@pnpm/deps.security.signatures 1102.0.0 → 1102.0.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @pnpm/deps.security.signatures
 
+## 1102.0.2
+
+### Patch Changes
+
+- `pnpm self-update`, `pnpm with`, and automatic package-manager version switching no longer wait through registry retry delays when a configured registry has no signatures and `registry.npmjs.org` is unavailable [#14483](https://github.com/pnpm/pnpm/issues/14483).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.4
+  - @pnpm/network.fetch@1100.1.15
+
+## 1102.0.1
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/network.fetch@1100.1.14
+
 ## 1102.0.0
 
 ### Major Changes

package/lib/verifySignatures.d.ts

@@ -104,7 +104,9 @@ export interface VerifyInstalledSignaturesOptions extends VerifySignaturesOption
      * Signatures are verified against the caller's trusted keys over the installed
      * integrity, so where the signature bytes come from does not affect what they
      * prove — a package passes only when some genuine signature validates over the
-     * bytes actually installed. See https://github.com/pnpm/pnpm/issues/13147.
+     * bytes actually installed. The fallback request is attempted once because it
+     * is an optional availability check after the primary registry already failed
+     * to provide a verifiable signature. See https://github.com/pnpm/pnpm/issues/13147.
      */
     fallbackRegistry?: string;
 }

package/lib/verifySignatures.js

@@ -16,7 +16,11 @@ export async function verifySignatures(packages, getAuthHeader, opts) {
     };
     // RegistriesByScope without signing keys are not counted as audited: there is no
     // registry trust root to verify against.
-    const packumentCache = new Map();
+    const packumentContext = {
+        getAuthHeader,
+        opts,
+        packumentCache: new Map(),
+    };
     const limit = pLimit(opts.networkConcurrency ?? 16);
     await Promise.all(packages.map((pkg) => limit(async () => {
         const keys = keysByRegistry.get(pkg.registry) ?? [];
@@ -25,7 +29,7 @@ export async function verifySignatures(packages, getAuthHeader, opts) {
         let version;
         let publishedAt;
         try {
-            const packument = await getPackument(pkg, getAuthHeader, opts, packumentCache);
+            const packument = await getPackument(pkg, packumentContext);
             if (!packument)
                 return;
             result.audited++;
@@ -107,13 +111,13 @@ async function fetchRegistryKeys(registry, getAuthHeader, opts) {
     // attestations are intentionally handled separately from this registry check.
     return body.keys.filter(({ keytype, scheme }) => keytype === 'ecdsa-sha2-nistp256' && scheme === 'ecdsa-sha2-nistp256');
 }
-async function getPackument(pkg, getAuthHeader, opts, packumentCache) {
-    const cacheKey = `${pkg.registry}:${pkg.name}`;
-    let packument = packumentCache.get(cacheKey);
+async function getPackument(pkg, ctx) {
+    const cacheKey = `${ctx.cacheNamespace ?? ''}:${pkg.registry}:${pkg.name}`;
+    let packument = ctx.packumentCache.get(cacheKey);
     if (!packument) {
         // Multiple installed versions share one full packument fetch.
-        packument = fetchPackument(pkg, getAuthHeader, opts);
-        packumentCache.set(cacheKey, packument);
+        packument = fetchPackument(pkg, ctx.getAuthHeader, ctx.opts);
+        ctx.packumentCache.set(cacheKey, packument);
     }
     return packument;
 }
@@ -267,6 +271,7 @@ export function getNpmSigningKeys() {
 }
 export async function verifyInstalledPackageSignatures(packages, trustedKeys, getAuthHeader, opts) {
     const ctx = {
+        cacheNamespace: 'primary',
         trustedKeys,
         getAuthHeader,
         opts,
@@ -301,7 +306,14 @@ async function findSignatureFailure(pkg, ctx) {
     const { fallbackRegistry } = ctx.opts;
     if (fallbackRegistry == null || equalRegistries(pkg.registry, fallbackRegistry))
         return primary;
-    const secondary = await attemptSignatureVerification(pkg, fallbackRegistry, ctx);
+    const secondary = await attemptSignatureVerification(pkg, fallbackRegistry, {
+        ...ctx,
+        cacheNamespace: 'fallback',
+        opts: {
+            ...ctx.opts,
+            retry: { ...ctx.opts.retry, retries: 0 },
+        },
+    });
     // A genuine signature validating over the installed integrity proves the
     // installed bytes regardless of which registry the primary attempt hit or
     // what it answered (e.g. a mirror serving stale signatures from a rotated
@@ -332,7 +344,7 @@ async function attemptSignatureVerification(pkg, registry, ctx) {
     const displayRegistry = redactAndSanitize(registry);
     let packument;
     try {
-        packument = await getPackument({ ...pkg, registry }, ctx.getAuthHeader, ctx.opts, ctx.packumentCache);
+        packument = await getPackument({ ...pkg, registry }, ctx);
     }
     catch (err) {
         // The fetch error may echo the request URL, credentials included.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.security.signatures",
-  "version": "1102.0.0",
+  "version": "1102.0.2",
   "description": "Verify package signatures from npm registries",
   "keywords": [
     "pnpm",
@@ -29,17 +29,17 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.1.3",
+    "@pnpm/error": "1100.1.4",
     "@pnpm/fetching.types": "1100.0.3",
-    "@pnpm/network.fetch": "1100.1.13",
-    "p-limit": "^7.3.1"
+    "@pnpm/network.fetch": "1100.1.15",
+    "p-limit": "^7.3.2"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.security.signatures": "1102.0.0",
+    "@pnpm/deps.security.signatures": "1102.0.2",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/testing.mock-agent": "1101.0.7"
   },