@pnpm/exe 12.4.2 → 12.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,22 +1,35 @@
1
1
  #!/bin/sh
2
2
  # Resolve $0 through symlinks so basedir is the shim's real directory.
3
3
  # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
4
+ #
5
+ # A shim runs with node_modules/.bin at the front of PATH, so readlink, sed,
6
+ # uname, and printf go through `command -p`, which searches the system default
7
+ # path instead. A dependency's bin cannot stand in for one of them and take over
8
+ # the shim before it reaches its target. Directories come from `${link%/*}`,
9
+ # which needs no helper at all.
4
10
  link="$0"
11
+ # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
12
+ # and stands for a file in the current directory.
13
+ case "$link" in
14
+ */*|*\\*) ;;
15
+ *) link="./$link" ;;
16
+ esac
5
17
  hops=0
6
18
  while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
7
19
  hops=$((hops+1))
8
- target=$(readlink "$link")
20
+ target=$(command -p readlink "$link")
9
21
  case "$target" in
10
22
  /*) link="$target" ;;
11
- *) link="$(dirname "$link")/$target" ;;
23
+ *) link="${link%/*}/$target" ;;
12
24
  esac
13
25
  done
14
- basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
26
+ basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
27
+ basedir="${basedir%/*}"
15
28
  basedir_win="$basedir"
16
29
  exe=""
17
30
  msys=""
18
31
 
19
- case `uname -a` in
32
+ case `command -p uname -a` in
20
33
  *CYGWIN*|*MINGW*|*MSYS*)
21
34
  if command -v cygpath > /dev/null 2>&1; then
22
35
  basedir_win=`cygpath -w "$basedir"`
@@ -1,22 +1,35 @@
1
1
  #!/bin/sh
2
2
  # Resolve $0 through symlinks so basedir is the shim's real directory.
3
3
  # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
4
+ #
5
+ # A shim runs with node_modules/.bin at the front of PATH, so readlink, sed,
6
+ # uname, and printf go through `command -p`, which searches the system default
7
+ # path instead. A dependency's bin cannot stand in for one of them and take over
8
+ # the shim before it reaches its target. Directories come from `${link%/*}`,
9
+ # which needs no helper at all.
4
10
  link="$0"
11
+ # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
12
+ # and stands for a file in the current directory.
13
+ case "$link" in
14
+ */*|*\\*) ;;
15
+ *) link="./$link" ;;
16
+ esac
5
17
  hops=0
6
18
  while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
7
19
  hops=$((hops+1))
8
- target=$(readlink "$link")
20
+ target=$(command -p readlink "$link")
9
21
  case "$target" in
10
22
  /*) link="$target" ;;
11
- *) link="$(dirname "$link")/$target" ;;
23
+ *) link="${link%/*}/$target" ;;
12
24
  esac
13
25
  done
14
- basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
26
+ basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
27
+ basedir="${basedir%/*}"
15
28
  basedir_win="$basedir"
16
29
  exe=""
17
30
  msys=""
18
31
 
19
- case `uname -a` in
32
+ case `command -p uname -a` in
20
33
  *CYGWIN*|*MINGW*|*MSYS*)
21
34
  if command -v cygpath > /dev/null 2>&1; then
22
35
  basedir_win=`cygpath -w "$basedir"`
@@ -1,22 +1,35 @@
1
1
  #!/bin/sh
2
2
  # Resolve $0 through symlinks so basedir is the shim's real directory.
3
3
  # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
4
+ #
5
+ # A shim runs with node_modules/.bin at the front of PATH, so readlink, sed,
6
+ # uname, and printf go through `command -p`, which searches the system default
7
+ # path instead. A dependency's bin cannot stand in for one of them and take over
8
+ # the shim before it reaches its target. Directories come from `${link%/*}`,
9
+ # which needs no helper at all.
4
10
  link="$0"
11
+ # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
12
+ # and stands for a file in the current directory.
