@pnpm/exe 12.0.0-rc.4 → 12.0.0-rc.6

package/dist/node_modules/get-pnpm/lib/index.js

@@ -0,0 +1,208 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { extractTarball } from './extractTarball.js';
+import { isMusl, platformPackageName } from './platformPackageName.js';
+import { downloadTarball, fetchPackument, fetchVersionMeta, registryFromEnv } from './registry.js';
+import { majorVersion, resolveVersion } from './resolveVersion.js';
+import { verifyRegistrySignature } from './verifySignature.js';
+export { downloadPnpmExecutable } from './downloadExecutable.js';
+export { extractTarballMember } from './extractTarballMember.js';
+export { isMusl, platformPackageName } from './platformPackageName.js';
+export { DEFAULT_REGISTRY, registryFromEnv } from './registry.js';
+export { majorVersion, resolveVersion } from './resolveVersion.js';
+export { verifyRegistrySignature } from './verifySignature.js';
+/**
+ * The package whose dist-tags name every pnpm release. `@pnpm/exe` carries the
+ * same versions today, but only `pnpm` is published from v12 onward, so its
+ * tags are the ones that cannot go stale.
+ */
+const CLI_PKG_NAME = 'pnpm';
+/** Holds the unpacked tarballs while the installation is assembled beside it. */
+const UNPACK_DIR = '.unpack';
+/** Where the `dist/` tree that ships beside the executable is published. */
+function wrapperPackageName(major) {
+    return major >= 12 ? CLI_PKG_NAME : '@pnpm/exe';
+}
+const USAGE = `Usage: npx get-pnpm [version]
+
+Installs pnpm as a standalone executable and adds it to your PATH.
+
+Arguments:
+  version            An exact version (11.20.0), a major (12), or a dist-tag
+                     (latest, next-12). Defaults to $PNPM_VERSION, then "latest".
+
+Environment variables:
+  PNPM_VERSION           Version to install when no argument is given.
+  PNPM_HOME              Directory to install pnpm into.
+  npm_config_registry    Registry to download pnpm from.
+`;
+export async function runCli(argv) {
+    const positional = [];
+    for (const arg of argv) {
+        if (arg === '--help' || arg === '-h') {
+            console.log(USAGE);
+            return 0;
+        }
+        if (arg.startsWith('-')) {
+            throw new Error(`Unknown option "${arg}".\n\n${USAGE}`);
+        }
+        positional.push(arg);
+    }
+    if (positional.length > 1) {
+        throw new Error(`Expected at most one version, got ${positional.length}.\n\n${USAGE}`);
+    }
+    return installPnpm({
+        versionSpec: positional[0] ?? process.env.PNPM_VERSION ?? 'latest',
+        registry: registryFromEnv(),
+    });
+}
+/**
+ * Downloads the pnpm executable and hands over to `pnpm setup`, which installs
+ * it globally and puts it on the PATH.
+ *
+ * Every download is checked against the checksum the registry published for it,
+ * and that checksum against npm's signature — see `verifyRegistrySignature`.
+ *
+ * The temporary directory is assembled to look like the release tarball that
+ * https://get.pnpm.io/install.sh downloads — the executable next to its `dist/`
+ * tree — because `pnpm setup` installs that directory as-is.
+ *
+ * @returns the exit code of `pnpm setup`.
+ */
+export async function installPnpm(opts) {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pnpm-install-'));
+    const removeTmpDir = () => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    };
+    // Registered for the duration of the call and no longer: this is also a
+    // library function, and handlers left behind would accumulate and outlive the
+    // directory they exist to clean up.
+    const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+    const onSignal = () => {
+        removeTmpDir();
+        process.exit(1);
+    };
+    for (const signal of signals) {
+        process.once(signal, onSignal);
+    }
+    try {
+        const { binPath } = await downloadPnpm({ ...opts, dest: tmpDir });
+        const { error, status } = spawnSync(binPath, ['setup', '--force'], { stdio: 'inherit' });
+        if (error != null)
+            throw error;
+        return status ?? 1;
+    }
+    finally {
+        for (const signal of signals) {
+            process.off(signal, onSignal);
+        }
+        removeTmpDir();
+    }
+}
+/**
+ * Downloads the pnpm executable into `dest`, laid out the way the release
+ * tarball lays it out — the executable next to the `dist/` tree it loads.
+ *
+ * Every download is checked against the checksum the registry published for it,
+ * and that checksum against npm's signature; see `verifyRegistrySignature`.
+ * Nothing outside `dest` is touched, so a caller that manages its own PATH — a
+ * CI action, say — can use this without the global install `installPnpm` does.
