@pnpm/resolving.npm-resolver 1101.3.3 → 1101.5.0

package/lib/createNpmResolutionVerifier.d.ts

@@ -71,15 +71,18 @@ export interface CreateNpmResolutionVerifierOptions {
     now?: number;
 }
 /**
- * Returns a `ResolutionVerifier` that re-applies the `minimumReleaseAge`
- * and/or `trustPolicy='no-downgrade'` policies to npm-registry-resolved
- * lockfile entries, or `undefined` when no policy is active. Pairs with
- * `createNpmResolver`: each resolver factory may export a sibling
- * verifier factory that the default-resolver combines.
+ * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
+ * entries. It always binds each entry's recorded tarball URL to the
+ * artifact the registry's metadata lists (an anti-tamper check that does
+ * not depend on any policy), and additionally re-applies the
+ * `minimumReleaseAge` and/or `trustPolicy='no-downgrade'` policies when
+ * those are configured. Pairs with `createNpmResolver`: each resolver
+ * factory may export a sibling verifier factory that the default-resolver
+ * combines.
  *
  * Designed for fail-closed semantics: if the manifest can't be loaded or
  * the pinned version is missing from it, the verifier reports a violation
  * rather than silently passing. Mirrors the post-resolution gate bun added
  * for the same shape of bug in oven-sh/bun#30526.
  */
-export declare function createNpmResolutionVerifier(opts: CreateNpmResolutionVerifierOptions): ResolutionVerifier | undefined;
+export declare function createNpmResolutionVerifier(opts: CreateNpmResolutionVerifierOptions): ResolutionVerifier;