13
+ case "$link" in
14
+ */*|*\\*) ;;
15
+ *) link="./$link" ;;
16
+ esac
5
17
  hops=0
6
18
  while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
7
19
  hops=$((hops+1))
8
- target=$(readlink "$link")
20
+ target=$(command -p readlink "$link")
9
21
  case "$target" in
10
22
  /*) link="$target" ;;
11
- *) link="$(dirname "$link")/$target" ;;
23
+ *) link="${link%/*}/$target" ;;
12
24
  esac
13
25
  done
14
- basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
26
+ basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
27
+ basedir="${basedir%/*}"
15
28
  basedir_win="$basedir"
16
29
  exe=""
17
30
  msys=""
18
31
 
19
- case `uname -a` in
32
+ case `command -p uname -a` in
20
33
  *CYGWIN*|*MINGW*|*MSYS*)
21
34
  if command -v cygpath > /dev/null 2>&1; then
22
35
  basedir_win=`cygpath -w "$basedir"`
@@ -1,22 +1,35 @@
1
1
  #!/bin/sh
2
2
  # Resolve $0 through symlinks so basedir is the shim's real directory.
3
3
  # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
4
+ #
5
+ # A shim runs with node_modules/.bin at the front of PATH, so readlink, sed,
6
+ # uname, and printf go through `command -p`, which searches the system default
7
+ # path instead. A dependency's bin cannot stand in for one of them and take over
8
+ # the shim before it reaches its target. Directories come from `${link%/*}`,
9
+ # which needs no helper at all.
4
10
  link="$0"
11
+ # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
12
+ # and stands for a file in the current directory.
13
+ case "$link" in
14
+ */*|*\\*) ;;
15
+ *) link="./$link" ;;
16
+ esac
5
17
  hops=0
6
18
  while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
7
19
  hops=$((hops+1))
8
- target=$(readlink "$link")
20
+ target=$(command -p readlink "$link")
9
21
  case "$target" in
10
22
  /*) link="$target" ;;
11
- *) link="$(dirname "$link")/$target" ;;
23
+ *) link="${link%/*}/$target" ;;
12
24
  esac
13
25
  done
14
- basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
26
+ basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
27
+ basedir="${basedir%/*}"
15
28
  basedir_win="$basedir"
16
29
  exe=""
17
30
  msys=""
18
31
 
19
- case `uname -a` in
32
+ case `command -p uname -a` in
20
33
  *CYGWIN*|*MINGW*|*MSYS*)
21
34
  if command -v cygpath > /dev/null 2>&1; then
22
35
  basedir_win=`cygpath -w "$basedir"`
@@ -1,22 +1,35 @@
1
1
  #!/bin/sh
2
2
  # Resolve $0 through symlinks so basedir is the shim's real directory.
3
3
  # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
4
+ #
5
+ # A shim runs with node_modules/.bin at the front of PATH, so readlink, sed,
6
+ # uname, and printf go through `command -p`, which searches the system default
7
+ # path instead. A dependency's bin cannot stand in for one of them and take over
8
+ # the shim before it reaches its target. Directories come from `${link%/*}`,
9
+ # which needs no helper at all.
4
10
  link="$0"
11
+ # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
12
+ # and stands for a file in the current directory.
13
+ case "$link" in
14
+ */*|*\\*) ;;
15
+ *) link="./$link" ;;
16
+ esac
5
17
  hops=0
6
18
  while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
7
19
  hops=$((hops+1))
8
- target=$(readlink "$link")
20
+ target=$(command -p readlink "$link")
9
21
  case "$target" in
10
22
