonical registry written as e.g.
+ * `https://Registry.NPMJS.org:443/` would be misclassified as a different,
+ * non-canonical one, weakening fail-closed decisions keyed on whether the
+ * registry is the canonical one. Inline `user:pass@` credentials are auth
+ * material, not identity, so they are stripped before comparing for the same
+ * reason.
+ */
+export function equalRegistries(a, b) {
+    return normalizeRegistryUrl(a) === normalizeRegistryUrl(b);
+}
+function normalizeRegistryUrl(registry) {
+    const withSlash = redactAndSanitize(registry.endsWith('/') ? registry : `${registry}/`);
+    try {
+        // URL normalization lowercases the host and drops a default port.
+        return new url.URL(withSlash).toString().toLowerCase();
+    }
+    catch {
+        return withSlash.toLowerCase();
+    }
+}
 //# sourceMappingURL=verifySignatures.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.security.signatures",
-  "version": "1101.2.9",
+  "version": "1101.3.0",
   "description": "Verify package signatures from npm registries",
   "keywords": [
     "pnpm",
@@ -29,9 +29,9 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.1.0",
+    "@pnpm/error": "1100.1.1",
     "@pnpm/fetching.types": "1100.0.3",
-    "@pnpm/network.fetch": "1100.1.10",
+    "@pnpm/network.fetch": "1100.1.11",
     "p-limit": "^7.3.1"
   },
   "peerDependencies": {
@@ -39,7 +39,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.security.signatures": "1101.2.9",
+    "@pnpm/deps.security.signatures": "1101.3.0",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/testing.mock-agent": "1101.0.7"
   },