+ *
+ * @returns the version installed and the path to the executable.
+ */
+export async function downloadPnpm(opts) {
+    const packument = await fetchPackument(opts.registry, CLI_PKG_NAME);
+    const version = resolveVersion(packument, opts.versionSpec);
+    const major = majorVersion(version);
+    const platformPkgName = platformPackageName({
+        major,
+        platform: process.platform,
+        arch: process.arch,
+        musl: isMusl(),
+    });
+    const { dest } = opts;
+    fs.mkdirSync(dest, { recursive: true });
+    try {
+        console.log(`==> Downloading pnpm ${version}`);
+        const executable = process.platform === 'win32' ? 'pnpm.exe' : 'pnpm';
+        const fetchPackage = verifiedPackageFetcher({ dir: dest, registry: opts.registry, version, keys: opts.keys });
+        // Settled, not `all`: a rejection there would leave the other fetch writing
+        // into the directory the `finally` below is about to remove.
+        const [platformResult, wrapperResult] = await Promise.allSettled([
+            fetchPackage(platformPkgName),
+            // v11 was the first release to keep files next to the executable; up to
+            // v10 the executable is self-contained and ships no `dist/`.
+            major >= 11 ? fetchPackage(wrapperPackageName(major)) : Promise.resolve(undefined),
+        ]);
+        if (platformResult.status === 'rejected')
+            throw platformResult.reason;
+        if (wrapperResult.status === 'rejected')
+            throw wrapperResult.reason;
+        const platformPkg = platformResult.value;
+        const wrapperPkg = wrapperResult.value;
+        const binPath = path.join(dest, executable);
+        fs.renameSync(path.join(platformPkg.dir, executable), binPath);
+        fs.chmodSync(binPath, 0o755);
+        if (wrapperPkg != null) {
+            fs.rmSync(path.join(dest, 'dist'), { recursive: true, force: true });
+            fs.renameSync(path.join(wrapperPkg.dir, 'dist'), path.join(dest, 'dist'));
+            writeManifest({ dest, executable, version, wrapperDir: wrapperPkg.dir, major });
+        }
+        return { version, binPath };
+    }
+    finally {
+        // `pnpm setup` installs this directory as a package, so nothing may be left
+        // in it that does not belong in the installation.
+        fs.rmSync(path.join(dest, UNPACK_DIR), { recursive: true, force: true });
+    }
+}
+/**
+ * `pnpm setup` installs the directory as a package, writing a minimal manifest
+ * when there is none — which is what the release tarball relies on. That
+ * tarball bundles the runtime dependencies inside `dist/`; the registry copy
+ * declares them instead, so up to v11 they have to be declared here or the
+ * install silently loses them (`@reflink/reflink`, and with it copy-on-write
+ * cloning). From v12 the `dist/` tree is self-contained again, so the manifest
+ * `setup` writes is left to it.
+ */
+function writeManifest(opts) {
+    if (opts.major >= 12)
+        return;
+    const wrapper = JSON.parse(fs.readFileSync(path.join(opts.wrapperDir, 'package.json'), 'utf8'));
+    if (wrapper.dependencies == null)
+        return;
+    fs.writeFileSync(path.join(opts.dest, 'package.json'), JSON.stringify({
+        name: '@pnpm/exe',
+        version: opts.version,
+        type: 'module',
+        bin: { pnpm: opts.executable, pn: opts.executable },
+        dependencies: wrapper.dependencies,
+    }));
+}
+/** Downloads packages of one version into one directory, verifying each. */
+function verifiedPackageFetcher(opts) {
+    return async function fetchPackage(pkgName) {
+        const meta = await fetchVersionMeta(opts.registry, pkgName, opts.version);
+        if (!meta.dist.integrity) {
+            throw new Error(`The npm registry published no checksum for ${pkgName}@${opts.version}, so it cannot be verified.`);
+        }
+        verifyRegistrySignature({
+            name: pkgName,
+            version: opts.version,
+            integrity: meta.dist.integrity,
+            signatures: meta.dist.signatures,
+            keys: opts.keys,
+        });
+        // Unpack away from the directory being assembled: `pnpm` is both a package
+        // name and the name of the executable that ends up beside it.
+        const unpackDir = path.join(opts.dir, UNPACK_DIR, pkgName.replaceAll('/', '-'));
+        const tarball = `${unpackDir}.tgz`;
+        fs.mkdirSync(path.dirname(tarball), { recursive: true });
+        await downloadTarball(meta, tarball, { registry: opts.registry });
+        extractTarball(tarball, unpackDir);
+        fs.rmSync(tarball);
+        return { dir: path.join(unpackDir, 'package') };
+    };
+}