  /*) link="$target" ;;
11
- *) link="$(dirname "$link")/$target" ;;
23
+ *) link="${link%/*}/$target" ;;
12
24
  esac
13
25
  done
14
- basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
26
+ basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
27
+ basedir="${basedir%/*}"
15
28
  basedir_win="$basedir"
16
29
  exe=""
17
30
  msys=""
18
31
 
19
- case `uname -a` in
32
+ case `command -p uname -a` in
20
33
  *CYGWIN*|*MINGW*|*MSYS*)
21
34
  if command -v cygpath > /dev/null 2>&1; then
22
35
  basedir_win=`cygpath -w "$basedir"`
@@ -1,9 +1,9 @@
1
1
  {
2
- "lastValidatedTimestamp": 1789466800429,
2
+ "lastValidatedTimestamp": 1789765288371,
3
3
  "projects": {
4
4
  "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
5
5
  "name": "pacquet",
6
- "version": "12.4.2"
6
+ "version": "12.5.1"
7
7
  }
8
8
  },
9
9
  "pnpmfiles": [],
@@ -48,7 +48,7 @@
48
48
  "@pnpm/tabtab": "^0.5.4",
49
49
  "@pnpm/tgz-fixtures": "0.0.0",
50
50
  "@reflink/reflink": "0.1.19",
51
- "@rushstack/worker-pool": "0.7.26",
51
+ "@rushstack/worker-pool": "0.7.27",
52
52
  "@stylistic/eslint-plugin": "^5.10.0",
53
53
  "@types/adm-zip": "^0.5.8",
54
54
  "@types/archy": "0.0.36",
@@ -97,8 +97,8 @@
97
97
  "@zkochan/retry": "^0.2.0",
98
98
  "@zkochan/rimraf": "^4.0.0",
99
99
  "@zkochan/table": "^2.0.1",
100
- "adm-zip": "^0.6.0",
101
- "amaro": "^1.1.11",
100
+ "adm-zip": "^0.6.1",
101
+ "amaro": "^1.2.0",
102
102
  "ansi-diff": "^1.2.0",
103
103
  "archy": "^1.0.0",
104
104
  "better-path-resolve": "2.0.0",
@@ -141,7 +141,7 @@
141
141
  "fast-glob": "^3.3.3",
142
142
  "fs-extra": "^11.4.0",
143
143
  "fuse-native": "^2.2.6",
144
- "get-pnpm": "^0.0.4",
144
+ "get-pnpm": "^0.0.5",
145
145
  "get-port": "^7.2.0",
146
146
  "ghooks": "2.0.4",
147
147
  "graceful-fs": "^4.2.11",
@@ -171,7 +171,7 @@
171
171
  "lru-cache": "^11.5.2",
172
172
  "make-empty-dir": "^4.0.0",
173
173
  "mdast-util-to-string": "^4.0.0",
174
- "memfs": "^3.5.3",
174
+ "memfs": "^4.78.0",
175
175
  "memoize": "^11.0.0",
176
176
  "micromatch": "^4.0.8",
177
177
  "msgpackr": "2.1.0",
@@ -184,7 +184,7 @@
184
184
  "npm-packlist": "10.0.4",
185
185
  "npm-registry-fetch": "^19.0.0",
186
186
  "object-hash": "3.0.0",
187
- "open": "^11.0.2",
187
+ "open": "^11.0.4",
188
188
  "openpgp": "^6.3.1",
189
189
  "p-defer": "^4.0.1",
190
190
  "p-every": "^2.0.0",
@@ -259,7 +259,7 @@
259
259
  "write-json5-file": "^4.0.0",
260
260
  "write-package": "7.2.0",
261
261
  "write-yaml-file": "^6.0.0",
262
- "yaml": "^2.9.0",
262
+ "yaml": "^2.9.1",
263
263
  "yaml-tag": "1.1.0"
264
264
  }
265
265
  },
@@ -3,7 +3,7 @@ import fs from 'node:fs';
3
3
  import path from 'node:path';
4
4
  import { extractTarballMember } from './extractTarballMember.js';
5
5
  import { isMusl, platformPackageName } from './platformPackageName.js';
6
- import { downloadTarball, fetchVersionMeta, normalizeRegistry } from './registry.js';
6
+ import { downloadTarball, fetchVersionMeta, normalizeRegistry, useProxyFromEnv } from './registry.js';
7
7
  import { majorVersion } from './resolveVersion.js';
8
8
  import { sameFileContents } from './sameFileContents.js';
9
9
  import { verifyRegistrySignature } from './verifySignature.js';
@@ -31,14 +31,23 @@ function executableName() {
31
31
  * @returns the package the executable came from.
