@preventive/upstream 1.3.0 → 1.4.0

package/cocoapods.d.ts

@@ -0,0 +1,33 @@
+// The name is asserted to be a root's as Podfile.lock writes it, printable
+// ASCII but for spaces, parentheses, slashes and backslashes, with no `.`
+// first; the version one of Pod::Version's; and the checksum 40 lowercase
+// hex digits, before any request or cache path. The cache is setCacheDir's
+// (npm.js).
+
+export { HttpError } from './npm.js'
+
+// A version's podspec from trunk, the JSON CocoaPods reads, whole, in
+// memory, as the CDN serves it under Specs/<a>/<b>/<c>/<name>/<version>/,
+// the first three hex digits of the md5 of the name: the files of
+// CocoaPods/Specs, so a pod from https://github.com/CocoaPods/Specs.git
+// too. Trunk says nothing of what a podspec hashes to, so `checksum` is
+// required: its sha1, as Podfile.lock records it in SPEC CHECKSUMS. The
+// bytes are checked against it, whether they were downloaded (before they
+// are cached) or read from a cache. The CDN's redirect to jsDelivr is
+// followed, as the bytes are checked whoever answers.
+//
+// A podspec is not fixed once trunk has it: `pod trunk deprecate` adds a
+// field to the latest version's. So one is cached by its checksum as well
+// as its version, and a lockfile written before such a change has a
+// checksum no download matches any longer, which throws.
+//
+// CocoaPods' own spec repos are read first, and never written: that path
+// in each directory under $CP_REPOS_DIR, else $CP_HOME_DIR/repos, else
+// `~/.cocoapods/repos`. A file there that does not match is passed over.
+// One in setCacheDir's cache that does not match throws. A cached podspec
+// that matches is answered with no request at all.
+//
+// What the pod is built from is not trunk's, and is not fetched here: a
+// commit of a GitHub repo, as a podspec's `source` or CHECKOUT OPTIONS
+// may name, is github.js's getRepoTarball's.
+export function getPodspec(name: string, version: string, checksum: string): Promise<Uint8Array>

package/cocoapods.js

@@ -0,0 +1,2 @@
+export { getPodspec } from './src/cocoapods.js'
+export { HttpError } from './src/http.js'

package/github.d.ts

@@ -89,6 +89,17 @@ export interface Client {
   // `node_modules`, of packages installed. A symlink is no file. Refused
   // where a path found is one getRepoFile does not take, such as one with a
   // control character in it.
+  // How `head` stands to `base` in the repo (each a full commit sha, or a
+  // branch or tag name), as GitHub's compare tells it: `ahead` where `base`
+  // is in `head`'s history, `behind` the other way round, `identical`, or
+  // `diverged`; with the commits each has that the other hasn't, and their
+  // merge base. Refused unless the status agrees with those counts, the
+  // merge base is `base` where `head` is ahead of it or the same, and the
+  // base GitHub compared is `base` where that is a commit. GitHub answers
+  // for a commit of any fork of the repo too, through the repo's own name:
+  // whether one is the repo's own is whether a ref of the repo (its default
+  // branch, say) is ahead of it or the same.
+  compareCommits(options: { repo: RepoName; base: string; head: string }): Promise<{ status: 'ahead' | 'behind' | 'identical' | 'diverged'; aheadBy: number; behindBy: number; mergeBase: string }>
   findRepoLockfiles(options: { repo: RepoName; sha: string; directory?: string }): Promise<{ lockfiles: RepoLockfile[]; projects: RepoProjectFile[] }>
   // An advisory by its GHSA id. With `repo`, that repository's published
   // copy: the maintainer's latest text, there before GitHub reviews it,
@@ -169,6 +180,10 @@ export interface Client {
   // found as getRepoTreeId finds it: GitHub's listing, hashed back to the
   // tree's id, so none is left out or changed.
   listRepoDir(options: { repo: RepoName; sha: string; directory?: string }): Promise<RepoDirEntry[]>
+  // Every page of the repo's branches, as GitHub lists them, each with the
+  // commit at its head; more than `maxPages` (100 by default) pages of 100
+  // is an error, as is a branch with no commit.
+  listRepoBranches(options: { repo: RepoName; maxPages?: number }): Promise<{ branch: string; oid: string }[]>
   // Every page of the repo's tags, as GitHub lists them, each with the
   // commit GitHub names for it, an annotated tag's included, which
   // getRepoTag checks is one; more than `maxPages` (100 by default) pages