package/lib/createNpmResolutionVerifier.js

@@ -5,16 +5,20 @@ import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
 import { fetchAttestationPublishedAt } from './fetchAttestationPublishedAt.js';
 import { fetchAbbreviatedMetadataCached, fetchFullMetadataCached, } from './fetchFullMetadataCached.js';
+import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { BUILTIN_NAMED_REGISTRIES } from './parseBareSpecifier.js';
 import { getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
-import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 /**
- * Returns a `ResolutionVerifier` that re-applies the `minimumReleaseAge`
- * and/or `trustPolicy='no-downgrade'` policies to npm-registry-resolved
- * lockfile entries, or `undefined` when no policy is active. Pairs with
- * `createNpmResolver`: each resolver factory may export a sibling
- * verifier factory that the default-resolver combines.
+ * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
+ * entries. It always binds each entry's recorded tarball URL to the
+ * artifact the registry's metadata lists (an anti-tamper check that does
+ * not depend on any policy), and additionally re-applies the
+ * `minimumReleaseAge` and/or `trustPolicy='no-downgrade'` policies when
+ * those are configured. Pairs with `createNpmResolver`: each resolver
+ * factory may export a sibling verifier factory that the default-resolver
+ * combines.
  *
  * Designed for fail-closed semantics: if the manifest can't be loaded or
  * the pinned version is missing from it, the verifier reports a violation
@@ -24,10 +28,6 @@ import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } f
 export function createNpmResolutionVerifier(opts) {
     const ageCheckActive = Boolean(opts.minimumReleaseAge);
     const trustCheckActive = opts.trustPolicy === 'no-downgrade';
-    // No policy → no verifier. Skipping early keeps the install-side fan-out
-    // empty when nothing is configured.
-    if (!ageCheckActive && !trustCheckActive)
-        return undefined;
     const cutoff = ageCheckActive
         ? (opts.now ?? Date.now()) - opts.minimumReleaseAge * 60 * 1000
         : 0;
@@ -84,20 +84,37 @@ export function createNpmResolutionVerifier(opts) {
     const minimumReleaseAge = opts.minimumReleaseAge ?? 0;
     const trustPolicy = opts.trustPolicy;
     const trustPolicyIgnoreAfter = opts.trustPolicyIgnoreAfter;
-    const verify = async (resolution, { name, version }) => {
+    const verify = async (resolution, { name, version, nonSemverVersion }) => {
         if (!isNpmRegistryResolution(resolution))
             return { ok: true };
-        // Non-semver versions identify URL tarballs, file: refs, git refs, etc.
-        // Neither the age nor the trust policy applies, and a registry lookup
+        // URL/git-keyed entries are deliberate non-registry deps. They can still
+        // carry a semver `version` copied from the resolved manifest, so the
+        // semver guard below isn't enough on its own — the registry policies and
+        // the tarball-URL binding don't apply to them, and a registry lookup
         // would 404.
+        if (nonSemverVersion != null)
+            return { ok: true };
         if (!semver.valid(version))
             return { ok: true };
+        const tarballUrl = resolution.tarball;
+        const registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
+        // A registry entry that pins an explicit tarball URL must point at the
+        // artifact the registry's own metadata lists. Otherwise a trusted
+        // `name@version` could front bytes from an attacker-chosen URL (with a
+        // matching integrity for those bytes). This binding is unconditional —
+        // it does not depend on `minimumReleaseAge`/`trustPolicy` and isn't
+        // narrowed by their exclude lists, since it guards integrity rather
+        // than maturity/trust. Registry entries with no tarball URL reconstruct
+        // it from name+version+registry, so they're inherently bound.
+        if (typeof tarballUrl === 'string') {
+            const urlViolation = await runTarballUrlCheck(lookupContext, registry, name, version, tarballUrl);
+            if (urlViolation)
+                return urlViolation;
+        }
         const ageApplies = ageCheckActive && !isExcluded(excludePolicy, name, version);
         const trustApplies = trustCheckActive && !isExcluded(trustExcludePolicy, name, version);
         if (!ageApplies && !trustApplies)