32
32
  */
33
33
  export async function downloadPnpmExecutable(opts) {
34
- const { version, destPath } = opts;
35
34
  const registry = normalizeRegistry(opts.registry);
36
35
  const packageName = platformPackageName({
37
- major: majorVersion(version),
36
+ major: majorVersion(opts.version),
38
37
  platform: process.platform,
39
38
  arch: process.arch,
40
39
  musl: isMusl(),
41
40
  });
41
+ const restoreProxy = useProxyFromEnv();
42
+ try {
43
+ return await fetchExecutable({ ...opts, registry, packageName });
44
+ }
45
+ finally {
46
+ restoreProxy();
47
+ }
48
+ }
49
+ async function fetchExecutable(opts) {
50
+ const { version, destPath, registry, packageName } = opts;
42
51
  const meta = await fetchVersionMeta(registry, packageName, version, opts.headers);
43
52
  if (!meta.dist.integrity) {
44
53
  throw new Error(`The npm registry published no checksum for ${packageName}@${version}, so it cannot be verified.`);
@@ -4,13 +4,13 @@ import os from 'node:os';
4
4
  import path from 'node:path';
5
5
  import { extractTarball } from './extractTarball.js';
6
6
  import { isMusl, platformPackageName } from './platformPackageName.js';
7
- import { downloadTarball, fetchPackument, fetchVersionMeta, registryFromEnv } from './registry.js';
7
+ import { downloadTarball, fetchPackument, fetchVersionMeta, registryFromEnv, useProxyFromEnv } from './registry.js';
8
8
  import { majorVersion, resolveVersion } from './resolveVersion.js';
9
9
  import { verifyRegistrySignature } from './verifySignature.js';
10
10
  export { downloadPnpmExecutable } from './downloadExecutable.js';
11
11
  export { extractTarballMember } from './extractTarballMember.js';
12
12
  export { isMusl, platformPackageName } from './platformPackageName.js';
13
- export { DEFAULT_REGISTRY, registryFromEnv } from './registry.js';
13
+ export { DEFAULT_REGISTRY, registryFromEnv, useProxyFromEnv } from './registry.js';
14
14
  export { majorVersion, resolveVersion } from './resolveVersion.js';
15
15
  export { verifyRegistrySignature } from './verifySignature.js';
16
16
  /**
@@ -37,6 +37,9 @@ Environment variables:
37
37
  PNPM_VERSION Version to install when no argument is given.
38
38
  PNPM_HOME Directory to install pnpm into.
39
39
  npm_config_registry Registry to download pnpm from.
40
+ HTTPS_PROXY Proxy to download through (HTTP_PROXY for an http://
41
+ registry); NO_PROXY names hosts to reach directly.
42
+ Node 24.14 or later.
40
43
  `;
41
44
  export async function runCli(argv) {
42
45
  const positional = [];
@@ -113,6 +116,15 @@ export async function installPnpm(opts) {
113
116
  * @returns the version installed and the path to the executable.
114
117
  */
115
118
  export async function downloadPnpm(opts) {
119
+ const restoreProxy = useProxyFromEnv();
120
+ try {
121
+ return await fetchPnpm(opts);
122
+ }
123
+ finally {
124
+ restoreProxy();
125
+ }
126
+ }
127
+ async function fetchPnpm(opts) {
116
128
  const packument = await fetchPackument(opts.registry, CLI_PKG_NAME);
117
129
  const version = resolveVersion(packument, opts.versionSpec);
118
130
  const major = majorVersion(version);
@@ -1,5 +1,6 @@
1
1
  import { createHash } from 'node:crypto';
2
2
  import { createWriteStream } from 'node:fs';
3
+ import http from 'node:http';
3
4
  import { pipeline } from 'node:stream/promises';
4
5
  const ABBREVIATED_PACKUMENT = 'application/vnd.npm.install-v1+json';
5
6
  export const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
@@ -16,6 +17,48 @@ export function registryFromEnv() {
16
17
  export function normalizeRegistry(registry) {
17
18
  return registry.endsWith('/') ? registry : `${registry}/`;
18
19
  }
20
+ const PROXY_VARS = ['https_proxy', 'HTTPS_PROXY', 'http_proxy', 'HTTP_PROXY'];
21
+ /**
22
+ * Routes every request made until the returned function is called through the
23
+ * proxy the environment names in `HTTPS_PROXY`/`HTTP_PROXY`, honouring
24
+ * `NO_PROXY`. A no-op when the environment names none.
25
+ *
26
+ * `fetch` reads those variables only when Node was started with
27
+ * `NODE_USE_ENV_PROXY=1`, which nothing that embeds this package controls:
28
+ * Corepack starts the process that runs pnpm's launcher. On a network that
29
+ * allows no other route out, the download then fails with a bare
30
+ * `fetch failed`, while everything before it went through the proxy fine,
31
+ * Corepack's own download of the `pnpm` package included.