package/npm.d.ts

@@ -37,11 +37,12 @@ export const defaultCacheDir: string | undefined
 // with no request. Point it only at storage that
 // nothing less trusted than the caller can write, never a cache shared
 // with or restored from lower-trust jobs. Tarballs, crates (cargo.js), zips
-// (soldeer.js) and tree tarballs (github.js) don't rely on this, since
-// they are checked against their integrity on every call; and the version
-// documents kept here (getMeta) never supply an integrity, only confirm
-// one a caller gives (verifyDist, and getMeta with a `dist`). A call's `cache` option, where it has
-// one, keeps what it caches elsewhere, or writes none of it here.
+// (soldeer.js), podspecs (cocoapods.js) and tree tarballs (github.js) don't
+// rely on this, since they are checked against their integrity on every
+// call; and the version documents kept here (getMeta) never supply an
+// integrity, only confirm one a caller gives (verifyDist, and getMeta with
+// a `dist`). A call's `cache` option, where it has one, keeps what it
+// caches elsewhere, or writes none of it here.
 export function setCacheDir(dir?: string | false): void
 
 // A store of the caller's, a database's say, for what would otherwise be

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@preventive/upstream",
-  "version": "1.3.0",
-  "description": "Minimal npm, crates.io, Soldeer, GitHub and git checkout clients",
+  "version": "1.4.0",
+  "description": "Minimal npm, crates.io, Soldeer, CocoaPods trunk, GitHub and git checkout clients",
   "type": "module",
   "exports": {
     "./advisories.js": {
@@ -12,6 +12,10 @@
       "types": "./cargo.d.ts",
       "default": "./cargo.js"
     },
+    "./cocoapods.js": {
+      "types": "./cocoapods.d.ts",
+      "default": "./cocoapods.js"
+    },
     "./github.js": {
       "types": "./github.d.ts",
       "default": "./github.js"
@@ -52,6 +56,8 @@
     "advisories.js",
     "cargo.d.ts",
     "cargo.js",
+    "cocoapods.d.ts",
+    "cocoapods.js",
     "github.d.ts",
     "github.js",
     "git.d.ts",
@@ -79,6 +85,7 @@
     "src/cache.js",
     "src/cargo/crate.js",
     "src/cargo/repos.js",
+    "src/cocoapods.js",
     "src/download.js",
     "src/git.js",
     "src/github/client.js",

package/src/advisories/common.js

@@ -38,7 +38,7 @@ export function detailsOf(text, id) {
   return { details: text }
 }
 
-const SEVERITIES = new Set(['critical', 'high', 'moderate', 'low', 'info'])
+export const SEVERITIES = ['critical', 'high', 'moderate', 'low', 'info']
 const isCvssVector = matches(/^CVSS:[34]\.\d(?:\/[A-Z]{1,4}:[A-Z]{1,2})+$/u)
 const isCwe = matches(/^CWE-\d{1,6}$/u)
 
@@ -48,7 +48,7 @@ const isCwe = matches(/^CWE-\d{1,6}$/u)
 export function metrics({ severity, score, vector, cwe }) {
   const word = typeof severity === 'string' ? severity.toLowerCase().replace(/^medium$/u, 'moderate') : undefined
   return {
-    ...(SEVERITIES.has(word) && { severity: word }),
+    ...(SEVERITIES.includes(word) && { severity: word }),
     ...(typeof score === 'number' && score > 0 && score <= 10 && { cvss: score }),
     ...(isCvssVector(vector) && { cvssVector: vector }),
     cwe: isStrings(cwe) ? cwe.filter(isCwe) : [],

package/src/advisories/index.js

@@ -2,7 +2,7 @@ import assert from 'node:assert/strict'
 