             return { ok: true };
-        const tarballUrl = resolution.tarball;
-        const registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
         if (ageApplies) {
             const ageViolation = await runAgeCheck(lookupContext, registry, name, version, cutoff, opts.ignoreMissingTimeField === true);
             if (ageViolation)
@@ -127,6 +144,12 @@ export function createNpmResolutionVerifier(opts) {
     return {
         verify,
         policy: {
+            // Marks runs that enforced the tarball-URL binding. A cache record
+            // written before this rule existed lacks the flag, so
+            // `canTrustPastCheck` rejects it and forces a re-verification that
+            // applies the binding — otherwise an upgrade could keep trusting a
+            // lockfile that was only ever age/trust-checked.
+            tarballUrlBinding: true,
             minimumReleaseAge,
             minimumReleaseAgeExclude: sortedMinAgeExcludes,
             trustPolicy: trustPolicy ?? null,
@@ -134,6 +157,10 @@ export function createNpmResolutionVerifier(opts) {
             trustPolicyIgnoreAfter: trustPolicyIgnoreAfter ?? null,
         },
         canTrustPastCheck: (cached) => {
+            // The tarball-URL binding is unconditional today; a cached run that
+            // didn't record it can't be trusted to have enforced it.
+            if (cached.tarballUrlBinding !== true)
+                return false;
             // Maturity: a previously cached run under a larger cutoff
             // (stricter window) is trustworthy under a smaller current one —
             // its set of accepted versions is a subset of today's. The
@@ -223,6 +250,44 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
     }
     return undefined;
 }
+/**
+ * Confirm the lockfile-pinned tarball URL is the artifact the registry's
+ * own metadata lists for this exact `name@version`.
+ *
+ * Fail-closed: the entry passes only when the registry metadata
+ * affirmatively lists this version with a matching tarball URL. If the
+ * metadata can't be fetched, doesn't list the version, or omits
+ * `dist.tarball`, the entry can't be confirmed and is rejected — otherwise
+ * a tampered lockfile could smuggle a malicious URL past the check by
+ * pointing it at a `name@version` the registry can't vouch for.
+ */
+async function runTarballUrlCheck(context, registry, name, version, lockfileTarball) {
+    const meta = await fetchAbbreviatedMeta(context, registry, name);
+    const registryTarball = meta?.versionTarballs?.get(version);
+    if (registryTarball != null && sameTarballUrl(lockfileTarball, registryTarball)) {
+        return undefined;
+    }
+    return {
+        ok: false,
+        code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
+        reason: registryTarball == null
+            ? "could not be verified against the registry's published metadata"
+            : `has a tarball URL (${lockfileTarball}) that does not match the registry's published metadata (${registryTarball})`,
+    };
+}
+function sameTarballUrl(a, b) {
+    return canonicalTarballUrl(a) === canonicalTarballUrl(b);
+}
+// Mirror the tolerance toLockfileResolution applies when it decides whether
+// a tarball URL is "the expected one": ignore the protocol and `%2f` scope
+// encoding so a benign http/https or encoding difference isn't read as
+// tampering. The `%2f` match is case-insensitive because `normalizeRegistryUrl`
+// (`new URL().toString()`) can upper-case percent-escapes to `%2F`.
+function canonicalTarballUrl(url) {
+    const normalized = normalizeRegistryUrl(url).replace(/%2f/gi, '/');
+    const schemeEnd = normalized.indexOf('://');
+    return schemeEnd === -1 ? normalized : normalized.slice(schemeEnd + 3);
+}
 /**
  * Run the resolver-time `failIfTrustDowngraded` check against the
  * pinned lockfile version. The packument is fetched through a
@@ -341,12 +406,23 @@ function projectTrustManifest(manifest) {
     // reads them; cast away the unsoundness so callers see the same nominal
     // shape without the per-version dependency graph / scripts / README bulk
     // carrying through. `_npmUser` is similarly narrowed to just
-    // `trustedPublisher` — the only sub-field the trust check inspects — so
-    // we don't keep maintainer name/email PII resident in the cache.
+    // `trustedPublisher` and `approver` — the only sub-fields the trust check
+    // inspects — so we don't keep maintainer name/email PII resident in the