package/dist/node_modules/get-pnpm/lib/npmSigningKeys.js

@@ -0,0 +1,23 @@
+/* eslint-disable */
+// GENERATED — npm's public registry signing keys, mirrored from
+// https://registry.npmjs.org/-/npm/v1/keys
+//
+// Refresh with: node scripts/update-npm-keys.mjs --update
+// A scheduled workflow runs the check, so a rotation arrives as a pull request
+// rather than as a failed install.
+export const NPM_SIGNING_KEYS = [
+    {
+        "expires": null,
+        "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="
+    },
+    {
+        "expires": "2025-01-29T00:00:00.000Z",
+        "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="
+    }
+];

package/dist/node_modules/get-pnpm/lib/platformPackageName.js

@@ -0,0 +1,60 @@
+/**
+ * Name of the npm package that carries the pnpm executable for `target`.
+ *
+ * pnpm ships the binary in a per-host package that `@pnpm/exe` lists as an
+ * optional dependency. The naming scheme changed with the Rust rewrite: v12
+ * publishes `@pnpm/exe.<process.platform>-<arch>[-musl]`, while v11 and older
+ * publish `@pnpm/<macos|win|linux|linuxstatic>-<arch>`.
+ *
+ * @throws if pnpm publishes no binary for the host — either because the
+ * architecture was never supported, or because of the v11-only Intel macOS gap.
+ */
+export function platformPackageName({ major, platform, arch, musl }) {
+    if (arch !== 'x64' && arch !== 'arm64') {
+        throw new Error('Sorry! pnpm currently only provides pre-built binaries for x86_64/arm64 architectures.');
+    }
+    if (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32') {
+        throw new Error(`Sorry! pnpm does not provide a pre-built binary for ${platform}.`);
+    }
+    if (platform === 'darwin' && arch === 'x64' && major === 11) {
+        throw new Error(`pnpm v11 does not provide a working binary for Intel macOS (darwin-x64) due to an upstream Node.js SEA bug.
+
+Install pnpm a different way instead:
+  npx get-pnpm 12        # pnpm v12 ships an Intel macOS binary
+  npm install -g pnpm    # uses your system Node.js
+  brew install pnpm      # via Homebrew
+
+More context: https://github.com/pnpm/pnpm/issues/11423`);
+    }
+    const linuxMusl = platform === 'linux' && musl;
+    if (major >= 12) {
+        return `@pnpm/exe.${platform}-${arch}${linuxMusl ? '-musl' : ''}`;
+    }
+    return `@pnpm/${legacyOsSegment(platform, linuxMusl)}-${arch}`;
+}
+function legacyOsSegment(platform, isMusl) {
+    switch (platform) {
+        case 'darwin': return 'macos';
+        case 'win32': return 'win';
+        default: return isMusl ? 'linuxstatic' : 'linux';
+    }
+}
+/**
+ * Whether this host's libc is musl rather than glibc.
+ *
+ * Probed the way pnpm's own wrappers do it rather than through a dependency:
+ * glibc builds report a `glibcVersionRuntime`, musl builds leave it unset.
+ * Keeping this package dependency-free means `npx` fetches one thing before
+ * pnpm exists.
+ */
+export function isMusl() {
+    if (process.platform !== 'linux')
+        return false;
+    try {
+        const report = process.report?.getReport();
+        return report?.header != null && !report.header.glibcVersionRuntime;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/node_modules/get-pnpm/lib/registry.js