 import { assertArgs, assertBoolean, assertRepo, assertion, isIterable, optional, sameName } from '../args.js'
 import { assertCache } from '../cache.js'
-import { order } from './common.js'
+import { SEVERITIES, order } from './common.js'
 import { GITHUB, SOLDEER, assertClient } from './github.js'
 import { NPM } from './npm.js'
 import { CARGO, COMPOSER } from './osv.js'
@@ -37,7 +37,6 @@ function collect(packages) {
 // Which of an advisory's rows stands for it: npm's registry's, then OSV's,
 // then its repository's.
 const SOURCES = ['registry', 'osv', 'repository']
-const SEVERITIES = ['critical', 'high', 'moderate', 'low', 'info']
 const worse = (a, b) => (b === undefined || (a !== undefined && SEVERITIES.indexOf(a) < SEVERITIES.indexOf(b)) ? a : b)
 
 // An advisory's rows as one: the first's by source, what it lacks from the

package/src/args.js

@@ -99,6 +99,12 @@ export const assertSoldeerName = assertion('a Soldeer package name', matches(/^(
 // Soldeer takes any version but an empty one. Its registry has semver
 // (`5.7.0-rc.0`, `1.0.2-solc-0.8-simulate`), bare numbers and commit hashes.
 export const assertSoldeerVersion = assertion('letters, digits, `.`, `_`, `+` and `-`', matches(/^(?=.{1,128}$)[\dA-Za-z][\w.+-]*$/u))
+// A root's name as Podfile.lock has it, and @preventive/lockfile reads it:
+// printable ASCII but for spaces, parentheses, slashes and backslashes, no
+// `.` first, which the spec linter refuses, and 1024 characters at most.
+const assertPodName = assertion('a pod\'s root name', matches(/^(?=.{1,1024}$)(?!\.)[!-'*-.0-[\]-~]+$/u))
+// Pod::Version's pattern, as Podfile.lock writes a version.
+const assertPodVersion = assertion('a CocoaPods version', matches(/^(?=.{1,256}$)\d+(?:\.[\dA-Za-z-]+)*(?:\+[\dA-Za-z.-]+)?$/u))
 // A package's name and version, as a registry's getters take them.
 const assertNameVersion = (assertName, assertVersion) => (method, name, version) => {
   assertName(method, 'name', name)
@@ -107,5 +113,8 @@ const assertNameVersion = (assertName, assertVersion) => (method, name, version)
 export const assertCrate = assertNameVersion(assertCrateName, assertCrateVersion)
 export const assertPackage = assertNameVersion(assertPackageName, assertPackageVersion)
 export const assertSoldeerPackage = assertNameVersion(assertSoldeerName, assertSoldeerVersion)
+export const assertPod = assertNameVersion(assertPodName, assertPodVersion)
 // As Cargo.lock and soldeer.lock write a checksum.
 export const assertSha256 = assertion('a sha256 in lowercase hex', matches(/^[\da-f]{64}$/u))
+// As Podfile.lock writes a podspec's checksum.
+export const assertSha1 = assertion('a sha1 in lowercase hex', isSha1)

package/src/cache.js

@@ -10,7 +10,7 @@ import { assertCacheName, assertDirectoryPath, assertion, isRepo } from './args.
 import { MAX_BYTES, decode } from './http.js'
 import { pool } from './pool.js'
 
-const DIRS = new Set(['npm/repos', 'npm/tarballs', 'npm/versions', 'cargo/repos', 'cargo/crates', 'composer/repos', 'soldeer/repos', 'soldeer/zips', 'github/trees', 'github/advisories'])
+const DIRS = new Set(['npm/repos', 'npm/tarballs', 'npm/versions', 'cargo/repos', 'cargo/crates', 'composer/repos', 'soldeer/repos', 'soldeer/zips', 'cocoapods/podspecs', 'github/trees', 'github/advisories'])
 const RECORD_TTL_MS = 30 * 24 * 60 * 60 * 1000 // A link only moves on a transfer or rename, and GitHub redirects those.
 const RECORDS_AT_ONCE = 8
 // JSON filed gzipped, as `<name>.json.gz`: a listing carries each