+    // cache.
+    const approver = manifest._npmUser?.approver;
     const trustedPublisher = manifest._npmUser?.trustedPublisher;
     const provenance = manifest.dist?.attestations?.provenance;
+    let npmUser = undefined;
+    if (approver) {
+        npmUser ||= {};
+        npmUser.approver = {};
+    }
+    if (trustedPublisher) {
+        npmUser ||= {};
+        npmUser.trustedPublisher = trustedPublisher;
+    }
     return {
-        _npmUser: trustedPublisher != null ? { trustedPublisher } : undefined,
+        _npmUser: npmUser,
         dist: provenance != null
             ? { attestations: { provenance } }
             : undefined,
@@ -429,7 +505,7 @@ async function tryAbbreviatedModifiedShortcut(context, registry, name, version)
     // publish time — but only for versions the registry currently lists.
     // An unpublished or never-published pin would otherwise pass the gate
     // on a stale package-level timestamp.
-    if (!meta?.versionNames?.has(version))
+    if (!meta?.versionTarballs?.has(version))
         return undefined;
     return modified;
 }
@@ -492,18 +568,26 @@ function validateSharedMeta(meta, name) {
         return undefined;
     return meta;
 }
-// Project the abbreviated packument down to the two fields the verifier
-// actually reads — package-level `modified` and the set of version names
-// for the existence check inside `tryAbbreviatedModifiedShortcut`. The
+// Project the abbreviated packument down to the few fields the verifier
+// actually reads — package-level `modified`, plus a per-version map of
+// `dist.tarball` (whose keys double as the version-existence set for the
+// `tryAbbreviatedModifiedShortcut` check and the tarball-URL binding). The
 // resolver populates the abbreviated mirror with every version's
 // dependency / engine / dist info, which can run to hundreds of KB per
 // package and accumulate to many GB across a multi-thousand-entry
 // lockfile (see #11860). The full document is GC-able as soon as this
-// closure returns.
+// closure returns; only the short tarball-URL strings are retained.
 function projectAbbreviatedMeta(meta) {
+    let versionTarballs;
+    if (meta.versions) {
+        versionTarballs = new Map();
+        for (const [version, manifest] of Object.entries(meta.versions)) {
+            versionTarballs.set(version, manifest.dist?.tarball);
+        }
+    }
     return {
         modified: meta.modified,
-        versionNames: meta.versions ? new Set(Object.keys(meta.versions)) : undefined,
+        versionTarballs,
     };
 }
 function readLocalMetaTime(context, registry, name) {
@@ -542,12 +626,14 @@ function pickRegistryForVersion(registries, namedRegistryPrefixes, name, tarball
     // origin we'd otherwise miss. Match the longest prefix so that two named
     // registries sharing a host but differing by path don't collide.
     if (tarballUrl) {
-        const normalized = tryParseUrl(tarballUrl)?.toString();
-        if (normalized) {
-            for (const prefix of namedRegistryPrefixes) {
-                if (normalized.startsWith(prefix))
-                    return prefix;
-            }
+        // Match on the same canonical form the tarball comparison uses, so a
+        // named-registry tarball that differs from the configured base only by
+        // scheme or `%2f` encoding still routes to its registry instead of
+        // falling back (and then failing closed against the wrong packument).
+        const normalized = canonicalTarballUrl(tarballUrl);
+        for (const prefix of namedRegistryPrefixes) {
+            if (normalized.startsWith(canonicalTarballUrl(prefix)))
+                return prefix;
         }
     }
     return pickRegistryForPackage(registries, name);
@@ -597,6 +683,14 @@ function isNpmRegistryResolution(resolution) {
     // the resolver and aren't subject to release-age policy.
     if ('gitHosted' in resolution && resolution.gitHosted)
         return false;
+    const tarball = resolution.tarball;
+    if (typeof tarball === 'string') {
+        // Local/non-registry tarballs (for example `file:`) have no packument
+        // metadata, so minimumReleaseAge/trustPolicy verification cannot apply.
+        const protocol = tryParseUrl(tarball)?.protocol;
+        if (protocol != null && protocol !== 'http:' && protocol !== 'https:')
+            return false;
+    }
     return 'tarball' in resolution || 'integrity' in resolution;
 }
 //# sourceMappingURL=createNpmResolutionVerifier.js.map