@@ -0,0 +1,120 @@
+import { createHash } from 'node:crypto';
+import { createWriteStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+const ABBREVIATED_PACKUMENT = 'application/vnd.npm.install-v1+json';
+export const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
+/** The registry npx/npm is configured with, so a mirror stays a mirror. */
+export function registryFromEnv() {
+    return normalizeRegistry(process.env.npm_config_registry ?? process.env.NPM_CONFIG_REGISTRY ?? DEFAULT_REGISTRY);
+}
+/**
+ * A registry URL that can be used as a base for a relative path.
+ *
+ * `new URL('pkg', 'https://mirror.example.com/npm')` drops the last segment,
+ * so a registry served from a subpath needs its trailing slash to survive.
+ */
+export function normalizeRegistry(registry) {
+    return registry.endsWith('/') ? registry : `${registry}/`;
+}
+// Node's fetch applies no timeout of its own: a registry that accepts the
+// connection and then stalls would hang the install with no output. Metadata is
+// small and quick; the tarball budget has to survive a slow connection carrying
+// a ~150 MB download.
+const METADATA_TIMEOUT_MS = 30_000;
+const TARBALL_TIMEOUT_MS = 15 * 60_000;
+export async function fetchPackument(registry, pkgName, headers) {
+    return fetchJson(new URL(pkgName, registry), ABBREVIATED_PACKUMENT, headers);
+}
+export async function fetchVersionMeta(registry, pkgName, version, headers) {
+    return fetchJson(new URL(`${pkgName}/${version}`, registry), 'application/json', headers);
+}
+/**
+ * Streams `meta.dist.tarball` to `dest`, verifying the checksum the registry
+ * published for it. A mismatch removes nothing — the caller discards the whole
+ * temporary directory.
+ *
+ * `registry` re-hosts a tarball URL that points at npm onto that registry, so a
+ * mirror that answered the metadata request serves the download too; `headers`
+ * travel only to the registry's own origin, never to a download host it names.
+ */
+export async function downloadTarball(meta, dest, opts = {}) {
+    const url = tarballUrl(meta, opts.registry);
+    const response = await request(url, undefined, TARBALL_TIMEOUT_MS, headersFor(url, opts));
+    const [algorithm, expected] = checksum(meta);
+    const hash = createHash(algorithm);
+    const body = response.body;
+    await pipeline(async function* () {
+        for await (const chunk of body) {
+            hash.update(chunk);
+            yield chunk;
+        }
+    }, createWriteStream(dest));
+    const actual = hash.digest('base64');
+    if (actual !== expected) {
+        throw new Error(`The download from ${url.href} does not match the checksum the npm registry published for it. Refusing to install.`);
+    }
+}
+/**
+ * Where to download `meta`'s tarball from.
+ *
+ * Registries that proxy npm hand back npm's own URL. Following it would leave
+ * the mirror the metadata came from — for an air-gapped one, it would not
+ * resolve at all — so the path is re-hosted onto `registry`. Matched by origin,
+ * so a host that merely starts with npm's is left alone.
+ */
+export function tarballUrl(meta, registry) {
+    const url = new URL(meta.dist.tarball);
+    if (registry == null || url.origin !== new URL(DEFAULT_REGISTRY).origin)
+        return url;
+    return new URL(`${url.pathname.replace(/^\//, '')}${url.search}`, normalizeRegistry(registry));
+}
+function headersFor(url, opts) {
+    if (opts.headers == null || opts.registry == null)
+        return undefined;
+    return url.origin === new URL(opts.registry).origin ? opts.headers : undefined;
+}
+/**
+ * The algorithm and digest to check a tarball against.
+ *
+ * `integrity` is an SRI string, which may hold several space-separated entries;
+ * the first is used. Only the digest that the registry signature covers is
+ * accepted — `shasum` is SHA-1, and a package without `integrity` has already
+ * been refused before any download starts.
+ */
+function checksum(meta) {
+    const entry = meta.dist.integrity?.trim().split(/\s+/)[0];
+    if (!entry) {
+        throw new Error(`The registry published no checksum for ${meta.dist.tarball}, so it cannot be verified.`);
+    }
+    const separator = entry.indexOf('-');
+    if (separator === -1) {
+        throw new Error(`The registry published an unreadable checksum for ${meta.dist.tarball}: ${entry}`);
+    }
+    return [entry.slice(0, separator), entry.slice(separator + 1)];
+}
+async function fetchJson(url, accept, headers) {
+    const response = await request(url, accept, METADATA_TIMEOUT_MS, headers);
+    return await response.json();
+}
+async function request(url, accept, timeoutMs, headers) {
+    let response;
+    try {
+        response = await fetch(url, {
+            signal: AbortSignal.timeout(timeoutMs),
+            headers: { ...headers, ...(accept ? { accept } : {}) },
+        });
+    }
+    catch (err) {
+        const reason = err.name === 'TimeoutError'
+            ? `timed out after ${Math.round(timeoutMs / 1000)}s`
+            : err.message;
+        throw new Error(`Could not reach ${url.href}: ${reason}`, { cause: err });
+    }
+    if (!response.ok) {
+        throw new Error(`Could not download ${url.href}: ${response.status} ${response.statusText}`);
+    }
+    if (response.body == null) {
+        throw new Error(`Empty response from ${url.href}`);
+    }
+    return response;
+}