package/src/cocoapods.js

@@ -0,0 +1,51 @@
+import { createHash } from 'node:crypto'
+import { readdir } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+import { assertPod, assertSha1 } from './args.js'
+import { verifiedDownload } from './download.js'
+import { COCOAPODS_CDN, buildUrl, encodeSegment } from './http.js'
+
+// No expiry, but kept by checksum as well: trunk refuses a version it
+// already has, yet rewrites a podspec it has, as `pod trunk deprecate`
+// adds a field to the latest version's.
+const DIR = 'cocoapods/podspecs'
+
+// Where a spec repo keeps a version's podspec: under a directory each for
+// the first three hex digits of the md5 of the name, as
+// Pod::Source::Metadata shards trunk, and CocoaPods/Specs with it.
+function specPath(name, version) {
+  const shard = createHash('md5').update(name).digest('hex').slice(0, 3)
+  return ['Specs', ...shard, name, version, `${name}.podspec.json`]
+}
+
+// CocoaPods' spec repos, a directory each under $CP_REPOS_DIR, else
+// $CP_HOME_DIR/repos, else ~/.cocoapods/repos: `trunk` with the podspecs
+// it read off the CDN as they were served, `master` a clone of
+// CocoaPods/Specs, others a team's own. os.homedir() throws where there is
+// no home directory to be found.
+async function localPaths(name, version) {
+  const { CP_REPOS_DIR, CP_HOME_DIR } = process.env
+  let root
+  try {
+    root = resolve(CP_REPOS_DIR || join(CP_HOME_DIR || join(homedir(), '.cocoapods'), 'repos'))
+  } catch {
+    return []
+  }
+  return (await readdir(root).catch(() => [])).map((repo) => join(root, repo, ...specPath(name, version)))
+}
+
+// Trunk has no hash to check a podspec against, so the caller brings one,
+// as Podfile.lock records it. The CDN redirects to jsDelivr, which is
+// followed: whoever answers, the bytes are held to the checksum.
+export async function getPodspec(name, version, checksum) {
+  assertPod('getPodspec', name, version)
+  assertSha1('getPodspec', 'checksum', checksum)
+  const what = `${name}@${version}`
+  const locate = () => buildUrl(COCOAPODS_CDN, specPath(name, version).map(encodeSegment))
+  return await verifiedDownload({
+    method: 'getPodspec', dir: DIR, what, entry: `${what}-${checksum}`, ext: 'podspec.json', algorithm: 'sha1', expected: checksum,
+    local: await localPaths(name, version), locate, options: { redirect: 'follow' },
+  })
+}

package/src/download.js

@@ -6,11 +6,13 @@ import { request } from './http.js'
 import { gitTreeOfTarball } from './tree.js'
 
 // A hash as each registry writes it: npm's integrity, one sha512 in base64
-// after `sha512-`; crates.io's and Soldeer's checksum, a sha256 in hex; a
-// git tree id for a tarball of that tree.
+// after `sha512-`; crates.io's and Soldeer's checksum, a sha256 in hex;
+// Podfile.lock's checksum of a podspec, a sha1 in hex; a git tree id for a
+// tarball of that tree.
 const DIGESTS = {
   sha512: (bytes) => `sha512-${createHash('sha512').update(bytes).digest('base64')}`,
   sha256: (bytes) => createHash('sha256').update(bytes).digest('hex'),
+  sha1: (bytes) => createHash('sha1').update(bytes).digest('hex'),
   tree: gitTreeOfTarball,
 }
 
