@pnpm/exe 12.0.0-rc.0 → 12.0.0-rc.10

package/dist/node_modules/get-pnpm/lib/verifySignature.js

@@ -0,0 +1,51 @@
+import { createVerify } from 'node:crypto';
+import { NPM_SIGNING_KEYS } from './npmSigningKeys.js';
+/**
+ * Checks the registry's signature over a package's identity and checksum.
+ *
+ * The registry serves both the tarball and the checksum, so a checksum taken
+ * from it proves nothing on its own. This is what makes it worth anything: the
+ * signature is made with a key the registry publishes but the download host
+ * cannot mint, and the trusted copy of that key ships inside this package.
+ *
+ * @throws if the package is unsigned, signed with a key that isn't trusted or
+ * has expired, or the signature does not verify.
+ */
+export function verifyRegistrySignature(opts) {
+    const pkg = `${opts.name}@${opts.version}`;
+    const signatures = opts.signatures ?? [];
+    if (signatures.length === 0) {
+        throw new Error(`${pkg} carries no npm registry signature, so it cannot be verified.`);
+    }
+    // Pick the signature by key rather than by position. A package can carry
+    // several, in no guaranteed order, and across a rotation one of them can be
+    // from a key this installer does not pin — which is not a reason to refuse a
+    // package that another, pinned key also signed.
+    const keys = opts.keys ?? NPM_SIGNING_KEYS;
+    const match = signatures
+        .map((signature) => ({ signature, key: keys.find(({ keyid }) => keyid === signature.keyid) }))
+        .find((candidate) => candidate.key != null);
+    if (match?.key == null) {
+        throw new Error(`${pkg} is signed with an unexpected npm key (${signatures.map(({ keyid }) => keyid).join(', ')}).
+
+If npm has rotated its signing key, this installer needs updating.
+Until then, install pnpm another way: https://pnpm.io/installation`);
+    }
+    const { signature, key } = match;
+    if (key.expires != null) {
+        const expires = new Date(key.expires).getTime();
+        // An unreadable date must not read as "never expires".
+        if (Number.isNaN(expires)) {
+            throw new Error(`${pkg} is signed with an npm key whose expiry date cannot be read (${key.expires}).`);
+        }
+        if (expires < (opts.now ?? new Date()).getTime()) {
+            throw new Error(`${pkg} is signed with an npm key that expired on ${key.expires}.`);
+        }
+    }
+    // Registry signatures cover the package identity and its content hash.
+    const message = `${pkg}:${opts.integrity}`;
+    const publicKey = `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`;
+    if (!createVerify('SHA256').update(message).verify(publicKey, signature.sig, 'base64')) {
+        throw new Error(`The npm registry signature for ${pkg} is not valid. Refusing to install.`);
+    }
+}

package/dist/node_modules/get-pnpm/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "get-pnpm",
+  "version": "0.0.3",
+  "description": "Installs pnpm as a standalone executable",
+  "keywords": [
+    "pnpm",
+    "install",
+    "installer"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/get.pnpm.io/tree/main/get-pnpm"
+  },
+  "homepage": "https://github.com/pnpm/get.pnpm.io/tree/main/get-pnpm#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/get.pnpm.io/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map",
+    "bin"
+  ],
+  "bin": {
+    "get-pnpm": "bin/get-pnpm.js"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "typescript": "^5.9.3"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc && node --test test/*.test.ts"
+  }
+}

package/dist/node_modules/node-gyp/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "12.4.0"
+    ".": "12.3.0"
 }

package/dist/node_modules/node-gyp/gyp/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "0.22.2"
+    ".": "0.22.1"
 }

package/dist/node_modules/node-gyp/gyp/pyproject.toml

@@ -4,20 +4,20 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gyp-next"
-version = "0.22.2"
+version = "0.22.1"
 authors = [
   { name="Node.js contributors", email="ryzokuken@disroot.org" },
 ]
 description = "A fork of the GYP build system for use in the Node.js projects"
 readme = "README.md"
-license = "BSD-3-Clause"
-license-files = ["LICENSE"]
+license = { file="LICENSE" }
 requires-python = ">=3.9"
-dependencies = ["packaging>=24.0", "setuptools>=77.0.3"]
+dependencies = ["packaging>=24.0", "setuptools>=69.5.1"]
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Environment :: Console",
     "Intended Audience :: Developers",
+    "License :: OSI Approved :: BSD License",
     "Natural Language :: English",
     "Programming Language :: Python",
     "Programming Language :: Python :: 3",

package/dist/node_modules/node-gyp/lib/download.js

@@ -1,5 +1,5 @@
 const { Readable } = require('stream')
-const { Agent, EnvHttpProxyAgent, RetryAgent, fetch } = require('undici')
+const { EnvHttpProxyAgent } = require('undici')
 const { promises: fs } = require('graceful-fs')
 const log = require('./log')
 