package/dist/node_modules/get-pnpm/lib/resolveVersion.js

@@ -0,0 +1,36 @@
+/**
+ * Turns what the user asked for into a concrete pnpm version.
+ *
+ * `spec` may be a dist-tag (`latest`, `next-12`), an exact version (`11.20.0`,
+ * with an optional leading `v`), or a bare major (`12`), which picks that
+ * major's stable release and falls back to its prerelease lane.
+ *
+ * Dist-tags win over exact versions, matching `install.ps1`.
+ *
+ * @throws if `spec` matches neither a dist-tag nor a published version.
+ */
+export function resolveVersion(packument, spec) {
+    const distTags = packument['dist-tags'];
+    if (distTags[spec])
+        return distTags[spec];
+    const version = spec.startsWith('v') ? spec.slice(1) : spec;
+    if (packument.versions[version])
+        return version;
+    if (/^\d+$/.test(version)) {
+        const majorTag = distTags[`latest-${version}`] ?? distTags[`next-${version}`];
+        if (majorTag)
+            return majorTag;
+    }
+    throw new Error(`Sorry! pnpm version "${spec}" could not be found. Available tags: ${Object.keys(distTags).sort().join(', ')}`);
+}
+/** The major of an exact version, as the package layout depends on it. */
+export function majorVersion(version) {
+    const field = version.split('.')[0] ?? '';
+    // Digits only: `Number` reads '' as 0 and '0x10' as 16, and a caller-supplied
+    // version that means neither should say so here rather than fail later as a
+    // package name nobody publishes.
+    if (!/^\d+$/.test(field)) {
+        throw new Error(`Could not read a major version from "${version}".`);
+    }
+    return Number(field);
+}