@@ -20,12 +22,12 @@ const DIGESTS = {
 // whether set or not (read, never written; a mismatch is passed over),
 // else the cache set, or a `cache` store in its place (readBytes; a
 // mismatch throws), else what `locate` answers, checked and then kept as
-// writeBytes keeps it. A tree's `list` and `symlinksAbove` are
-// gitTreeOfTarball's.
-export async function verifiedDownload({ method, dir, what, ext, algorithm, expected, local = [], ours = false, cache, locate, options = {}, list, symlinksAbove }) {
+// writeBytes keeps it, as `entry`, `what` unless given. A tree's `list`
+// and `symlinksAbove` are gitTreeOfTarball's.
+export async function verifiedDownload({ method, dir, what, entry = what, ext, algorithm, expected, local = [], ours = false, cache, locate, options = {}, list, symlinksAbove }) {
   assert.ok(Object.hasOwn(DIGESTS, algorithm) && typeof expected === 'string' && expected !== '', `${method}: nothing to check ${what} against`)
   const digest = (bytes) => DIGESTS[algorithm](bytes, { expected, list, symlinksAbove })
-  const key = `${what}.${ext}`
+  const key = `${entry}.${ext}`
   for (const path of ours ? [...local, ...ourCachePaths(dir, key)] : local) {
     const bytes = await readRegularFile(path)
     if (bytes && await digest(bytes) === expected) return bytes
@@ -35,10 +37,10 @@ export async function verifiedDownload({ method, dir, what, ext, algorithm, expe
     assert.ok(actual === expected, `${method}: integrity mismatch for ${what} from ${from}: expected ${expected}, got ${actual}`)
     return bytes
   }
-  const cached = await readBytes(dir, what, key, cache)
+  const cached = await readBytes(dir, entry, key, cache)
   if (cached) return await check(cached, cache ? 'the store' : 'the cache')
   const url = await locate()
   const bytes = await check(await request(url, { ...options, as: 'bytes' }), url)
-  await writeBytes(dir, what, key, bytes, cache)
+  await writeBytes(dir, entry, key, bytes, cache)
   return bytes
 }

package/src/git.js

@@ -52,7 +52,6 @@ export async function findGitCheckout(dir) {
   const dirs = start && await isDirectory(start) ? await findGitDirs(start) : null
   if (dirs === null) return {}
   const directory = relative(dirs.root, start).split(sep).join('/')
-  const github = await originGitHub(dirs.commonDir)
-  const commit = await headCommit(dirs.gitDir, dirs.commonDir)
+  const [github, commit] = await Promise.all([originGitHub(dirs.commonDir), headCommit(dirs.gitDir, dirs.commonDir)])
   return { ...(github && { github }), directory, ...(github && { url: `https://github.com/${github}` }), ...(commit && { commit }) }
 }

package/src/github/read.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict'
 import { Buffer } from 'node:buffer'
 
-import { assertArgs, assertBoolean, assertGhsa, assertLevels, assertLogin, assertNumber, assertPath, assertRef, assertRepo, assertSha, assertTagName, assertTreeId, isRepo, isSha, isSha1, isTagName, optional, sameName, show } from '../args.js'
+import { assertArgs, assertBoolean, assertGhsa, assertLevels, assertLogin, assertNumber, assertPath, assertRef, assertRepo, assertSha, assertTagName, assertTreeId, assertion, isRefName, isRepo, isSha, isSha1, isTagName, optional, sameName, show } from '../args.js'
 import { verifiedDownload } from '../download.js'
 import { HttpError, decode, encodeSegment, requestWithHeaders } from '../http.js'
 import { FORMATS, lockfileOf, projectFormats } from '../lockfiles.js'
@@ -111,6 +111,49 @@ async function listRepoTags(headers, options) {
   })
 }
 