package/lib/pickPackage.js

@@ -201,7 +201,7 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
         }
-        if (opts.publishedBy) {
+        if (opts.publishedBy && opts.publishedByExclude?.(spec.name) !== true) {
             const mtime = await limit(async () => getFileMtime(pkgMirror));
             if (mtime != null && mtime >= opts.publishedBy) {
                 metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));

package/lib/trustChecks.d.ts

@@ -1,6 +1,6 @@
 import type { PackageInRegistry, PackageMeta } from '@pnpm/resolving.registry.types';
 import type { PackageVersionPolicy } from '@pnpm/types';
-type TrustEvidence = 'provenance' | 'trustedPublisher';
+type TrustEvidence = 'provenance' | 'trustedPublisher' | 'stagedPublish';
 export declare function failIfTrustDowngraded(meta: PackageMeta, version: string, opts?: {
     trustPolicyExclude?: PackageVersionPolicy;
     trustPolicyIgnoreAfter?: number;

package/lib/trustChecks.js

@@ -2,6 +2,7 @@ import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
 import { assertMetaHasTime } from './pickPackageFromMeta.js';
 const TRUST_RANK = {
+    stagedPublish: 3,
     trustedPublisher: 2,
     provenance: 1,
 };
@@ -51,6 +52,7 @@ export function failIfTrustDowngraded(meta, version, opts) {
 }
 function prettyPrintTrustEvidence(trustEvidence) {
     switch (trustEvidence) {
+        case 'stagedPublish': return 'staged publish';
         case 'trustedPublisher': return 'trusted publisher';
         case 'provenance': return 'provenance attestation';
         default: return 'no trust evidence';
@@ -70,14 +72,19 @@ function detectStrongestTrustEvidenceBeforeDate(meta, beforeDate, options) {
         const trustEvidence = getTrustEvidence(manifest);
         if (!trustEvidence)
             continue;
-        if (trustEvidence === 'trustedPublisher') {
-            return 'trustedPublisher';
+        if (best === undefined || TRUST_RANK[trustEvidence] > TRUST_RANK[best]) {
+            best = trustEvidence;
+            if (best === 'stagedPublish') {
+                return best;
+            }
         }
-        best ||= 'provenance';
     }
     return best;
 }
 export function getTrustEvidence(manifest) {
+    if (manifest._npmUser?.approver) {
+        return 'stagedPublish';
+    }
     if (manifest._npmUser?.trustedPublisher && manifest.dist?.attestations?.provenance) {
         return 'trustedPublisher';
     }

package/lib/violationCodes.d.ts

@@ -10,3 +10,4 @@
  */
 export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_VIOLATION";
 export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";
+export declare const TARBALL_URL_MISMATCH_VIOLATION_CODE = "TARBALL_URL_MISMATCH";

package/lib/violationCodes.js

@@ -10,4 +10,5 @@
  */
 export const MINIMUM_RELEASE_AGE_VIOLATION_CODE = 'MINIMUM_RELEASE_AGE_VIOLATION';
 export const TRUST_DOWNGRADE_VIOLATION_CODE = 'TRUST_DOWNGRADE';
+export const TARBALL_URL_MISMATCH_VIOLATION_CODE = 'TARBALL_URL_MISMATCH';
 //# sourceMappingURL=violationCodes.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.3.3",
+  "version": "1101.5.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -10,7 +10,10 @@
   ],
   "license": "MIT",
   "funding": "https://opencollective.com/pnpm",
-  "repository": "https://github.com/pnpm/pnpm/tree/main/resolving/npm-resolver",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/pnpm/tree/main/resolving/npm-resolver"
+  },
   "homepage": "https://github.com/pnpm/pnpm/tree/main/resolving/npm-resolver#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
@@ -40,27 +43,27 @@
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.6",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.1.2",
+    "@pnpm/config.pick-registry-for-package": "1100.0.7",
+    "@pnpm/config.version-policy": "1100.1.3",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/config.version-policy": "1100.1.2",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.5",
-    "@pnpm/resolving.registry.types": "1100.0.5",
-    "@pnpm/resolving.resolver-base": "1100.3.1",
-    "@pnpm/store.cafs": "1100.1.7",
-    "@pnpm/store.index": "1100.1.0",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/types": "1101.2.0",
-    "@pnpm/workspace.range-resolver": "1100.0.1",
     "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/resolving.registry.types": "1100.1.1",
+    "@pnpm/resolving.resolver-base": "1100.4.0",
+    "@pnpm/store.cafs": "1100.1.8",
+    "@pnpm/store.index": "1100.1.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.7",
+    "@pnpm/core-loggers": "1100.1.3",
+    "@pnpm/types": "1101.3.0",
+    "@pnpm/fetching.types": "1100.0.1",
+    "@pnpm/workspace.range-resolver": "1100.0.1",
+    "@pnpm/error": "1100.0.0",
     "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.8"
+    "@pnpm/worker": "^1100.1.9"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -70,11 +73,11 @@
     "@types/ssri": "^7.1.5",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.7",
-    "@pnpm/resolving.npm-resolver": "1101.3.3",
+    "@pnpm/network.fetch": "1100.1.0",
+    "@pnpm/resolving.npm-resolver": "1101.5.0",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/network.fetch": "1100.0.7"
+    "@pnpm/testing.mock-agent": "1101.0.0",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"