package/dist/node_modules/get-pnpm/lib/sameFileContents.js

@@ -0,0 +1,45 @@
+import fs from 'node:fs';
+const CHUNK_SIZE = 64 * 1024;
+/**
+ * Whether two paths hold the same bytes.
+ *
+ * Compared rather than hashed: the answer is usually "no" at the first
+ * differing byte, and there is nothing to gain from reading further.
+ *
+ * `b` is the untrusted side — a path something else may hold — so anything
+ * other than a readable regular file of the same size is simply not the same
+ * file, rather than an error.
+ */
+export function sameFileContents(a, b) {
+    const sizeA = fs.statSync(a).size;
+    const statB = fs.lstatSync(b, { throwIfNoEntry: false });
+    if (statB?.isFile() !== true || statB.size !== sizeA)
+        return false;
+    let fdA;
+    let fdB;
+    try {
+        fdA = fs.openSync(a, 'r');
+        fdB = fs.openSync(b, 'r');
+        const bufferA = Buffer.alloc(CHUNK_SIZE);
+        const bufferB = Buffer.alloc(CHUNK_SIZE);
+        while (true) {
+            const readA = fs.readSync(fdA, bufferA, 0, CHUNK_SIZE, null);
+            const readB = fs.readSync(fdB, bufferB, 0, CHUNK_SIZE, null);
+            if (readA !== readB)
+                return false;
+            if (readA === 0)
+                return true;
+            if (!bufferA.subarray(0, readA).equals(bufferB.subarray(0, readB)))
+                return false;
+        }
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fdA !== undefined)
+            fs.closeSync(fdA);
+        if (fdB !== undefined)
+            fs.closeSync(fdB);
+    }
+}

package/dist/node_modules/get-pnpm/lib/verifySignature.js

@@ -0,0 +1,51 @@
+import { createVerify } from 'node:crypto';
+import { NPM_SIGNING_KEYS } from './npmSigningKeys.js';
+/**
+ * Checks the registry's signature over a package's identity and checksum.
+ *
+ * The registry serves both the tarball and the checksum, so a checksum taken
+ * from it proves nothing on its own. This is what makes it worth anything: the
+ * signature is made with a key the registry publishes but the download host
+ * cannot mint, and the trusted copy of that key ships inside this package.
+ *
+ * @throws if the package is unsigned, signed with a key that isn't trusted or
+ * has expired, or the signature does not verify.
+ */
+export function verifyRegistrySignature(opts) {
+    const pkg = `${opts.name}@${opts.version}`;
+    const signatures = opts.signatures ?? [];
+    if (signatures.length === 0) {
+        throw new Error(`${pkg} carries no npm registry signature, so it cannot be verified.`);
+    }
+    // Pick the signature by key rather than by position. A package can carry
+    // several, in no guaranteed order, and across a rotation one of them can be
+    // from a key this installer does not pin — which is not a reason to refuse a
+    // package that another, pinned key also signed.
+    const keys = opts.keys ?? NPM_SIGNING_KEYS;
+    const match = signatures
+        .map((signature) => ({ signature, key: keys.find(({ keyid }) => keyid === signature.keyid) }))
+        .find((candidate) => candidate.key != null);
+    if (match?.key == null) {
+        throw new Error(`${pkg} is signed with an unexpected npm key (${signatures.map(({ keyid }) => keyid).join(', ')}).
+
+If npm has rotated its signing key, this installer needs updating.
+Until then, install pnpm another way: https://pnpm.io/installation`);
+    }
+    const { signature, key } = match;
+    if (key.expires != null) {
+        const expires = new Date(key.expires).getTime();
+        // An unreadable date must not read as "never expires".
+        if (Number.isNaN(expires)) {
+            throw new Error(`${pkg} is signed with an npm key whose expiry date cannot be read (${key.expires}).`);
+        }
+        if (expires < (opts.now ?? new Date()).getTime()) {
+            throw new Error(`${pkg} is signed with an npm key that expired on ${key.expires}.`);
+        }
+    }
+    // Registry signatures cover the package identity and its content hash.
+    const message = `${pkg}:${opts.integrity}`;
+    const publicKey = `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`;
+    if (!createVerify('SHA256').update(message).verify(publicKey, signature.sig, 'base64')) {
+        throw new Error(`The npm registry signature for ${pkg} is not valid. Refusing to install.`);
+    }
+}

