@pnpm/exe 11.22.0 → 11.24.0

package/dist/worker.js

@@ -6904,7 +6904,7 @@ function filesIncludeInstallScripts(filesIndex) {
 var LOCKFILE_MAJOR_VERSION = "9";
 var LOCKFILE_VERSION = `${LOCKFILE_MAJOR_VERSION}.0`;
 var ENGINE_NAME = `${process.platform};${process.arch};node${process.version.split(".")[0].substring(1)}`;
-var BUILTIN_NAMED_REGISTRIES = Object.freeze({
+var BUILTIN_REGISTRIES_BY_PREFIX = Object.freeze({
   gh: "https://npm.pkg.github.com/",
   npmjs: "https://registry.npmjs.org/"
 });
@@ -8040,7 +8040,12 @@ function contentPathFromHex(fileType, hex) {
 }
 
 // ../store/cafs/lib/checkPkgFilesIntegrity.js
-global["verifiedFileIntegrity"] = 0;
+var verifiedFileIntegrity = { files: 0, ms: 0 };
+function takeVerifiedFileIntegrity() {
+  const taken = verifiedFileIntegrity;
+  verifiedFileIntegrity = { files: 0, ms: 0 };
+  return taken;
+}
 function checkPkgFilesIntegrity(storeDir, pkgIndex) {
   const verifiedFilesCache = /* @__PURE__ */ new Set();
   const _checkFilesIntegrity = checkFilesIntegrity.bind(null, verifiedFilesCache, storeDir, pkgIndex.algo);
@@ -8129,7 +8134,7 @@ function verifyFile(filename, fstat, algorithm) {
       rimrafSync(filename);
       return false;
     }
-    const passed = verifyFileIntegrity(filename, { digest: fstat.digest, algorithm });
+    const passed = tallyVerifyFileIntegrity(filename, { digest: fstat.digest, algorithm });
     if (!passed) {
       lib_default.unlinkSync(filename);
     }
@@ -8137,21 +8142,39 @@ function verifyFile(filename, fstat, algorithm) {
   }
   return true;
 }
+function tallyVerifyFileIntegrity(filename, integrity) {
+  const startedAt = performance.now();
+  const data = readFileForIntegrity(filename);
+  if (data == null)
+    return false;
+  const passed = hashMatches(data, integrity);
+  if (passed == null)
+    return false;
+  verifiedFileIntegrity.files++;
+  verifiedFileIntegrity.ms += performance.now() - startedAt;
+  return passed;
+}
 function verifyFileIntegrity(filename, integrity) {
-  global["verifiedFileIntegrity"]++;
-  let data;
+  const data = readFileForIntegrity(filename);
+  if (data == null)
+    return false;
+  return hashMatches(data, integrity) ?? false;
+}
+function readFileForIntegrity(filename) {
   try {
-    data = lib_default.readFileSync(filename);
+    return lib_default.readFileSync(filename);
   } catch (err) {
     if (util4.types.isNativeError(err) && "code" in err && err.code === "ENOENT") {
-      return false;
+      return null;
     }
     throw err;
   }
+}
+function hashMatches(data, integrity) {
   try {
     return crypto3.hash(integrity.algorithm, data, "hex") === integrity.digest;
   } catch {
-    return false;
+    return null;
   }
 }
 function checkFile(filename, checkedAt) {
@@ -11811,6 +11834,7 @@ async function handleMessage(message) {
         if (!pkgFilesIndex) {
           parentPort.postMessage({
             status: "success",
+            verifiedFileIntegrity: takeVerifiedFileIntegrity(),
             value: {
               verified: false,
               pkgFilesIndex: null
@@ -11845,6 +11869,10 @@ If you want to ignore this issue, set strictStorePkgContentCheck to false in you
         parentPort.postMessage({
           status: "success",
           warnings,
+          // Store verification happens here, in the worker, but the
+          // install reports it from the main thread. Hand this worker's
+          // share back with the answer it belongs to.
+          verifiedFileIntegrity: takeVerifiedFileIntegrity(),
           value: {
             verified: verifyResult.passed,
             bundledManifest,
@@ -11871,6 +11899,10 @@ If you want to ignore this issue, set strictStorePkgContentCheck to false in you
   } catch (e) {
     parentPort.postMessage({
       status: "error",
+      // Drained here too: a request that hashed and then threw would
+      // otherwise leave its share in this worker, to be handed to
+      // whichever install asks next.
+      verifiedFileIntegrity: takeVerifiedFileIntegrity(),
       error: {
         code: e.code,
         message: e.message ?? e.toString(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/exe",
-  "version": "11.22.0",
+  "version": "11.24.0",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -35,17 +35,17 @@
     "detect-libc": "^2.1.2"
   },
   "optionalDependencies": {
-    "@pnpm/linux-arm64": "11.22.0",
-    "@pnpm/linux-x64": "11.22.0",
-    "@pnpm/linuxstatic-arm64": "11.22.0",
-    "@pnpm/linuxstatic-x64": "11.22.0",
-    "@pnpm/macos-arm64": "11.22.0",
-    "@pnpm/win-arm64": "11.22.0",
-    "@pnpm/win-x64": "11.22.0"
+    "@pnpm/linux-arm64": "11.24.0",
+    "@pnpm/linux-x64": "11.24.0",
+    "@pnpm/linuxstatic-arm64": "11.24.0",
+    "@pnpm/linuxstatic-x64": "11.24.0",
+    "@pnpm/macos-arm64": "11.24.0",
+    "@pnpm/win-arm64": "11.24.0",
+    "@pnpm/win-x64": "11.24.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/exe": "11.22.0",
+    "@pnpm/exe": "11.24.0",
     "@pnpm/jest-config": "1100.0.22",
     "@zkochan/cmd-shim": "^9.0.7",
     "execa": "npm:safe-execa@0.3.0"