@@ -48,7 +48,7 @@ async function createDispatcher (gyp) {
   const env = process.env
   const hasProxyEnv = env.http_proxy || env.HTTP_PROXY || env.https_proxy || env.HTTPS_PROXY
   if (!gyp.opts.proxy && !gyp.opts.cafile && !hasProxyEnv) {
-    return new RetryAgent(new Agent(), { maxRetries: 3 })
+    return undefined
   }
 
   const opts = {}
@@ -69,7 +69,7 @@ async function createDispatcher (gyp) {
   if (gyp.opts.noproxy) {
     opts.noProxy = gyp.opts.noproxy
   }
-  return new RetryAgent(new EnvHttpProxyAgent(opts), { maxRetries: 3 })
+  return new EnvHttpProxyAgent(opts)
 }
 
 async function readCAFile (filename) {

package/dist/node_modules/node-gyp/package.json

@@ -11,7 +11,7 @@
     "bindings",
     "gyp"
   ],
-  "version": "12.4.0",
+  "version": "12.3.0",
   "installVersion": 11,
   "author": "Nathan Rajlich <nathan@tootallnate.net> (http://tootallnate.net)",
   "repository": {

package/install.js

@@ -10,37 +10,20 @@
 // relinked); on Windows the native binary is hardlinked onto each and
 // self-detects its launch name to inject `dlx` (see `argv_with_alias_subcommand`
 // in the cli crate).
+//
+// Corepack runs no lifecycle scripts, so it never gets here; it enters through
+// `bin/pnpm.mjs` instead.
 import console from 'node:console'
 import fs from 'node:fs'
-import { createRequire } from 'node:module'
 import path from 'node:path'
 import process from 'node:process'
-import { fileURLToPath } from 'node:url'
-
-const require = createRequire(import.meta.url)
-const ownDir = path.dirname(fileURLToPath(import.meta.url))
-const { platform, arch } = process
-
-const PLATFORMS = {
-  win32: {
-    x64: '@pnpm/exe.win32-x64/pnpm.exe',
-    arm64: '@pnpm/exe.win32-arm64/pnpm.exe',
-  },
-  darwin: {
-    x64: '@pnpm/exe.darwin-x64/pnpm',
-    arm64: '@pnpm/exe.darwin-arm64/pnpm',
-  },
-  linux: {
-    x64: {
-      glibc: '@pnpm/exe.linux-x64/pnpm',
-      musl: '@pnpm/exe.linux-x64-musl/pnpm',
-    },
-    arm64: {
-      glibc: '@pnpm/exe.linux-arm64/pnpm',
-      musl: '@pnpm/exe.linux-arm64-musl/pnpm',
-    },
-  },
-}
+import {
+  getBinCandidates,
+  readWrapperManifest,
+  resolveInstalledBinary,
+  splitBinSpecifier,
+  wrapperDir,
+} from './native-binary.mjs'
 
 const BIN_NAMES = ['pnpm', 'pn', 'pnpx', 'pnx']
 
@@ -50,45 +33,37 @@ function setup () {
   // The committed manifest has no `optionalDependencies`; generate-packages.mjs
   // adds them at release time. Without them this is the monorepo checkout, where
   // the wrapper is a workspace package and there is no native binary to link.
-  if (readOwnManifest().optionalDependencies == null) {
+  if (readWrapperManifest().optionalDependencies == null) {
     return
   }
 
   const candidates = getBinCandidates()
   if (candidates.length === 0) {
-    fail(`pnpm does not ship a prebuilt binary for ${platform}-${arch}.`)
+    fail(`pnpm does not ship a prebuilt binary for ${process.platform}-${process.arch}.`)
   }
 
-  // Use whichever platform package the package manager installed: it already
-  // filtered by `os`/`cpu`/`libc`, more reliable than re-deriving the host.
-  let nativeBinary
-  for (const target of candidates) {
-    try {
-      nativeBinary = require.resolve(target)
-      break
-    } catch {}
-  }
+  const nativeBinary = resolveInstalledBinary()
   if (nativeBinary == null) {
-    const pkgName = candidates[0].split('/').slice(0, 2).join('/')
+    const { packageName } = splitBinSpecifier(candidates[0])
     fail(
-      `The "${pkgName}" package is not installed, so pnpm has no native binary to run.\n` +
+      `The "${packageName}" package is not installed, so pnpm has no native binary to run.\n` +
       'If your package manager skipped optional dependencies or blocked build scripts, ' +
       'enable them and reinstall.'
     )
   }
 