package/dist/node_modules/get-pnpm/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "get-pnpm",
+  "version": "0.0.3",
+  "description": "Installs pnpm as a standalone executable",
+  "keywords": [
+    "pnpm",
+    "install",
+    "installer"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/get.pnpm.io/tree/main/get-pnpm"
+  },
+  "homepage": "https://github.com/pnpm/get.pnpm.io/tree/main/get-pnpm#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/get.pnpm.io/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map",
+    "bin"
+  ],
+  "bin": {
+    "get-pnpm": "bin/get-pnpm.js"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "typescript": "^5.9.3"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc && node --test test/*.test.ts"
+  }
+}

package/dist/node_modules/node-gyp/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "12.4.0"
+    ".": "12.3.0"
 }

package/dist/node_modules/node-gyp/gyp/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "0.22.2"
+    ".": "0.22.1"
 }

package/dist/node_modules/node-gyp/gyp/pyproject.toml

@@ -4,20 +4,20 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gyp-next"
-version = "0.22.2"
+version = "0.22.1"
 authors = [
   { name="Node.js contributors", email="ryzokuken@disroot.org" },
 ]
 description = "A fork of the GYP build system for use in the Node.js projects"
 readme = "README.md"
-license = "BSD-3-Clause"
-license-files = ["LICENSE"]
+license = { file="LICENSE" }
 requires-python = ">=3.9"
-dependencies = ["packaging>=24.0", "setuptools>=77.0.3"]
+dependencies = ["packaging>=24.0", "setuptools>=69.5.1"]
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Environment :: Console",
     "Intended Audience :: Developers",
+    "License :: OSI Approved :: BSD License",
     "Natural Language :: English",
     "Programming Language :: Python",
     "Programming Language :: Python :: 3",

package/dist/node_modules/node-gyp/lib/download.js

@@ -1,5 +1,5 @@
 const { Readable } = require('stream')
-const { Agent, EnvHttpProxyAgent, RetryAgent, fetch } = require('undici')
+const { EnvHttpProxyAgent } = require('undici')
 const { promises: fs } = require('graceful-fs')
 const log = require('./log')
 
@@ -48,7 +48,7 @@ async function createDispatcher (gyp) {
   const env = process.env
   const hasProxyEnv = env.http_proxy || env.HTTP_PROXY || env.https_proxy || env.HTTPS_PROXY
   if (!gyp.opts.proxy && !gyp.opts.cafile && !hasProxyEnv) {
-    return new RetryAgent(new Agent(), { maxRetries: 3 })
+    return undefined
   }
 
   const opts = {}
@@ -69,7 +69,7 @@ async function createDispatcher (gyp) {
   if (gyp.opts.noproxy) {
     opts.noProxy = gyp.opts.noproxy
   }
-  return new RetryAgent(new EnvHttpProxyAgent(opts), { maxRetries: 3 })
+  return new EnvHttpProxyAgent(opts)
 }
 
 async function readCAFile (filename) {

package/dist/node_modules/node-gyp/package.json

@@ -11,7 +11,7 @@
     "bindings",
     "gyp"
   ],
-  "version": "12.4.0",
+  "version": "12.3.0",
   "installVersion": 11,
   "author": "Nathan Rajlich <nathan@tootallnate.net> (http://tootallnate.net)",
   "repository": {