32
+ *
33
+ * Node before 24.14 has no way to apply the proxy after startup, so the
34
+ * request goes direct there, as it always has.
35
+ *
36
+ * The setting is process-global, so overlapping downloads share one
37
+ * activation: the first call applies the proxy and the last of the returned
38
+ * functions to run puts the agents back, never one in the middle.
39
+ */
40
+ export function useProxyFromEnv() {
41
+ if (!PROXY_VARS.some((name) => process.env[name]))
42
+ return () => { };
43
+ const { setGlobalProxyFromEnv } = http;
44
+ if (setGlobalProxyFromEnv == null)
45
+ return () => { };
46
+ // Counted only once the activation took: a call that threw on a malformed
47
+ // proxy URL holds nothing to release, and a retry after a fix has to activate.
48
+ if (proxyUsers === 0)
49
+ restoreProxy = setGlobalProxyFromEnv(process.env);
50
+ proxyUsers++;
51
+ let released = false;
52
+ return () => {
53
+ if (released)
54
+ return;
55
+ released = true;
56
+ if (--proxyUsers === 0)
57
+ restoreProxy();
58
+ };
59
+ }
60
+ let proxyUsers = 0;
61
+ let restoreProxy = () => { };
19
62
  // Node's fetch applies no timeout of its own: a registry that accepts the
20
63
  // connection and then stalls would hang the install with no output. Metadata is
21
64
  // small and quick; the tarball budget has to survive a slow connection carrying
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "get-pnpm",
3
- "version": "0.0.4",
3
+ "version": "0.0.5",
4
4
  "description": "Installs pnpm as a standalone executable",
5
5
  "keywords": [
6
6
  "pnpm",
package/package.json CHANGED
@@ -9,7 +9,7 @@
9
9
  "./dist/node_modules/node-gyp/gyp/gyp"
10
10
  ]
11
11
  },
12
- "version": "12.4.2",
12
+ "version": "12.5.1",
13
13
  "description": "Fast, disk space efficient package manager",
14
14
  "keywords": [
15
15
  "pnpm",
@@ -46,20 +46,20 @@
46
46
  "THIRD-PARTY-NOTICES.md"
47
47
  ],
48
48
  "optionalDependencies": {
49
- "@pnpm/exe.win32-x64": "12.4.2",
50
- "@pnpm/exe.win32-arm64": "12.4.2",
51
- "@pnpm/exe.darwin-x64": "12.4.2",
52
- "@pnpm/exe.darwin-arm64": "12.4.2",
53
- "@pnpm/exe.linux-x64": "12.4.2",
54
- "@pnpm/exe.linux-arm64": "12.4.2",
55
- "@pnpm/exe.linux-riscv64": "12.4.2",
56
- "@pnpm/exe.linux-ppc64": "12.4.2",
57
- "@pnpm/exe.linux-s390x": "12.4.2",
58
- "@pnpm/exe.linux-x64-musl": "12.4.2",
59
- "@pnpm/exe.linux-arm64-musl": "12.4.2",
60
- "@pnpm/exe.freebsd-x64": "12.4.2",
61
- "@pnpm/exe.android-arm64": "12.4.2",
62
- "@pnpm/exe.android-x64": "12.4.2"
49
+ "@pnpm/exe.win32-x64": "12.5.1",
50
+ "@pnpm/exe.win32-arm64": "12.5.1",
51
+ "@pnpm/exe.darwin-x64": "12.5.1",
52
+ "@pnpm/exe.darwin-arm64": "12.5.1",
53
+ "@pnpm/exe.linux-x64": "12.5.1",
54
+ "@pnpm/exe.linux-arm64": "12.5.1",
55
+ "@pnpm/exe.linux-riscv64": "12.5.1",
56
+ "@pnpm/exe.linux-ppc64": "12.5.1",
57
+ "@pnpm/exe.linux-s390x": "12.5.1",
58
+ "@pnpm/exe.linux-x64-musl": "12.5.1",
59
+ "@pnpm/exe.linux-arm64-musl": "12.5.1",
60
+ "@pnpm/exe.freebsd-x64": "12.5.1",
61
+ "@pnpm/exe.android-arm64": "12.5.1",
62
+ "@pnpm/exe.android-x64": "12.5.1"
63
63
  },
64
64
  "scripts": {
65
65
  "preinstall": "node install.js",