-  if (platform === 'win32') {
+  if (process.platform === 'win32') {
     const newBin = {}
     for (const name of BIN_NAMES) {
       // The existing shim points at the no-ext file, so it must become the
       // binary; the `.exe` twin + bin rewrite are for shims generated later.
-      placeBinary(nativeBinary, path.join(ownDir, `${name}.exe`))
-      placeBinary(nativeBinary, path.join(ownDir, name))
+      placeBinary(nativeBinary, path.join(wrapperDir, `${name}.exe`))
+      placeBinary(nativeBinary, path.join(wrapperDir, name))
       newBin[name] = `${name}.exe`
     }
     rewriteBin(newBin)
   } else {
-    placeBinary(nativeBinary, path.join(ownDir, 'pnpm'), 0o755)
+    placeBinary(nativeBinary, path.join(wrapperDir, 'pnpm'), 0o755)
   }
 }
 
@@ -126,7 +101,7 @@ function placeBinary (nativeBinary, destPath, mode) {
 }
 
 function rewriteBin (binMap) {
-  const pkgJsonPath = path.join(ownDir, 'package.json')
+  const pkgJsonPath = path.join(wrapperDir, 'package.json')
   // Temp file + rename, not in-place: package.json is hard-linked from the store.
   const tempPath = `${pkgJsonPath}.pnpm-tmp`
   try {
@@ -145,55 +120,3 @@ function fail (message) {
   console.error(message)
   process.exit(1)
 }
-
-// A successful read with no optionalDependencies is the dev checkout (setup
-// no-ops there); a read/parse failure is a corrupt published package and must
-// not be silently swallowed into that same no-op path.
-function readOwnManifest () {
-  const manifestPath = path.join(ownDir, 'package.json')
-  let manifest
-  try {
-    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'))
-  } catch (err) {
-    throw new Error(`Failed to read ${manifestPath}: ${err.message}`)
-  }
-  if (typeof manifest !== 'object' || manifest == null || Array.isArray(manifest)) {
-    throw new Error(`Expected ${manifestPath} to contain a JSON object`)
-  }
-  return manifest
-}
-
-/**
- * Native binary specifiers to try, most-preferred first; empty when the host is
- * unsupported. The linux glibc/musl pair is ordered by detected libc, which
- * only decides the winner when both are installed (e.g. `npm install --force`).
- *
- * @returns {string[]}
- */
-function getBinCandidates () {
-  const platformEntry = PLATFORMS?.[platform]?.[arch]
-
-  if (platformEntry == null) {
-    return []
-  }
-  if (typeof platformEntry === 'string') {
-    return [platformEntry]
-  }
-
-  const order = detectLinuxLibc() === 'musl' ? ['musl', 'glibc'] : ['glibc', 'musl']
-  return order.map((libc) => platformEntry[libc])
-}
-
-function detectLinuxLibc () {
-  if (platform !== 'linux') {
-    return null
-  }
-
-  // glibc builds set `glibcVersionRuntime`; musl leaves it unset. Guarded —
-  // `process.report` may be unavailable, leaving ordering to the default.
-  try {
-    return process.report?.getReport().header.glibcVersionRuntime ? 'glibc' : 'musl'
-  } catch {
-    return null
-  }
-}