+// GitHub lists each branch with the commit at its head.
+async function listRepoBranches(headers, options) {
+  assertArgs('listRepoBranches', options, { repo: assertRepo, maxPages: optional(assertNumber) })
+  const { repo, maxPages } = options
+  const branches = await paginate('listRepoBranches', headers, (paging) => repoApi(repo, ['branches'], paging), maxPages)
+  return branches.map((entry) => {
+    assert.ok(isRefName(entry?.name) && isSha(entry.commit?.sha), `listRepoBranches: GitHub listed ${show(entry?.name)} in ${repo}, which is no branch name with a commit`)
+    return { branch: entry.name, oid: entry.commit.sha }
+  })
+}
+
+const assertRevision = assertion('a full commit sha, or a branch or tag name', (value) => isSha(value) || isRefName(value))
+// What GitHub's compare says of the counts it gives with it.
+const COMPARED = {
+  ahead: (ahead, behind) => ahead > 0 && behind === 0,
+  behind: (ahead, behind) => ahead === 0 && behind > 0,
+  identical: (ahead, behind) => ahead === 0 && behind === 0,
+  diverged: (ahead, behind) => ahead > 0 && behind > 0,
+}
+const isCount = (value) => Number.isSafeInteger(value) && value >= 0
+
+// How `head` stands to `base` in the repo, as GitHub's compare tells it:
+// `ahead` where `base` is in `head`'s history, `behind` the other way round,
+// `identical`, or `diverged`; with the commits each has that the other
+// hasn't, and their merge base. Refused unless the status agrees with those
+// counts, the merge base is `base` where `head` is ahead of it or the same,
+// and the base GitHub compared is `base` where that is a commit. GitHub
+// answers for a commit of any fork of the repo too: whether one is the
+// repo's own is whether a ref of the repo has it in its history.
+async function compareCommits(headers, options) {
+  assertArgs('compareCommits', options, { repo: assertRepo, base: assertRevision, head: assertRevision })
+  const { repo, base, head } = options
+  const body = await call(headers, repoApi(repo, ['compare', `${encodeSegment(base)}...${encodeSegment(head)}`], { per_page: 1 }))
+  const { status, ahead_by: aheadBy, behind_by: behindBy } = body ?? {}
+  const baseCommit = body?.base_commit?.sha
+  const mergeBase = body?.merge_base_commit?.sha
+  assert.ok(Object.hasOwn(COMPARED, status) && isCount(aheadBy) && isCount(behindBy) && COMPARED[status](aheadBy, behindBy),
+    `compareCommits: GitHub compared ${repo} ${base}...${head} as ${show(status)}, ${show(aheadBy)} ahead and ${show(behindBy)} behind`)
+  assert.ok(isSha(baseCommit) && isSha(mergeBase) && (!isSha(base) || baseCommit === base) && (!['ahead', 'identical'].includes(status) || mergeBase === baseCommit),
+    `compareCommits: GitHub compared ${repo} ${base}...${head} from ${show(baseCommit)}, merge base ${show(mergeBase)}`)
+  return { status, aheadBy, behindBy, mergeBase }
+}
+
 // GitHub's object for the path first: a directory, symlink or submodule is
 // refused rather than read as a file's text. Up to 1 MB the object holds
 // the content; past it, `encoding: none`, and the blob it names is read,
@@ -305,5 +348,5 @@ async function listRepoAdvisories(headers, options) {
   return (await Array.fromAsync(cursorPages('listRepoAdvisories', headers, pageUrl))).flat()
 }
 
-export const readMethods = { getCurrentUser, listUserRepos, getRepo, getRepoHead, getRepoTag, listRepoTags, getRepoFile, getRepoTarball, getRepoTreeTarball, getRepoTreeId, listRepoDir, findRepoLockfiles, getPullRequest, getCollaboratorPermission, getAdvisory, listRepoAdvisories }
+export const readMethods = { getCurrentUser, listUserRepos, getRepo, getRepoHead, getRepoTag, listRepoTags, listRepoBranches, compareCommits, getRepoFile, getRepoTarball, getRepoTreeTarball, getRepoTreeId, listRepoDir, findRepoLockfiles, getPullRequest, getCollaboratorPermission, getAdvisory, listRepoAdvisories }
 export const createClient = (options) => bindMethods(clientHeaders('createClient', options, true), readMethods)

package/src/http.js

@@ -15,9 +15,10 @@ export const CRATES_INDEX = 'https://index.crates.io'
 export const CRATES_STATIC = 'https://static.crates.io'
 export const SOLDEER_API = 'https://api.soldeer.xyz'
 export const SOLDEER_REVISIONS = 'https://soldeer-revisions.s3.amazonaws.com'
+export const COCOAPODS_CDN = 'https://cdn.cocoapods.org'
 export const MAX_BYTES = 512 * 1024 * 1024
 
