@pnpm/engine.runtime.node-resolver 1101.1.4 → 1101.1.6

package/lib/index.js

@@ -1,4 +1,4 @@
-import { fetchShasumsFile } from '@pnpm/crypto.shasums-file';
+import { fetchShasumsFile, fetchVerifiedNodeShasumsFile } from '@pnpm/crypto.shasums-file';
 import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
 import versionSelectorType from 'version-selector-type';
@@ -32,7 +32,7 @@ export async function resolveNodeRuntime(ctx, wantedDependency, opts) {
     if (!version) {
         throw new PnpmError('NODEJS_VERSION_NOT_FOUND', `Could not find a Node.js version that satisfies ${versionSpec}`);
     }
-    const variants = await readNodeAssets(ctx.fetchFromRegistry, nodeMirrorBaseUrl, version);
+    const variants = await readNodeAssets(ctx.fetchFromRegistry, nodeMirrorBaseUrl, version, releaseChannel);
     const range = version === versionSpec ? version : `^${version}`;
     return {
         id: `node@runtime:${version}`,
@@ -61,13 +61,20 @@ export async function resolveLatestNodeRuntime(ctx, query, _opts) {
         return {};
     return { latestManifest: { name: 'node', version } };
 }
-async function readNodeAssets(fetch, nodeMirrorBaseUrl, version) {
-    const assets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl, version, muslOnly: false });
+async function readNodeAssets(fetch, nodeMirrorBaseUrl, version, releaseChannel) {
+    // The mirror is repository-configurable, so the SHASUMS file's hashes are only
+    // trustworthy once its OpenPGP signature is verified against the Node.js
+    // release keys embedded in pnpm. Only the `release` channel publishes a signed
+    // SHASUMS256.txt; pre-release channels (rc, nightly, …) are unsigned by Node,
+    // so they cannot be verified this way.
+    const assets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl, version, muslOnly: false, verifySignature: releaseChannel === 'release' });
     // When using the default mirror, also fetch musl variants from unofficial-builds.nodejs.org,
-    // since musl builds are not available on the official mirror.
+    // since musl builds are not available on the official mirror. That URL is hardcoded (not
+    // repository-configurable) and signed by a different (unofficial-builds) key, so it is trusted
+    // over TLS rather than verified against the official release keys.
     if (nodeMirrorBaseUrl === DEFAULT_NODE_MIRROR_BASE_URL) {
         try {
-            const muslAssets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl: UNOFFICIAL_NODE_MIRROR_BASE_URL, version, muslOnly: true });
+            const muslAssets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl: UNOFFICIAL_NODE_MIRROR_BASE_URL, version, muslOnly: true, verifySignature: false });
             assets.push(...muslAssets);
         }
         catch {
@@ -77,9 +84,11 @@ async function readNodeAssets(fetch, nodeMirrorBaseUrl, version) {
     return assets;
 }
 async function readNodeAssetsFromMirror(fetch, opts) {
-    const { nodeMirrorBaseUrl, version, muslOnly } = opts;
+    const { nodeMirrorBaseUrl, version, muslOnly, verifySignature } = opts;
     const integritiesFileUrl = `${nodeMirrorBaseUrl}v${version}/SHASUMS256.txt`;
-    const shasumsFileItems = await fetchShasumsFile(fetch, integritiesFileUrl);
+    const shasumsFileItems = verifySignature
+        ? await fetchVerifiedNodeShasumsFile(fetch, integritiesFileUrl)
+        : await fetchShasumsFile(fetch, integritiesFileUrl);
     const escaped = version.replace(/\\/g, '\\\\').replace(/\./g, '\\.');
     // The second capture group uses [^.-]+ to stop at a dash, so that the optional
     // third group can capture the '-musl' suffix separately (e.g. 'x64' + '-musl').

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/engine.runtime.node-resolver",
-  "version": "1101.1.4",
+  "version": "1101.1.6",
   "description": "Resolves a Node.js version specifier to an exact Node.js version",
   "keywords": [
     "pnpm",
@@ -31,18 +31,18 @@
   "dependencies": {
     "semver": "^7.8.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.reader": "1101.6.0",
-    "@pnpm/crypto.shasums-file": "1100.0.1",
+    "@pnpm/config.reader": "1101.8.0",
     "@pnpm/fetching.types": "1100.0.1",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/resolving.resolver-base": "1100.4.0",
-    "@pnpm/types": "1101.3.0"
+    "@pnpm/crypto.shasums-file": "1100.1.0",
+    "@pnpm/types": "1101.3.1",
+    "@pnpm/resolving.resolver-base": "1100.4.1"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/semver": "7.7.1",
-    "@pnpm/engine.runtime.node-resolver": "1101.1.4",
-    "@pnpm/network.fetch": "1100.1.0"
+    "@pnpm/engine.runtime.node-resolver": "1101.1.6",
+    "@pnpm/network.fetch": "1100.1.2"
   },
   "engines": {
     "node": ">=22.13"