package/native-binary.mjs

@@ -0,0 +1,116 @@
+// Where the host's native pnpm binary comes from. Shared by the preinstall
+// (`install.js`), which links it over the placeholder bins, and by the Corepack
+// entry (`bin/pnpm.mjs`), which spawns it.
+import fs from 'node:fs'
+import { createRequire } from 'node:module'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const require = createRequire(import.meta.url)
+const { platform, arch } = process
+
+/** Directory of the published wrapper; the native binary lives next to it. */
+export const wrapperDir = path.dirname(fileURLToPath(import.meta.url))
+
+const PLATFORMS = {
+  win32: {
+    x64: '@pnpm/exe.win32-x64/pnpm.exe',
+    arm64: '@pnpm/exe.win32-arm64/pnpm.exe',
+  },
+  darwin: {
+    x64: '@pnpm/exe.darwin-x64/pnpm',
+    arm64: '@pnpm/exe.darwin-arm64/pnpm',
+  },
+  linux: {
+    x64: {
+      glibc: '@pnpm/exe.linux-x64/pnpm',
+      musl: '@pnpm/exe.linux-x64-musl/pnpm',
+    },
+    arm64: {
+      glibc: '@pnpm/exe.linux-arm64/pnpm',
+      musl: '@pnpm/exe.linux-arm64-musl/pnpm',
+    },
+  },
+}
+
+/**
+ * Native binary specifiers to try, most-preferred first; empty when the host is
+ * unsupported. The linux glibc/musl pair is ordered by detected libc, which
+ * only decides the winner when both are installed (e.g. `npm install --force`).
+ *
+ * @returns {string[]}
+ */
+export function getBinCandidates () {
+  const platformEntry = PLATFORMS?.[platform]?.[arch]
+
+  if (platformEntry == null) {
+    return []
+  }
+  if (typeof platformEntry === 'string') {
+    return [platformEntry]
+  }
+
+  const order = detectLinuxLibc() === 'musl' ? ['musl', 'glibc'] : ['glibc', 'musl']
+  return order.map((libc) => platformEntry[libc])
+}
+
+/**
+ * Split a specifier from {@link getBinCandidates} into the package that ships
+ * the binary and the binary's path inside it.
+ *
+ * @param {string} specifier
+ * @returns {{ packageName: string, binFile: string }}
+ */
+export function splitBinSpecifier (specifier) {
+  const [scope, name, ...rest] = specifier.split('/')
+  return { packageName: `${scope}/${name}`, binFile: rest.join('/') }
+}
+
+/**
+ * Path to the native binary of whichever platform package the package manager
+ * installed, or `null` when none is present (Corepack, `--no-optional`).
+ *
+ * @returns {string | null}
+ */
+export function resolveInstalledBinary () {
+  // Use whichever platform package the package manager installed: it already
+  // filtered by `os`/`cpu`/`libc`, more reliable than re-deriving the host.
+  for (const specifier of getBinCandidates()) {
+    try {
+      return require.resolve(specifier)
+    } catch {}
+  }
+  return null
+}
+
+// A successful read with no optionalDependencies is the dev checkout (there is
+// no native binary to link there); a read/parse failure is a corrupt published
+// package and must not be silently swallowed into that same path.
+export function readWrapperManifest () {
+  const manifestPath = path.join(wrapperDir, 'package.json')
+  let manifest
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'))
+  } catch (err) {
+    throw new Error(`Failed to read ${manifestPath}: ${err.message}`)
+  }
+  if (typeof manifest !== 'object' || manifest == null || Array.isArray(manifest)) {
+    throw new Error(`Expected ${manifestPath} to contain a JSON object`)
+  }
+  return manifest
+}
+
+function detectLinuxLibc () {
+  if (platform !== 'linux') {
+    return null
+  }
+
+  // glibc builds set `glibcVersionRuntime`; musl leaves it unset. Guarded —
+  // `process.report` may be unavailable, leaving ordering to the default.
+  try {
+    return process.report?.getReport().header.glibcVersionRuntime ? 'glibc' : 'musl'
+  } catch {
+    return null
+  }
+}

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.0.0-rc.0",
+  "version": "12.0.0-rc.10",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -39,18 +39,21 @@
     "pn",
     "pnpx",
     "pnx",
+    "bin/",
     "install.js",
-    "dist/"
+    "native-binary.mjs",
+    "dist/",
+    "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.0.0-rc.0",
-    "@pnpm/exe.win32-arm64": "12.0.0-rc.0",
-    "@pnpm/exe.darwin-x64": "12.0.0-rc.0",
-    "@pnpm/exe.darwin-arm64": "12.0.0-rc.0",
-    "@pnpm/exe.linux-x64": "12.0.0-rc.0",
-    "@pnpm/exe.linux-arm64": "12.0.0-rc.0",
-    "@pnpm/exe.linux-x64-musl": "12.0.0-rc.0",
-    "@pnpm/exe.linux-arm64-musl": "12.0.0-rc.0"
+    "@pnpm/exe.win32-x64": "12.0.0-rc.10",
+    "@pnpm/exe.win32-arm64": "12.0.0-rc.10",
+    "@pnpm/exe.darwin-x64": "12.0.0-rc.10",
+    "@pnpm/exe.darwin-arm64": "12.0.0-rc.10",
+    "@pnpm/exe.linux-x64": "12.0.0-rc.10",
+    "@pnpm/exe.linux-arm64": "12.0.0-rc.10",
+    "@pnpm/exe.linux-x64-musl": "12.0.0-rc.10",
+    "@pnpm/exe.linux-arm64-musl": "12.0.0-rc.10"
   },
   "scripts": {
     "preinstall": "node install.js",