@pnpm/lockfile.utils 1100.0.8 → 1100.0.10

package/lib/pkgSnapshotToResolution.js

@@ -1,11 +1,33 @@
 import url from 'node:url';
 import * as dp from '@pnpm/deps.path';
+import { PnpmError } from '@pnpm/error';
 import getNpmTarballUrl from 'get-npm-tarball-url';
 import { nameVerFromPkgSnapshot } from './nameVerFromPkgSnapshot.js';
+import { isGitHostedTarballUrl } from './toLockfileResolution.js';
 export function pkgSnapshotToResolution(depPath, pkgSnapshot, registries) {
-    if (Boolean(pkgSnapshot.resolution.type) ||
-        pkgSnapshot.resolution.tarball?.startsWith('file:') ||
-        pkgSnapshot.resolution.gitHosted === true) {
+    const resolution = pkgSnapshot.resolution;
+    // Tarball-shaped resolutions (no `type` field) must carry `integrity`,
+    // except where the URL itself anchors the bytes:
+    //   - `file:` tarballs (local file on the user's machine; integrity
+    //     adds nothing the user doesn't already control).
+    //   - Git-hosted tarballs (URL contains the commit SHA; git's content-
+    //     addressed model binds the bytes to the commit). The `gitHosted`
+    //     flag may be absent on legacy lockfiles, so fall back to a URL
+    //     match — same logic as `toLockfileResolution`.
+    // For any other tarball entry a missing integrity is what a tampered
+    // lockfile looks like: the worker would mint a fresh integrity from
+    // whatever bytes the URL returned, so we fail closed here. Pacquet
+    // enforces the same invariant via
+    // `pacquet_package_manager::missing_tarball_integrity`.
+    if (resolution.type == null &&
+        resolution.integrity == null &&
+        !resolution.tarball?.startsWith('file:') &&
+        !(resolution.gitHosted === true || (resolution.tarball != null && isGitHostedTarballUrl(resolution.tarball)))) {
+        throw new PnpmError('MISSING_TARBALL_INTEGRITY', `Cannot install package "${depPath}": its lockfile entry has no "integrity" field, so pnpm cannot verify the downloaded tarball.`, { hint: 'The lockfile may be corrupted or have been tampered with. Restore it from a trusted source, or delete it and re-run installation without --frozen-lockfile to regenerate.' });
+    }
+    if (Boolean(resolution.type) ||
+        resolution.tarball?.startsWith('file:') ||
+        resolution.gitHosted === true) {
         return pkgSnapshot.resolution;
     }
     // Recover the tarball field for `file:` snapshots whose resolution lost

package/lib/toLockfileResolution.d.ts

@@ -4,3 +4,4 @@ export declare function toLockfileResolution(pkg: {
     name: string;
     version: string;
 }, resolution: Resolution, registry: string, lockfileIncludeTarballUrl?: boolean): LockfileResolution;
+export declare function isGitHostedTarballUrl(url: string): boolean;

package/lib/toLockfileResolution.js

@@ -58,7 +58,7 @@ function preservingGitHosted(resolution, gitHosted) {
 // Inlined to avoid pulling @pnpm/fetching.pick-fetcher into the lockfile-utils
 // dep graph. Used as a fallback when callers haven't pre-set the
 // `gitHosted` field on TarballResolution.
-function isGitHostedTarballUrl(url) {
+export function isGitHostedTarballUrl(url) {
     return (url.startsWith('https://codeload.github.com/') ||
         url.startsWith('https://bitbucket.org/') ||
         url.startsWith('https://gitlab.com/')) && url.includes('tar.gz');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.utils",
-  "version": "1100.0.8",
+  "version": "1100.0.10",
   "description": "Utils for dealing with pnpm-lock.yaml",
   "keywords": [
     "pnpm",
@@ -28,12 +28,12 @@
   "dependencies": {
     "get-npm-tarball-url": "^2.1.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/deps.path": "1100.0.3",
-    "@pnpm/lockfile.types": "1100.0.6",
-    "@pnpm/resolving.resolver-base": "1100.2.0",
-    "@pnpm/types": "1101.1.0",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/hooks.types": "1100.0.7"
+    "@pnpm/deps.path": "1100.0.5",
+    "@pnpm/lockfile.types": "1100.0.8",
+    "@pnpm/hooks.types": "1100.0.9",
+    "@pnpm/types": "1101.2.0",
+    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/error": "1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -41,7 +41,7 @@
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/lockfile.utils": "1100.0.8"
+    "@pnpm/lockfile.utils": "1100.0.10"
   },
   "engines": {
     "node": ">=22.13"