-const ORIGINS = new Set([NPM_REGISTRY, GITHUB_API, OSV_API, CRATES_API, PACKAGIST_REPO, CRATES_INDEX, CRATES_STATIC, SOLDEER_API, SOLDEER_REVISIONS])
+const ORIGINS = new Set([NPM_REGISTRY, GITHUB_API, OSV_API, CRATES_API, PACKAGIST_REPO, CRATES_INDEX, CRATES_STATIC, SOLDEER_API, SOLDEER_REVISIONS, COCOAPODS_CDN])
 const isSegment = matches(/^(?!\.\.?$)(?:[\w.~@-]|%[\dA-F]{2})+$/u)
 const isQueryKey = matches(/^[a-z_]+(?:\[\])?$/u)
 const isQueryValue = (value) => (typeof value === 'string' && value !== '') || (Number.isSafeInteger(value) && value >= 0)

package/src/npm/cacache.js

@@ -13,6 +13,7 @@ import { readRegularFile } from '../cache.js'
 const KEY = 'make-fetch-happen:request-cache:'
 const digest = (algorithm, data, encoding) => createHash(algorithm).update(data).digest(encoding)
 const shard = (hex) => [hex.slice(0, 2), hex.slice(2, 4), hex.slice(4)]
+export const contentPath = (cache, sha512) => join(cache, 'content-v2', 'sha512', ...shard(Buffer.from(sha512, 'base64').toString('hex')))
 const decoder = new TextDecoder('utf-8')
 
 async function lastEntry(root, key) {
@@ -39,6 +40,6 @@ export async function readNpmCached(root, url) {
   const integrity = typeof entry?.integrity === 'string' ? entry.integrity : ''
   const sha512 = /(?:^|\s)sha512-([\d+/A-Za-z]+={0,2})(?=[\s?]|$)/u.exec(integrity)?.[1]
   if (sha512 === undefined) return null
-  const body = await readRegularFile(join(root, 'content-v2', 'sha512', ...shard(Buffer.from(sha512, 'base64').toString('hex'))))
+  const body = await readRegularFile(contentPath(root, sha512))
   return body && digest('sha512', body, 'base64') === sha512 ? { body, metadata: entry.metadata } : null
 }

package/src/npm/tarball.js

@@ -1,4 +1,3 @@
-import { Buffer } from 'node:buffer'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 
@@ -6,7 +5,7 @@ import { assertArgs, assertPackage, assertPackageName, isPlainObject, isSha, opt
 import { assertCache } from '../cache.js'
 import { verifiedDownload } from '../download.js'
 import { NPM_REGISTRY, decode } from '../http.js'
-import { readNpmCached } from './cacache.js'
+import { contentPath, readNpmCached } from './cacache.js'
 import { getDocument, withNpmToken } from './registry.js'
 import { checkedDist, getVersion, matchingDist } from './versions.js'
 
@@ -25,8 +24,7 @@ function npmCacheDirs() {
 // npm 5+ (cacache) files a tarball by its sha512, npm 4 and before as
 // <name>/<version>/package.tgz; ~/.audit as <org>:<name>-<version>.tgz.
 function localPaths(name, version, integrity) {
-  const hex = Buffer.from(integrity.slice('sha512-'.length), 'base64').toString('hex')
-  const npm = npmCacheDirs().flatMap((root) => [join(root, '_cacache/content-v2/sha512', hex.slice(0, 2), hex.slice(2, 4), hex.slice(4)), join(root, name, version, 'package.tgz')])
+  const npm = npmCacheDirs().flatMap((root) => [contentPath(join(root, '_cacache'), integrity.slice('sha512-'.length)), join(root, name, version, 'package.tgz')])
   return [...npm, join(homedir(), '.audit/cache/tgz', `${name.replace(/^@/u, '').replace('/', ':')}-${version}.tgz`)]
 }
 
@@ -117,7 +115,7 @@ export async function getPublishTimes(name) {
   const time = record(json.time)
   const times = new Map()
   for (const version of Object.keys(record(json.versions))) {
-    const at = readTime(Object.hasOwn(time, version) ? time[version] : undefined)
+    const at = readTime(own(time, version))
     if (at !== undefined) times.set(version, at)
   }
   return times